Best Way to Wipe a HDD

So, it's pretty well established that it's almost impossible to permanently, irreversibly erase data from a hard drive, but I do understand that it can be made ridiculously, unimaginably hard to recover.

So what do you think is the best way to do it? Is a clean reformat enough? What programs do you prefer to go a step further than that? I've heard of programs that basically "insert blanks" (as I'm told) to clean a HDD well.

Reason I'm asking is we're getting ready to donate an old computer to a charitable organization out there that just got flooded (lost ALL of their computers). Since where I work is a financial company, however, making sure HDDs that we get rid of are totally clean is a BIG issue.

So what do you suggest?

I recommend writing random bits to the entire drive more than once as a simple way to make data very hard to recover. Check out DBAN (Darik's Boot and Nuke) for your wiping needs. I think it will fit the bill nicely.
Of the five different wipe methods it offers, it has at least one that meets the American DoD 5220-22.M Standard Wipe requirements. (Features.)

- X

Do you need to re-use the HDD's ?
Are they going out of your 'sphere of influence' [sold / given away]

There are a variety of commercially available apps that will do the job to remove data beyond recovery [economical recovery that is]

If you are just trashing them, then de-gaussing will obliterate the data AND destroy the platters [no more magnetic data on a platter that can no longer be magnetically changed]

if selling / giving away :
remove and trash those HDD's from sensitive machines,[servers ?] replace for your client [assuming client to be unable to supply their own HDD]

run clean-up apps on the rest .............

Pax
HTH

DoD 5220-22.M is not good enough for top-secret data destruction. Those platters are electronically, chemically and physically "destroyed”. Then the pile of sh!t is hauled off by a truck to a undisclosed location. At least that's what I saw on the history channel about the pentagon, where they incinerate all of their paper trash on site. Where cost is king and where the data is worth that amount to have destroyed.

If you’re that concerned and have the time, hook them up to a faster CPU and do more than 3 passes. But I wouldn't do one just from an app through the OS. Booting is my preferred method.


http://www.dss.mil/isec/nispom.htm

It cost money to really recover hardcore.

The best way to destroy the data on that harddisk would of course be by using a sledgehammer to smash it into pieces and then burn whatever remains just to make sure...

But okay, you want someone else to be able to use this harddisk so destruction of the disk is not an option... So you should start with a low-level format of the harddisk. Then, as has been suggested, use some tool that will write random characters over every part of the harddisk. I think that Symantec has a tool called WipeDisk that could do this. Once it wiped the disk, just low-level format the disk again, with a second WipeDisk action.
The next step is a simple one. Install Windows (or Linux) back on it. If you give that PC away, you'd probably want the recipient to have some operating system running on it too.

The drawback, however, is that people with advanced tools might still be able to read some of the data that you stored on those harddisks. They will need very advanced equipment for that, though.
Another drawback is of course that wiping a big harddisk in a secure way is very time-consuming. A harddisk of 60 GB could take half a day or even more before it's completely wiped.

About that Symantec WipeDisk... I think that in their most advanced cleaning setup, they are NOT writing zero's to the disk but it writes some kind of pattern on it, and repeats writing different patterns to the same area a few times. It is pretty secure, yet still not as sure as the sledgehammer technique...

arch welders

Burn several holes through the case. No one can retrieve the data. Period!

Lol guys, I think DBAN, mentioned earlier, will be just fine in this case. No one's gonna take an electron microscope to these HDD's.

I once got a shitty laptop from a former employer......that was fun......had alot of "Your eyes only". /me goes back to lurking in the dark.

I think it primarily depends on what you intend to do with it..Ppl who want to go to such extremes to get the data no matter what must really have a good reason for doing that..T he mafia for example comes to mind..lol:D

I'v said it before and I'll say it again, throw the thing in a river :p

Buy a Seagate (see my post in hardware), they seem to be doing a great job of making themselves unrecoverable for me. Unfortunately this seems to happen on the drive's schedule and not mine.

cheers,

catch

Well,

1. Wipe your data
2. Boot into safe mode and defragment the drive
3. Wipe the freespace

Then wipe the operating system if you want to.

Whilst the previous comments on data recovery are possible, they are not practical in this situation. There was a guy on here a few weeks back who was quoted $1,200 - $1,500 just to recover a corrupted drive.

:)

2 words.

deleted. isnt.

