Drive Wiping

http://www.securityfocus.com/brief/888

Quote:

---

A computer forensics specialist has a message for security-minded computer users: A single wipe will make drives impossible to read.

~~

"Although there is a good chance of recovery for any individual bit from a drive, the chances of recovery of any amount of data from a drive using an electron microscope are negligible," Wright stated. "The fallacy that data can be forensically recovered using an electron microscope or related means needs to be put to rest."

---

Found this article linked on Slashdot ... What do you guys think? Are multiple wipes/rewrites a waste of time?

If you overwrite once, you will not be able to recover data using "normal" hardware/software techniques.

After all, if you could, how would normal software work if it is being confused by these "ghost" images?

Get yourself a nice $250,000 spin up table, some other fancy hardware and software and a >$75,000 a year technician and you have a whole new ballgame.

You have a better chance of recovery if you know what overwriting sequence was used, but there rapidly comes a point where the "ghost" is so faint that it is not decipherable. Also consider that what you are interested in might be overlaid on top of other valid data so which "layer" do you really want? And these "layers" could be at different levels depending on how many times that part of the drive has been used.

The concepts of magnetic remnance and track overlay are valid, but please remember that Guttman was writing in 1996. Hard drives are quite different these days ;)

It is not a "fallacy" as such, but I will say that the evidence seems to be based on very carefully stage managed laboratory scenarios rather than the real World.

Quote:

---

"The fallacy that data can be forensically recovered using an electron microscope or related means needs to be put to rest."

---

Until Wright can show me that he has the combined resources of the NSA, FBI and CIA; I will just mark his card "dork". We just don't know (us mere mortals that is :rolleyes:)

One thing that I can tell you from my experience in the defence industry is that if you overwrite 7 times it has gone. And if it were more classified than that it would have been physically destroyed :)

For businesses in the US, if you use Secure Erase to wipe your drives, you are covered re: liability associated with regulatory compliance e.g. HIPAA, SOX, GLB. I Boot & Nuke.

If you are really paranoid, physically destroy the drive.

I would mention that I am not aware of any commercial data recovery service that offers to recover data that has been overwritten even once. Anyone know of one?

Also, the experiments that i have read about were on a new drive with a single overwrite. The concept was certainly proven, but whether it would be practical in the real World is another matter.

I am not aware of any civilian commercial solutions. :)

You're totally right nihil ..... even software that recovers data not knowingly overwritten doesn't always recover 100% of deleted data.

I know because recently I deleted photos from my camera and had to run some undelete software. Most of the photos were fine, but one was recovered only half properly. I wouldn't begin to know where to look for data that had been overwritten ... and it's important to remember the distinction between overwritten and having had the chance to be overwritten by the camera or PC being subsequently used. I was lucky that my photos hadn't had the marked "free space" used by more photos (in that I hadn't taken more) but if I knew they'd been overwritten, then I'd have had it.

Just on the business of drive wiping, I remembered this being discussed on an old thread (indeed, I still have your wonderful copy of DBAN Nihil!), where I was told by someone I know to be very knowledgeable that a clean install of Vista would be a completely secure wipe:

Quote:

---

It overwrites all data with 0s. That's it. The data is gone for all intents and purposes. The drive certainly can't read it again...
it's technically possible that the old data still "shines through" - as in where there used to be a 1, there's now a 0.0001, and where there used to be a 0, there's now a 0.
However unless you happen to have lost the meaning of life, or the location of Osama Bin Laden on that drive, you're unlikely to get half the scientists in the world working on recovering it.

---

It was nihil who said:

Quote:

---

this is called "magnetic remnance", the other concept is "track overlay", which is where the heads don't write to exactly the same spot each time, so there are traces of previous data at the edges.

---

Here is Peter Gutmann's original article to which he has added a postscript regarding this paper.

http://www.cs.auckland.ac.nz/~pgut001/pubs/secure_del.html

Quote:

---

It overwrites all data with 0s

---

Secure drive wipe utilities use a "pseudo-random" sequence of 0's and 1's, which makes it significantly more difficult to recover the overwritten data.

*edit*
I thought I should define "pseudo-random". Check out the article below.

http://en.wikipedia.org/wiki/PRNG

Yeah ... you need special computer programs like Yarrow to truly randomise a sample, or produce scientifically accepted random data.

Take the drive to the range, put a few rounds of 9MM and it will be unrecoverable!

Way too violent...but what do you expect from a disgruntled postal worker ;)

I prefer the "better living through chemistry" approach. Drop them in a bucket of acid (no, not that acid you old fart... muriatic acid)

csr

When I was involved we would wipe the drive (software) then pulverise it (literally reduce to powder) then burn the remains.

:)

Thermite should do the trick :-P

Nice one oofki, but if you think of it, most of the makeup of a hard drive is already thermite (aluminium and iron/ferric oxide) :D

I take mine out to the tool and die shop where the older guys cut them in half with HUGH table saws and the young ones weld them back together again.

(Some times the welds actually hold)

I believe that for all intents and purposes, once a hard drive has been wiped it is probably too far gone to retrieve a worthwhile amount of data, by anyone. If you're paranoid use killdisk* or related software.

*
http://www.killdisk.com/screen.htm

This is the one I generally use:

http://eraser.heidi.ie/index.php#download

It is an open source (free) product.

Also:

http://www.dban.org/download

Another open source project. Also called "Darik's Boot & Nuke", it is available as a self booting application for CD, DVD, floppy and USB drives.

In my opinion, you need to wipe a drive externally to be certain that everything is wiped.

I use DBAN with a simple zero overwrite before doing reinstalls/ghosts. In the old days there was an option in DOS to overwrite in this way (it actually overwrote with a pattern, rather than 0 or 1). With Vista, if you select a full format it will overwrite the drive with 0.

Other versions of Windows do not do this.

The reason that I do this is to make sure that I have a level playing field, and by writing to all of the drive I will get errors if it is damaged ;)

The advantage of DBAN is that it will work with operating systems other than Windows, as it is self-contained ;)

And just to lay some myths to rest:

There is no such thing as a "low level reformat" of a modern hard drive. This can only be done at the factory.

The Gutmann 35 pass wiping isn't what people think. I think that the maximum is around 17 passes. The others are to cover drive formats that might not be recognised, and applies to old technology.

Haha in response what you said to be a little while ago Nihil, I try not to remember makes up things as such as thermite, I am dangerous enough as it is :-P