Wiping data from drive question

Discussion in 'Computer Security' started by Doofus McFly, Jun 14, 2006.

  1. Doofus McFly

    Doofus McFly Guest

    A co-worker made a statement that data is recoverable from a hard drive even
    after you write zeros to all sectors of the hard drive. I was always under
    the impression that once you wrote zeros to all sectors that any data that
    was there is impossible to recover. Does anyone have any thoughts on this?
    Thanks!
     
    Doofus McFly, Jun 14, 2006
    #1
    1. Advertising

  2. Doofus McFly

    imhotep Guest

    There are techniques where you can retrieve some data because if a place on
    the disk had a "1" for a long period of time, theoretically, then changed
    to a "0" (you wiped the disk) there would be a "shadow" of a "1" left. You
    have to write a combo of zeros and ones many, many times say 10,000
    times....

    Imhotep

    Doofus McFly wrote:

    > A co-worker made a statement that data is recoverable from a hard drive
    > even after you write zeros to all sectors of the hard drive. I was always
    > under the impression that once you wrote zeros to all sectors that any
    > data that was there is impossible to recover. Does anyone have any
    > thoughts on this? Thanks!


    --
    *************************************
    Pass a Net Neutrality Law in the US!!!!

    Save the Internet:
    http://www.savetheinternet.com/

    Its our net:
    http://www.itsournet.org/

    *************************************
     
    imhotep, Jun 14, 2006
    #2
    1. Advertising

  3. Doofus McFly

    kony Guest

    On Tue, 13 Jun 2006 18:30:08 -0700, "Doofus McFly"
    <> wrote:

    >A co-worker made a statement that data is recoverable from a hard drive even
    >after you write zeros to all sectors of the hard drive. I was always under
    >the impression that once you wrote zeros to all sectors that any data that
    >was there is impossible to recover. Does anyone have any thoughts on this?
    >Thanks!



    Merely overwriting it once with the same digit will allow a
    professional with specialized equipment to recover "some" if
    not all of the data, at great cost (computer repair shop or
    the like could not do it).

    Random overwriting with a couple of passes makes it MUCH
    more difficult, practically impossible. The prior poster is
    incorrect about 10,000 passes, a couple of random passes is
    sufficient but prudence with sensitive data would suggest at
    least 3 or 4 passes.
     
    kony, Jun 14, 2006
    #3
  4. Not impossible but very unlikely without access to the proper equipment and
    having the necessary skills. It may take a little longer but it is a good
    idea to erase to DOD standards or better which most erase programs will
    allow you to do. With XP Pro or Windows 2003 you can use cipher /w to do a
    decent quick job of overwriting data. A sledge hammer and bucket of
    sulphuric acid is probably the most secure solution for permanent
    destruction of data but should not be attempted by amateurs. What I find
    shocking is the lack of simple security procedures being used such as the
    idiot that had a disk with sensitive data on all military retires at his
    home unsecured with no encryption. --- Steve


    "Doofus McFly" <> wrote in message
    news:...
    >A co-worker made a statement that data is recoverable from a hard drive
    >even after you write zeros to all sectors of the hard drive. I was always
    >under the impression that once you wrote zeros to all sectors that any data
    >that was there is impossible to recover. Does anyone have any thoughts on
    >this? Thanks!
    >
    >
    >
    >
     
    Steven L Umbach, Jun 14, 2006
    #4
  5. kony wrote:

    > Random overwriting with a couple of passes makes it MUCH
    > more difficult, practically impossible. The prior poster is
    > incorrect about 10,000 passes, a couple of random passes is
    > sufficient but prudence with sensitive data would suggest at
    > least 3 or 4 passes.


    The randomness isn't needed either. Zeros will do as well.
     
    Sebastian Gottschalk, Jun 14, 2006
    #5
  6. Steven L Umbach wrote:
    > It may take a little longer but it is a good
    > idea to erase to DOD standards or better which most erase programs will
    > allow you to do. With XP Pro or Windows 2003 you can use cipher /w to do a
    > decent quick job of overwriting data.