The only sure fire way I have found to erase info from a hard disk and make it unrecoverable is to totally destroy it. then burn it. then nuke it. then give it to my kid brother for the day. then leave it in a subteranian underground layer in a pool of acid for the day. Then pour moulten lava on it. then throw it under a train. then tell mr t it called him a monkey. then use it to hotwire a car. then have luke sky walker play baseball with it. then allow it to complete the T-Rex feeding cycle. Then spread it with cheese and take it to a comic convention. then tell Saddam it is not his.

Even after all this. There is still a chance.

So in short if it has that picture of you and the wife doing that wheel barrow race thing or has personal financial info etc. Just hit it with a brick and burn the remains.

Let's skip all the dramatics for a moment, all you need to do is practice due diligence.

Just format the drives, audit the drive to ensure the format was successful, document the process, have it notarized (you should do these last two no matter what method you choose) and be done with it.

cheers,

catch

Yeah, Thats Great catch.

other than the fact that if you format a drive it would take me all of about 10 seconds to put the original fat back on it and recover all the files.

Like I said. What you want to do is.

The only sure fire way I have found to erase info from a hard disk and make it unrecoverable is to totally destroy it. then burn it. then nuke it. then give it to my kid brother for the day. then leave it in a subteranian underground layer in a pool of acid for the day. Then pour moulten lava on it. then throw it under a train. then tell mr t it called him a monkey. then use it to hotwire a car. then have luke sky walker play baseball with it. then allow it to complete the T-Rex feeding cycle. Then spread it with cheese and take it to a comic convention. then tell Saddam it is not his.

Given that you are giving away the machine you need to ask yourself a few questions:

1. What information is/was on this box?
2. How confidential are those data?
3. How much are you prepared to pay?

If there is nothing of importance on the machine then a simple wipe will suffice, such as I suggested.

If there is confidential information on the drive then I would suggest removing it and supplying the system without a HDD or just sticking a cheap second hand one in it. You have still made a decent contribution?

Find out how your organisation normally disposes of redundant/obsolete equipment. Unless you are a very young institution, you MUST have a process.

Are we talking a PC or a server here? If it is a desk top and DOES have confidential information on it, I would suggest that you have some serious internal security flaws?

If it is a server, and has confidential information on it I would recommend removal and destruction of the drives and a re-build to suit the scale of the recipient. They might reasonably want to use a different RAID array from a financial institution, for example?

Maybe a compromise, by bringing in someone who has obsolete drives that have been replaced but never contained any sensitive data?...........process control stuff, for example?

If they still work someone might have hung on to them?

just a few thoughts :)

mark_boyle2002... seriously, cut the dramatics.

It doesn't matter if you can recover the data or not, what matters for this question is mitigating the original poster's liability. So maybe we should leave the T-rex, Mr. T BS out of the picture and try to keep the conversation productive.

Because you know what? If he formats the drive, documents the process and someone recovers all the information neither he nor his company can be held liable as this is an inductry accepted method of removing data from drives.
If he follows your advice and even one piece of confidental data survives, his company can be sued and he will be fired, if not had criminal charges brought against him for using an unrecognized method of data removal.

cheers,

catch

Thanks all for a TON of very informative comments.

Thankfully, there was no critical data on the drive. It was just company policy that since we are a financial compnay, ALL HDDs must have their data destroyed before they leave our hands. So even though there was nothing noteworthy on it, I still had to wipe it for policy's sake, and do so somewhat convincingly. That being the case, Xierox's solution suited me just fine.

But the rest made for some excellent discussion, and I'm definately learning something.

Most of companies that makes HD's, have programs that can wipe whole HD by writing zero to all clusters. UBCD have most complete collection of tools for this, I think.

To save OS is simple, just copy whole windows to another harddrive(backup server), then clear HD, format it, copy whole windows back and restore boot sectors.
In windows 9x/me "sys c:" for windows xp/2k boot from CD and use "fixboot" or/and "fixmbr"

Quote:

---

Originally posted here by MrBabis
Most of companies that makes HD's, have programs that can wipe whole HD by writing zero to all clusters.

---

This is not really a secure wipe because it's not terribly hard to figure out what the previous value of the bit was when you know the entire drive had the same bit (in this case 'zero') written to it.

- Xierox

The ultimate boot cd has a few utils that allow you to really wipe the HDD

http://www.ultimatebootcd.com

Quote:

---

Originally posted here by catch
Let's skip all the dramatics for a moment, all you need to do is practice due diligence.

Just format the drives, audit the drive to ensure the format was successful, document the process, have it notarized (you should do these last two no matter what method you choose) and be done with it.

