Writing over the data once, with anything, is enough. It can be all 1s, or all 0s, or all random data. It doesn’t matter. If it were possible to recover old data after an overwrite, then they would use that technology to make drives with higher capacity.
Hopefully somebody who understands more than me will be along soon to explain it.
An important difference between the way HDD and SSD work is that on an HDD when new data has to be written old date can be overwritten without erasing it first. On an SSD the storage cells have to be erased in order for new data to be written. On an HDD when a file is deleted, usually all that happens is the files entry on the filesystem is removed, but the actual data in the file is still on disk. This is how undelete programs can scan a disk and recover deleted files. On an SSD when a file is deleted the entry in the file system is removed, but the disk or operating system know the space used by the file has been deleted, so when idle the SSD will erase the blocks occupied by the deleted file, so they are ready to be written to when needed.
So, because SSDs will actively clear unused space it may be more difficult to recover deleted files. However, I’m not sure if that is true, because I’ve never had to investigate it.
Running something like DBAN on an SSD may not be effective because of the way SSDs try to balance writes to all of the different memory cells that makeup the device. The cells can wear out if changed too many times, so the drive keeps a record of how often they have been used and will try to use them evenly. So, when DBAN says, “write to 0x00, now to 0x01, now to 0x02” a HDD will just move along the disk writing, because the drive writes where it’s told (let’s ignore error remapping). An SSD might say 0x00 goes in spot 0x55, 0x01 goes in spot 0x68, 0x02 goes back in spot 0x55 (because it’s recorded as empty). So, you might not actually overwrite the whole drive using something like DBAN.
My method for wiping an SSD is to use the SSD’s security erase function, if it is available. This can often be accessed using utility programs from the manufacturer, or some third party tools like hdparm. This should erase all of the cells on the drive, so no old data remains. The other technique I use is to put a filesystem on the drive, and then create a single (or multiple) files which fill the entire disk. Because the drive has to hold all of the data, the whole thing is eventually written to. Then I’ll delete the files and use a trim/discard command to tell the drive to clear all of the now free memory cells.
It’s possible both methods may allow some data to leak, because the security erase feature may not work as intended. The filling with files method may still leave some cells with old data if they are not overwritten for some reason.
By far the best method to wipe an SSD is to only ever write encrypted data to it. Then all that has to happen is the encryption keys are wiped, and the rest of the data on the drive is rendered meaningless. Do not trust SSD’s builtin encryption, which also means don’t trust Window’s Bitlocker, unless you’ve gone to the trouble to tell Bitlocker not to use the drive’s builtin encryption, which it will do if available.
That’s a lot of stuff. I invite any real computer security experts to come along and fight my ignorance if anything I said is wrong (not just simplified).
I’d have to refresh my memory on SSD wipes, but I think echoreply pretty much nailed it. I would only add that some SSDs pad the storage to compensate for the limited number of writes each block can take over its life. So the drive is labeled as 256GB, but there’s really more physical storage space there, which is visible to the drive’s firmware but not to an OS. At least, that’s my somewhat hazy memory of it. Anyway it goes back to who you’re worried about. Are you worried that a common criminal is going to try to recover data from it? One pass is enough even on SSDs. Are you worried about the NSA? They might go to the trouble to dig into the drive to get that little but of data, but probably not even them.
And, yeah, the problem goes away if you use full disk encryption. Well, unless you’re at risk of Rubber Hose Cryptanalysis. Or the Evil Maid attack, but that’s a real edge case.
My understanding is that this padding often corresponds to the nearest power of 2, simply because making the devices in powers of two is easy.
I also note that many advertised numbers are actually in billions of bytes, rather than gigabytes. In other words, a “128GB” SSD will arrive with 119.2 GB (128,000,000,000 bytes) available. So, if the above is true, I still have over 8 GB left for over provisioning.
That said, it’s not that those cells just sit there unused. It’s that the system spreads out the writes onto more cells to avoid writing to the same cells too many times. It may also use some of them for a cache, where information is written more quickly but less efficiently, and then stored more efficiently later.
In Windows 10, if you double-click an ISO file (not program) it will mount as an optical disk. To unmount, right-click on the E: drive and click “eject”.
You need to burn the ISO file to a bootable thumb drive. There is a program call Rufus that will do that for you.
Rufus is pretty straightforward:
- At the top, select the target device (your thumb drive)
- Under boot selection, navigate to the DBAN ISO file
- Click start
When that is complete, you can boot from the thumb drive and run DBAN.
I’m basically computer illiterate, and have a simple question :
Why can’t the OP just type the old DOS command "format c: " ?
Doesn’t that erase the whole disc well enough?
Regarding secure erase on SSD drives.
The main manufacturers offer tools for maintaining their SSDs, which usually contain a secure erase function. E.g., here’s the manual (PDF) for SanDisk’s tool. (Special fun note: Their “secure erase” just wipes the pointer table. To actually erase the data you have to use their “sanitize” tool.)
The problem is that there are a bunch of lesser manufacturers who don’t offer such tools.
While a single disk overwrite is enough to wipe modern HDDs, there can be a catch in some cases: S.M.A.R.T. drives.
The disk firmware detects an iffy sector and swaps it out from a sector in a reserve pool. If you turn off S.M.A.R.T. and use a low level tool you can access such sectors and read their data. (Sectors that fail are sometimes the most used. So they could have interesting data.)