    If you read the documentation on how the SDelete utility from
    Sysinternals works (same applies to the utility Eraser), then you might
    understand that file system cache, harddrive cache, journaling (which is
    common on NTFS) and data relocation pose a very real threat to such
    simple methods, making them fail so blatantly when not carefully considered.

    And even then you should be aware of bad sector relocations of your
    harddrive. At least SCSI 2 always and SATA optionally, but not IDE
    allows you to retrieve a list of bad sectors that are normally hidden
    from the view. Still you won't be able to see their data content or to
    overwrite them.
     
    Sebastian Gottschalk, Jun 14, 2006
    #6
  7. Doofus McFly

    Guest

    Sebastian Gottschalk wrote:
    > kony wrote:
    >
    > > Random overwriting with a couple of passes makes it MUCH
    > > more difficult, practically impossible. The prior poster is
    > > incorrect about 10,000 passes, a couple of random passes is
    > > sufficient but prudence with sensitive data would suggest at
    > > least 3 or 4 passes.

    >
    > The randomness isn't needed either. Zeros will do as well.


    The randomness IS necessary. If the recovery specialist knows that the
    data was zeroed, then he has a better chance of getting recoverable
    data. The ones would make themselves known. But if the pattern is
    random, the task becomes much harder.
     
    , Jun 14, 2006
    #7
  8. wrote:

    >> The randomness isn't needed either. Zeros will do as well.

    >
    > The randomness IS necessary. If the recovery specialist knows that the
    > data was zeroed, then he has a better chance of getting recoverable
    > data. The ones would make themselves known. But if the pattern is
    > random, the task becomes much harder.


    The new data has no significant, if any influence on how its noise
    cancels out rest signals of old data. Actually in modern harddisks
    there's hardly any difference between zeros and ones without knowing the
    context, doing a very careful signal estimation and utilizing a lot of
    error correction codes - a short glimpse at the signal would essentially
    show you no difference to a noisy sinus wave.
     
    Sebastian Gottschalk, Jun 14, 2006
    #8
  9. Doofus McFly

    kony Guest

    On Wed, 14 Jun 2006 07:47:45 +0200, Sebastian Gottschalk
    <> wrote:

    >kony wrote:
    >
    >> Random overwriting with a couple of passes makes it MUCH
    >> more difficult, practically impossible. The prior poster is
    >> incorrect about 10,000 passes, a couple of random passes is
    >> sufficient but prudence with sensitive data would suggest at
    >> least 3 or 4 passes.

    >
    >The randomness isn't needed either. Zeros will do as well.


    No, 0 or 1 is only an absolute based on a threshold. If one
    doesn't "round off" to a threshold but takes absolute values
    the signature from a same-bit fill can distinguish the prior
    data.

    Now, if you were to continually overwrite the same areas,
    over and over again with zeros, this would work better, but
    not ideally, and why would one want to do that several more
    times than it would take to write randomly? There would be
    no reason to do it.
     
    kony, Jun 15, 2006
    #9
  10. Doofus McFly

    kony Guest

    On Wed, 14 Jun 2006 10:05:30 +0200, Sebastian Gottschalk
    <> wrote:

    > wrote:
    >
    >>> The randomness isn't needed either. Zeros will do as well.

    >>
    >> The randomness IS necessary. If the recovery specialist knows that the
    >> data was zeroed, then he has a better chance of getting recoverable
    >> data. The ones would make themselves known. But if the pattern is
    >> random, the task becomes much harder.

    >
    >The new data has no significant, if any influence on how its noise
    >cancels out rest signals of old data. Actually in modern harddisks
    >there's hardly any difference between zeros and ones without knowing the
    >context, doing a very careful signal estimation and utilizing a lot of
    >error correction codes - a short glimpse at the signal would essentially
    >show you no difference to a noisy sinus wave.



    We're not talking about a short glimpse, rather someone who
    is experienced and _trying_ to recover the data with the
    correct equipment.
     
    kony, Jun 15, 2006
    #10
  11. kony wrote:

    > We're not talking about a short glimpse, rather someone who
    > is experienced and _trying_ to recover the data with the
    > correct equipment.


    You may or may not notice that just signal evaluation in a normal read
    process today is just about recover. If there were any significant
    redundancies left, we'd exploit them to store more data.
     