---

Don't you mean due care?

In any case I would say that for confidential data formatting is not enough. A good run of a wiper, such as BCWipe would do the trick nicely. If the data was just regular old documents and such then formating would be perfectly fine.

The destruction of the drive could be used in the most direst of situations, but what you really need to consider is the cost/benefit of the process. What is the loss you could take if the data was found vs. the cost it would take to destroy the media. My opinion is wiping the drive mitigates the risk to an acceptable level.

I was once interested in the destruction of data - you can use the degaussing ring from an old TV or monitor - although be careful cos those things run on mains...

I take great pleasure in smashing drives up with a hammer, but i've never *really* needed to. The material they make the disks out of is pretty boring and you get no sparks when you grind them up, although you can drill though them surprisingly easily.

Its amazing though becuase i bought about 20 old hard disks from a car boot sale (yard sale?) and went though all of them to see whether there was anything juicy on them - yes i know im a nosey bastard.... and its surprising how many people store there details and stuff in plain text and then sell there drives off for £0.20 a piece. They must of come from a company becuase there were loads of excel spreadsheets, and internal memos which could of been exploited for the means of social engineering.

i2c

Quote:

---

Don't you mean due care?

---

No, if I meant due care, I would have said that. Considering the definitions of "diligence" are:

1. Earnest and persistent application to an undertaking; steady effort; assiduity.
2. Attentive care; heedfulness.

diligence is a more appropriate choice as in this case it deals with persistence of the security policy and industry best practices. "Due care" would be cleaning the drive in the way you see fit and not the way deemed acceptable by the policy/industry.

Quote:

---

The destruction of the drive could be used in the most direst of situations, but what you really need to consider is the cost/benefit of the process. What is the loss you could take if the data was found vs. the cost it would take to destroy the media. My opinion is wiping the drive mitigates the risk to an acceptable level.

---

My opinion is that you have no clue of the asset value on the drive or the exposure factor, consequently you have no basis for calculating the risk involved much less its appropriate mitigation. You are just looking at throwing superfluous safeguards (which are not recognized as industry best standard so if any data is recovered, hello lawsuit, goodbye job) at the situation with no regard for (hell, no knowledge of) requirement or cost.

cheers,

catch

Well,

1. Strictly speaking you should already have a documented and repeatable process for equipment disposal, which would include HDDs. (You would need that for CMM level 3?)

2. In the defence, intelligence and military sectors, sensitive materials are physically destroyed, in accordance with a clearly defined process. Less important data are wiped according to a standard approved by the DoD, MoD or whoever.

3. Whilst a simple re-formatting is adequate for materials that are to be re-used internally, this is not adequate for anything that is leaving the organisation. It is far too easily recovered. The industry standard (for those who actually have standards :D ..........and many do not) is to use a military/government approved methodology. This is quite natural, as it makes a much stronger case in court than an "industry standard" that may well be flawed, government standards being generally more acceptable than private sector ones in this area. The process includes formatting but has the additional overwriting procedures. I suspect that the rationale behind this is that I might "accidentally" recover a formatted drive, but if I recover a wiped drive that would be a very deliberate action? "Malice and aforethought" and all that sort of thing?

4. I agree with the documentation part. As disposal of any asset requires some sort of formal authorisation process (or it SHOULD do), the data wiping documentation would logically seem to belong here? (I know, I know.................spoken like a true auditor..........but audits cost money so why not make things quick and easy for them? :D )

Just my thoughts..............

Quote:

---

Originally posted here by catch
Let's skip all the dramatics for a moment, all you need to do is practice due diligence.

Just format the drives, audit the drive to ensure the format was successful, document the process, have it notarized (you should do these last two no matter what method you choose) and be done with it.

cheers,

catch

---

Quote:

---

Originally posted here by catch
My opinion is that you have no clue of the asset value on the drive or the exposure factor, consequently you have no basis for calculating the risk involved much less its appropriate mitigation. You are just looking at throwing superfluous safeguards (which are not recognized as industry best standard so if any data is recovered, hello lawsuit, goodbye job) at the situation with no regard for (hell, no knowledge of) requirement or cost.

cheers,

catch

---

Are you talking in circles? You say first to just format it and document it, and then in the next say that wiping the drive is not in the industry best standard because data could be recovered? If you plan to reuse a drive with confidential data on it you need to make the best effort to be certain that the drive is indeed unrecoverable. A signed document isn't going to save your job when the guy next to you says that he wanted to wipe that drive but all you cared about was getting your paperwork notorized.