Does DBAN and such turn off S.M.A.R.T. and write all the sectors? (Tried Googling and seemed to get hits using “smart” in the ordinary sense.)
Unfortunately no. All that does is erase the index to the data.
A full erase can take several hours. You have to write random data over the disk to make the data unrecoverable. That’s usually good enough for all practical purposes.
Even then though, there are ways to recover old data. That requires fairly involved, expensive, time consuming and expensive efforts. So if someone is doing that, it’s probably a government or law enforcement.
I don’t believe the manufacturer would engage in silly shenanigans. If it says 128 GB, I expect 128000000000 bytes of user-available storage, because that is the standard meaning, contrary to what you are suggesting.
What happens is, between you and the chips providing that storage is controller hardware that implements error correction/management and wear leveling. Each memory page may have “extra” bits available for this purpose, which are invisible to the user, powers of two or no powers of two. Furthermore, even when it leaves the factory, the chip is only guaranteed to have a number of valid blocks above a certain threshold, not 100% of them. Since there may be bad blocks, in order to guarantee those 128 GB there must be extra blocks available for the controller to work around the bad ones and store internal tables.
In short, you need to rely on a “block erase” command that is able to erase all the physical memory blocks, not just whatever normally appears to the user, which is what DBAN wipes out.
How is it done, and what types of magnetic discs / flash memory are vulnerable?
I was going from memory, but a quick search turned up this reference: http://www.nber.org/sys-admin/overwritten-data-guttman.html
I guess the danger is more theoretical than real, but it seems to be at least theoretically possible to recover data even if you have overwritten it.
To expand slightly if this isn’t clear: when you delete files from a hard drive or format it, the computer doesn’t actually “delete” the data (because it would both be slow to do so and would probably shorten the lifespan of drives dramatically). Your drive has a table of contents where it stores info like, “picture.jpg is stored in location 15340 - 15420.” When you delete it, all the hard drive does is delete that pointer, so it now doesn’t think picture.jpg exists and thinks locations 15340-15420 are free to use. However, the data for picture.jpg is actually still there, and software exists that can find and reassemble it very easily. When you format a drive, all you’re doing is deleting the WHOLE list of pointers; all the data still sits exactly where it was.
To prevent that, you need to overwrite the data on the drive. Apps like DBAN will basically overwrite ever location on the drive with random 1s and 0s to make the original file data impossible to access.
This brings up an interesting question about format. We have two methods, quick format and full format.
What are the difference?
Why are you discarding a working computer? Donate it to one of the many charitable organizations that refurbish old computers and make them available to poor people. They have experts who regularly clean machines, erase data, and reset the operating system. (With a machine this old, they will probably install a Linux OS & applications. So even more likely to completely obscure whatever data is there now.)
Remember, it’s Reduce, then Reuse, and only after that Recycle.
A quick format recreates the file structure.
A full format takes longer because it checks the drive for bad sectors before recreating the file structure.
In both cases the new file structure is empty. However, someone with the appropriate tools can recover the data pretty easily.
Here is my experience. I got the dban and also a program called universal usb installer and installed it on a usb. When I tried to boot my old computer from the usb, it turned out that was not on the boot list. The old computer did have a CD reader and booting from a CD/DVD was an option. So I put the dban on a memory stick and clicked on the .iso file and, lo and behold, it offered to burn a CD. I had some blank CDs and no further use for them so I put one in and burned it. I also set the boot sequence to CD/DVD and tried to boot from it. I know CDs take a long time to boot, but a half hour later all I had was a black screen.
It is a laptop and I don’t have a tool to open it. Maybe a table saw if I had one. I’m to that point now. And my wife wants it our of the house (we are preparing to move).
Finally, I discovered that a very tiny phillips screw driver will unscrew the screws on the underside and I was lucky to be able to find the compartment that held the disk on my second try and have taken it out. I will take the computer to the recycling place and the hard drive to my office and ask the sysop to do what she will with it.
I would have been perfectly happy to donate it to charity. But it wasn’t working very well (wouldn’t download stuff from the inet, although it connected immediately to my home network–one of the reasons I want the disk wiped.
Sounds more like a software rather than hardware problem. A disk wipe, OS reinstall would likely have resulted in a reasonably working computer with no hazards to you.
I agree that donating is always best, but I’ll also say that donation facilities may actually not even accept a machine this old. Worth asking, but a lot of them don’t really want older desktops. There’s not enough demand, and much newer desktops are cheap and plentiful enough to fulfill demand. XP-era systems are likely to just go straight to recycling, maybe after having the wires stripped.
Also, I would still recommend wiping your harddrives before donating a system. In my experience, wiping the hard drive data is NOT done when machines are received, only when the drive is eventually reused. This means that, if your system is parted out (and most are), that drive will be sitting on a shelf where any of the young, bored volunteers could grab it and use a usb adapter to check out the drive contents. Or somebody could buy the drive off the shelf (since these centers usually sell parts to the community) and walk out the door with your personal data intact. Not a SUPER high risk, but easy to avoid. Pretty sure the center I volunteered for actively encouraged people to wipe their drives before donating.
I got my Amazon Fire 8" Tablet for $50. Old computers cannot compete with this. It is portable and self contained. You can use your phone link up or wifi for access to the internet.