    Sebastian Gottschalk, Jun 15, 2006
    #11
  12. kony wrote:

    > Now, if you were to continually overwrite the same areas,
    > over and over again with zeros, this would work better, but
    > not ideally, and why would one want to do that several more
    > times than it would take to write randomly? There would be
    > no reason to do it.


    This is just bullshit argumentation.

    As the rest signal is independent from the new data, there's essentially
    no difference with what exactly you overwrite.
     
    Sebastian Gottschalk, Jun 15, 2006
    #12
  13. Doofus McFly

    kony Guest

    On Tue, 13 Jun 2006 22:06:43 -0500, "Steven L Umbach"
    <> wrote:

    >Not impossible but very unlikely without access to the proper equipment and
    >having the necessary skills. It may take a little longer but it is a good
    >idea to erase to DOD standards or better which most erase programs will
    >allow you to do. With XP Pro or Windows 2003 you can use cipher /w to do a
    >decent quick job of overwriting data. A sledge hammer and bucket of
    >sulphuric acid is probably the most secure solution for permanent
    >destruction of data but should not be attempted by amateurs.


    I often hear of these excessive methods and just pass it off
    as overkill but effective.

    It isn't really effective at all. If one has done the
    random-overwrite the data is already gone- end of story.
    If one has not done the random overwrite and intends to
    remove the drive for later destruction, it is only
    subjecting the drive to more potential for it to fall into
    the wrong hands, hands that would obviously be willing to go
    to extremes to get it... if they're a problem making
    ultimate destruction of data important in the first place.

    Attended and immediate multiplass overwrite at the moment
    the data is wished destroyed is the most safe method. Any
    extra time spent physically destroying the medium is
    probably better spent just standing around, watching those
    around you for suspicious activity.
     
    kony, Jun 15, 2006
    #13
  14. Doofus McFly

    kony Guest

    On Thu, 15 Jun 2006 02:04:17 +0200, Sebastian Gottschalk
    <> wrote:

    >kony wrote:
    >
    >> We're not talking about a short glimpse, rather someone who
    >> is experienced and _trying_ to recover the data with the
    >> correct equipment.

    >
    >You may or may not notice that just signal evaluation in a normal read
    >process today is just about recover. If there were any significant
    >redundancies left, we'd exploit them to store more data.



    In a cheap-to-make, mass produced drive this would be true.
    In a spare-no-expense, recover-valuable-data scenerio, the
    minor differences are what is important.
     
    kony, Jun 15, 2006
    #14
  15. Doofus McFly

    kony Guest

    On Thu, 15 Jun 2006 02:06:09 +0200, Sebastian Gottschalk
    <> wrote:

    >kony wrote:
    >
    >> Now, if you were to continually overwrite the same areas,
    >> over and over again with zeros, this would work better, but
    >> not ideally, and why would one want to do that several more
    >> times than it would take to write randomly? There would be
    >> no reason to do it.

    >
    >This is just bullshit argumentation.
    >
    >As the rest signal is independent from the new data, there's essentially
    >no difference with what exactly you overwrite.



    Every single article on the subject disagrees with you.
    Read a few.
     
    kony, Jun 15, 2006
    #15
  16. kony wrote:
    > On Thu, 15 Jun 2006 02:04:17 +0200, Sebastian Gottschalk
    > <> wrote:
    >
    >> kony wrote:
    >>
    >>> We're not talking about a short glimpse, rather someone who
    >>> is experienced and _trying_ to recover the data with the
    >>> correct equipment.

    >> You may or may not notice that just signal evaluation in a normal read
    >> process today is just about recover. If there were any significant
    >> redundancies left, we'd exploit them to store more data.

    >
    >
    > In a cheap-to-make, mass produced drive this would be true.
    > In a spare-no-expense, recover-valuable-data scenerio, the
    > minor differences are what is important.


    A very optimistic estimation gives that you can recover bits with a
    median certainty of 50.4% correctly. And random overwrites don't change
    anything about that,
     
    Sebastian Gottschalk, Jun 15, 2006
    #16
  17. kony wrote:

    >> As the rest signal is independent from the new data, there's essentially
    >> no difference with what exactly you overwrite.