No, I don't know the qualitative risk that is involved in the data being recovered, but if someone was to tell me its financial data I would quantitatively rank it with some importance. This might mean taking a little extra effort to make sure that the data is not recoverable. This results in a multipass wipe of the drive which doesn't drive up the cost.

Indeed I do not know if there are any special requirements set forth by his company, but neither do you. We only have the information that he provided which everyone made their recommendations based on.


Due care: The care that a reasonable man would exercise under the circumstances; the standard for determining legal duty

Due dilligence: The process of systematically evaluating information, to identify risks and issues relating to a proposed transaction.(ie verify that information is what it is proposed to be).

Dilligence is research what you should do, and care is actually performing the actions. Both are needed, it just seemed like you were offering more actions to be done than research.

While I have noticed some very good replys. Lost of people mention zero'ing out the drive is sufficient. I know somone that claims to have an app that will restore a drive zero'ed out up to 8 times over. I have never seen this in operation, but he claims to have restored crashed drives with the application to get them up long enought xfer data. *Shrugs* could be a lie, who knows.....
Also,
I had to take a client's think-pad HD to data recovery specialest to recover some time sensitive unique data. The place that I took it to prided theirselves on their recovery succcess rate and had some pictures of various drives where data had been recovered. Among these included Hard Drives damaged in Fires and Floods. They were good. They recovered everything from a Laptop drive for me that was no longer recognized by the computer. Yes, they were expensive. But just know that some people are willing to pay the price. When you add curiosity to the factor, you have to ask yourself how much one would pay for a key to open a chest of unknown contents.

Quote:

---

3. Whilst a simple re-formatting is adequate for materials that are to be re-used internally, this is not adequate for anything that is leaving the organisation. It is far too easily recovered. The industry standard (for those who actually have standards ..........and many do not) is to use a military/government approved methodology. This is quite natural, as it makes a much stronger case in court than an "industry standard" that may well be flawed, government standards being generally more acceptable than private sector ones in this area. The process includes formatting but has the additional overwriting procedures. I suspect that the rationale behind this is that I might "accidentally" recover a formatted drive, but if I recover a wiped drive that would be a very deliberate action? "Malice and aforethought" and all that sort of thing?

---

While it is true that US DOD/MIL standards are far more secure than commercial standards, companies need to take care if they plan on picking and choosing.
Why follow high assurance data destruction techniques when low assurance data storage techniques are used? Sooner or later someone, be it an auditor, stockholders, someone is gonna ask the following question:

Why are we wasting the resources on making this one area high assurance when nothing else we do is?

Then people get laid off, and new policy is written.

cheers,

catch

Hi, fraggin

I can well believe it. A reasonably secure wiping sequence will use 0's 1's in a random sequence and intersperse with writes of random 0's and 1's.

If you repeatedly overwrite with the same character, it is relatively easy to unravel the overwrites.

;)

Quote:

---

Are you talking in circles? You say first to just format it and document it, and then in the next say that wiping the drive is not in the industry best standard because data could be recovered?

---

Nowhere did I say that wiping the drive is not the industry best standard because data can be recovered. What I said was:

"You are just looking at throwing superfluous safeguards (which are not recognized as industry best standard so if any data is recovered, hello lawsuit, goodbye job)"

Meaning that if you wipe the drive, and or do anything to the drive that isn't considered an industry best practice and IF any data is recovered you are in worse standing than if you used the industry best practice and the same data were recovered.
No circles.

Quote:

---

A signed document isn't going to save your job when the guy next to you says that he wanted to wipe that drive but all you cared about was getting your paperwork notorized.

---

No, but it will save your job and lose his when you remind the seniors that the guy next to you was wanting to needlessly waste resources so that you can have high assurance data destruction, even though you are utilizing low assurance data storage. (how do I know he is using low assurance data storage? if he wasn't he'd already have a policy on data destruction)

Quote:

---

This results in a multipass wipe of the drive which doesn't drive up the cost.

---

Yes it does, you need to acquire the tools to do this (things), and you need tools that offer some level of assurance (more expensive tools) that they actually do what you think they are doing. Then you need someone to apply the tools to the drive (time). Then you actually need a more complicated audit to ensure the tool worked properly in this instance (more time), unless you just check to see the drive was formatted, in which case you've done nothing more than wasted resources.
(things + more expensive things) + (time + more time) = lots of extra cost

Quote:

---

Indeed I do not know if there are any special requirements set forth by his company, but neither do you.

---

Sure I do, the simple fact that no policy, much less procedure exists for this at his company lets me know that there are no special requirements. So why do you assume that they have all this need that no one there has ever considered?

Due care tends to be the action involved when dealing beyond the scope of any guidelines. In this case the guidelines are very clear, industry best practices. (Diligence would be assuring that policy, procedure, best practices, etc are followed through on, so I felt it more appropriate)

cheers,

catch

Catch

Quote:

---

Why are we wasting the resources on making this one area high assurance when nothing else we do is?

---

That is a good question, I hope that I have understood it correctly :)

I am suggesting two standards:

1. Destructive
2. Secure

I am assuming we are dealing with asset disposal so it is something that involves assets, and potentially, information, that is leaving the corporate/institutional environment.

I have wiped a fair bit of stuff in my time......................all you do is launch an application and get on with your life until it finishes. :D It is not a "waste of resource" as such, as very little resource is used in reality.

OK you need someone independent (need two signatures on the documentation) to run some recovery apps to audit the wipe, but once again that is an automatic process. Just set it going.............if you find ANYTHING you sure as hell don't sign it off!!!!

If anyone wants to re-write that process, their time would be better spent writing their letter of resignation?

:)

EDIT: OK I know things are probably different over here but I can get all the required software for less than one MS office licence fee, so I don't really see cost as an issue. And please remember, the alternative is to PAY someone to trash the kit?...............if you are able to sell/pass it on then this offsets the "cost".............if you give it away just charge the cost to "charitable donations"?

Hey, don't get me wrong here, I am not "preaching" or "grinding axes" just commenting on what I have come across over here.

Well I think we've both said our piece, and although we might disagree about some of the details I think this all boils down to, it isn't the techs call. Management should be presented with the options and make the decision as to which route to take.

Quote:

---

Meaning that if you wipe the drive, and or do anything to the drive that isn't considered an industry best practice and IF any data is recovered you are in worse standing than if you used the industry best practice and the same data were recovered.
No circles.

---

Maybe I mispoke in my first statement but my intentions was to convey formatting and then wiping. This is an extra step and goes beyond what you consider the best practice and thus couldn't be considered any worse off.

Quote:

---

Sure I do, the simple fact that no policy, much less procedure exists for this at his company lets me know that there are no special requirements. So why do you assume that they have all this need that no one there has ever considered?

---

Just because no policy exists doesn't mean there aren't special requirements. Giving computers away isn't something companys address a whole lot, atleast in a working status, and thus probably doesn't warrent a policy until it happens. From the original question I take it to believe there isn't a policy on hard drive reuse and they're out to create one.

Quote:

---

how do I know he is using low assurance data storage? if he wasn't he'd already have a policy on data destruction

---

A destruction policy could have been overlooked. The process of giving a system away might not be in any policy they have. In a perfect system I would agree with this, but I have seen a good number of not so perfect systems where people only seem concerned with storage up front and address destruction tomorrow. We all know, tomorrow never comes.

Quote:

---

Yes it does, you need to acquire the tools to do this (things), and you need tools that offer some level of assurance (more expensive tools) that they actually do what you think they are doing. Then you need someone to apply the tools to the drive (time).

---

All of this is fairly cheap. The tools don't run more than $50 which is a one-time cost. The labor is starting tool, which is the same thing you do for formatting, and then walk away. Its not exactly breaking the bank there. This isn't a process that is going to occur daily so it isn't going to snowball over time.

It all boils down to the value of the data, which being financial should be high, and what upper management decides on.

Quote:

---

Well I think we've both said our piece, and although we might disagree about some of the details I think this all boils down to, it isn't the techs call. Management should be presented with the options and make the decision as to which route to take.

---

I completely agree.

I come from the standpoint of doing the exact minimum required, one cent more is wasted resources.

Would I wipe my own drives? I wipe them and then drill four holes through the platters. Not because I think I have anything that important, but because I can't predict how something found on my system might be able to be used by someone.

I just wanted to make it really clear to the original poster that elaborate data destruction techniques are not REQUIRED, and just because someone could possibly recovery some percentage of the data using a STEM doesn't mean that he should feel a need to surpass his minimum legal obligations.

Some people just get way over zealous with this crap all while using insecure operating systems, insecure networking/telcom equipment, most likely not following any real control process... etc, etc. Doesn't make any sense. And every cent spent on secure data destruction would have a much better ROSI when spent on many, many other aspects of the company.