    >
    > Every single article on the subject disagrees with you.
    > Read a few.


    Strange enough Mr. Gutmanm fully agrees with me. I haven't found any
    scientific article disagreeing. Can you point me to one?
     
    Sebastian Gottschalk, Jun 15, 2006
    #17
  18. Doofus McFly

    Leythos Guest

    In article <>, says...
    > kony wrote:
    >
    > >> As the rest signal is independent from the new data, there's essentially
    > >> no difference with what exactly you overwrite.

    > >
    > > Every single article on the subject disagrees with you.
    > > Read a few.

    >
    > Strange enough Mr. Gutmanm fully agrees with me. I haven't found any
    > scientific article disagreeing. Can you point me to one?


    I would suggest that you both read the following:
    http://csrc.nist.gov/publications/drafts/DRAFT-sp800-88-Feb3_2006.pdf


    --


    remove 999 in order to email me
     
    Leythos, Jun 15, 2006
    #18
  19. Doofus McFly

    kony Guest

    On Thu, 15 Jun 2006 08:44:23 +0200, Sebastian Gottschalk
    <> wrote:

    >kony wrote:
    >
    >>> As the rest signal is independent from the new data, there's essentially
    >>> no difference with what exactly you overwrite.

    >>
    >> Every single article on the subject disagrees with you.
    >> Read a few.

    >
    >Strange enough Mr. Gutmanm fully agrees with me. I haven't found any
    >scientific article disagreeing. Can you point me to one?


    You don't bother to reference this "Gutmanm" and yet I am
    supposed to find articles for you? It is well known, the
    WHOLE PURPOSE of the random overwrite strategy used
    countless times by anyone, anywhere (everywhere).

    I suppose you mean Peter Gutman, but are you referring to
    his work a decade ago (when HDD densities were a fraction of
    what they are now) or something more recent? You need to
    provide a specific quote, WITH the context, if you want to
    claim Gutman is in agreement with what you claim TODAY...
    because back then he was of the opinion that the goal was to
    flip the bits back and forth unpredictably, in a random
    pattern, not pseudo-random and NOT all zeros as you suggest.
     
    kony, Jun 15, 2006
    #19
  20. kony wrote:

    > It is well known, the WHOLE PURPOSE of the random overwrite strategy
    > used countless times by anyone, anywhere (everywhere).


    It is well known to the uninitiated, but not in any scientific context.

    > I suppose you mean Peter Gutman, but are you referring to his work a
    > decade ago (when HDD densities were a fraction of what they are now)
    > or something more recent?


    Read Gutman's article and try to understand the content. He told that
    his ideas exactly apply to any modern drives and about any future drive
    with the same technology, and that only special cases of old, really
    low-density drives must be considered carefully.

    > You need to provide a specific quote, WITH the context, if you want
    > to claim Gutman is in agreement with what you claim TODAY... because
    > back then he was of the opinion that the goal was to flip the bits
    > back and forth unpredictably, in a random pattern, not pseudo-random
    > and NOT all zeros as you suggest.


    No. He was the opinion that doing so is absolutely unnecessary and just
    added for safety, which also applies to the large number of passes. Now
    RTFA.
     
    Sebastian Gottschalk, Jun 15, 2006
    #20
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. UnderDog

    Wiping hard drive fdisk/mbr?

    UnderDog, Aug 16, 2003, in forum: Computer Support
    Replies:
    7
    Views:
    1,210
    Patrick
    Aug 26, 2003
  2. ftran999

    need advice on wiping hard drive

    ftran999, Sep 15, 2004, in forum: Computer Support
    Replies:
    4
    Views:
    2,041
  3. ROBERT BROOKS

    wiping a drive

    ROBERT BROOKS, May 8, 2005, in forum: Computer Information
    Replies:
    1
    Views:
    334
    Uncle Andy
    May 8, 2005
  4. Tranqility

    Wiping Hard Drive Clean?

    Tranqility, Dec 6, 2005, in forum: Computer Support
    Replies:
    18
    Views:
    681
    Mr. Foster Freeze
    Dec 9, 2005
  5. Trevor
    Replies:
    0
    Views:
    474
    Trevor
    Dec 30, 2007
Loading...

Share This Page