All that aside, the original poster has already made up his mind, so this is all academic. ;)

cheers,

catch

Quote:

---

Would I wipe my own drives? I wipe them and then drill four holes through the platters

---

What!

You should drill seven, at least one of which should be random!

Just kiddin........................ :D :p :)

Quote:

---

Originally posted here by xierox
I recommend writing random bits to the entire drive more than once as a simple way to make data very hard to recover. Check out DBAN (Darik's Boot and Nuke) for your wiping needs. I think it will fit the bill nicely.
Of the five different wipe methods it offers, it has at least one that meets the American DoD 5220-22.M Standard Wipe requirements. (Features.)

- X

---

I also recommend DBAN, as someone who's used it and subsequently verified that the wipe was complete.

The one drawback to DBAN, as I understand it, is that it can't yet deal with Host Protected Areas on disks. You'll need to remove the HPA setting first, before the wipe. Supposedly, this is an issue that will be addressed in an upcoming version of DBAN.

Quote:

---

Originally posted here by !mitationRust
DoD 5220-22.M is not good enough for top-secret data destruction. Those platters are electronically, chemically and physically "destroyed”.

---

While this is true, it's also true that three overwrite passes is sufficient to deal with Secret-level data destruction, according to DoD specs, and that's not small potatoes, either.

The bottom line is that if your data is absolutely priceless, and interested people with endless resources will go to any lengths to recover it, then yeah, physically destroy the drive. Otherwise, overwriting it with a few passes of random data is probably more than enough.

Quote:

---

Originally posted here by fraggin
While I have noticed some very good replys. Lost of people mention zero'ing out the drive is sufficient. I know somone that claims to have an app that will restore a drive zero'ed out up to 8 times over. I have never seen this in operation, but he claims to have restored crashed drives with the application to get them up long enought xfer data. *Shrugs* could be a lie, who knows.....

---

There is no application which can read data that the hard drive can no longer sense--this is an impossibility. You have to physically remove the drive platters and subject them to magnetic force microscopy or somesuch procedure. Which, by the way, is not an easy, cheap or quick thing to do.

Quote:

---

Also,
I had to take a client's think-pad HD to data recovery specialest to recover some time sensitive unique data. The place that I took it to prided theirselves on their recovery succcess rate and had some pictures of various drives where data had been recovered. Among these included Hard Drives damaged in Fires and Floods. They were good. They recovered everything from a Laptop drive for me that was no longer recognized by the computer. Yes, they were expensive. But just know that some people are willing to pay the price. When you add curiosity to the factor, you have to ask yourself how much one would pay for a key to open a chest of unknown contents.

---

This sounds like they had to re-mount the drive platters with a new read-write head mechanism. However, this is a far cry from data recovery when the surface itself has been wiped.

Quote:

---

Originally posted here by nihil
Hi, fraggin

I can well believe it. A reasonably secure wiping sequence will use 0's 1's in a random sequence and intersperse with writes of random 0's and 1's.

If you repeatedly overwrite with the same character, it is relatively easy to unravel the overwrites.

;)

---

Umm..."easy" being a relative term here. As in "spending tens of thousands of dollars and tasking tens-to-hundreds of thousands of dollars of equipment and a technician or two for several months on imaging a hard drive, all for potentially zero benefit".

Much as I actually find Catch rather annoying, he or she is right on regarding the dramatics in this thread. While I disagree with Catch that a simple overwrite of a hard drive is a "high assurance" process (more like having a firewall on your network, rather than leaving it open to the world), few hard drives that weren't owned by those involved in espionage or international terrorism will ever be subjected to data-recovery techniques that a single overwrite pass with all zeros won't defeat.

Hi kythe ,

What Catch and I have been discussing here is a process known as "covering your a$$"

A single overwrite would suffice in most situations, as a software retrieval solution would not be possible. Beyond that you go to laboratory forensics that rely on magnetic remnance and track overlay. Formatting, however, DOES NOT overwrite the original data.

If you have something that you think someone would pay for that resource for, then you DESTROY THE DRIVE

Otherwise just take suitable precautions that will stand up in court. Government and military standards fit this requirement.

From a corporate/institutional viewpoint a properly documented process is important, because you are accountable. If it is your own stuff it is your problem and your choice.


:)

Quote:

---

Much as I actually find Catch rather annoying

---

Fortunately no one asked or cares about how you find me. :)

Quote:

---

While I disagree with Catch that a simple overwrite of a hard drive is a "high assurance" process

---

A comparatively high assurance process, and clearly higher than is required.

cheers,

catch