destorying the hard drive

March 21, 2008

Re: destorying the hard drive

On Fri, 21 Mar 2008 11:46:57 -0600, "philo" <philo@privacy.net> put

finger to keyboard and composed:

>No one has *EVERY* given evidence of retrieving data from a properly

>zero-wiped drive.

>Here is the definitive answer:

>

>http://searchwincomputing.techtarget.com/tip/0,289483,sid68_gci1246592,00.html

I see that the author cites a paper by Peter Gutmann:

http://www.cs.cornell.edu/people/clarkson/secdg/papers.sp06/secure_deletion.pdf

Gutmann states that ...

=====================================================================

Most drives are capable of microstepping the heads for internal

diagnostic and error recovery purposes (typical error recovery

strategies consist of rereading tracks with slightly changed data

threshold and window offsets and varying the head positioning by a few

percent to either side of the track), but writing to the media while

the head is off-track in order to erase the remnant signal carries too

much risk of making neighbouring tracks unreadable to be useful (for

this reason the microstepping capability is made very difficult to

access by external means).

=====================================================================

In the 80s I used to service CDC SMD hard drives which supported track

offsets and early/late data strobes for improving the reliability of

data retrieval. These features were part of the documented command

set. I still don't see how, by using a simple software approach, one

could extract the remnant magnetisation at the track edges from the

much more dominant primary data.

- Franc Zabkar

--

Please remove one 'i' from my address when replying by email.

March 21, 2008

Re: destorying the hard drive

On Fri, 21 Mar 2008 02:38:55 -0300, John John <audetweld@nbnet.nb.ca>

put finger to keyboard and composed:

>Lee wrote:

>

>> Best advice yet is correct, but your advice on zero filled data is

>> totally incorrect.

>

>No, his advice is totally correct! I challenge you, or anyone reading

>these groups, to offer concrete proof that they can recover zero

>written/wiped files or to give us the names of data recovery firms who

>can do it.

>

>It cannot be done, it has never been done, no one has ever been able to

>do it and no one has ever been able to offer a shred of evidence that

>they have successfully recovered files on securely wiped disks.

>

>John

The following article was written by a company that is selling data

wiping software, so actual data recovery may be less plausible than

they make out, if not impossible:

http://web.archive.org/web/20070307054145/http://www.forensics-intl.com/art15.html

The article states that "horizontal head alignment and vertical head

placement is just a bit different every time data is written and

rewritten to the same track". This results in horizontal and vertical

magnetic "shadow data" which can be recovered by sensitive equipment.

Curiously the article claims that "if you have an interest in

researching and experimenting with shadow data, basic tools are

available for free download over the Internet". However the authors

qualify this statement by adding that "software solutions provide

limited success because they rely upon the same mechanical flaws

discussed above". I don't understand how software could do what the

authors claim, although I expect that one could use undocumented

commands (if they exist) to add track offsets and/or early/late data

strobes to any read or seek command. But AFAICS this would only be

useful in retrieving marginal primary data, not remnant data.

- Franc Zabkar

--

Please remove one 'i' from my address when replying by email.

March 21, 2008

Re: destorying the hard drive

Format. There was no such thing as a format with adjectives. No "low

level", no "full", no "quick". Just plain format...

"during which time the drive geometry - cylinders,

tracks - is laid out, tracks are numbered, the entire drive is

written

with a byte pattern and verified."

Except there were no cylinders on 5 1/4 floppies..

dadiOH

______________

Gary S. Terhune wrote:

> What did?

>

> "dadiOH" <dadiOH@guesswhere.com> wrote in message

> news:%23P7qnx1iIHA.1132@TK2MSFTNGP06.phx.gbl...

>> Use to be just plain "format" (sans adjectives) :)

>>

>> dadiOH

>> _____________

>>

>> Gary S. Terhune wrote:

>>> What you describe is a "low-level" format, not a "full" format.

>>>

>>> "dadiOH" <dadiOH@guesswhere.com> wrote in message

>>> news:ei9JBrziIHA.5504@TK2MSFTNGP05.phx.gbl...

>>>> Bill in Co. wrote:

>>>>> Even as I said, if you do a Full format, I think you'll be hard

>>>>> pressed to recover much, despite what Gary said. But I think

>>>>> Gary was thinking of the Quick Format (and I don't consider

>>>>> that a real format).

>>>>

>>>> There is no longer such a thing as a true "full format" of a hard

>>>> drive except the one done by the manufacturer originally.

>>>> Certainly, not one by Windows...a full format of even a smallish

>>>> hard drive would take many hours during which time the drive

>>>> geometry - cylinders, tracks - is laid out, tracks are numbered,

>>>> the entire drive is written with a byte pattern and verified.

>>>>

>>>> If the OP wants to destroy everything on the drive - including

>>>> all intersector bytes - passing a magnet over it should do it.

>> ...a help file of info about MP3s, recording from

>> LP/cassette and tips & tricks on this and that.

>> Get it at http://mysite.verizon.net/xico

March 21, 2008

Re: destorying the hard drive

Franc Zabkar wrote:

> I suspect that the difference in the treatment of FDs and HDs may be

> due to the fact that diskettes can be magnetically blank, ie they

> may have no prerecorded sector IDs, in which case they need to be

> low level formatted. HDs, OTOH, are already low level formatted at

> the factory.

>

> - Franc Zabkar

Bingo.

--

dadiOH

____________________________

dadiOH's dandies v3.06...

....a help file of info about MP3s, recording from

LP/cassette and tips & tricks on this and that.

Get it at http://mysite.verizon.net/xico

March 21, 2008

Re: destorying the hard drive

On Fri, 21 Mar 2008 13:41:24 +1100, Franc Zabkar

<fzabkar@iinternode.on.net> put finger to keyboard and composed:

>Typing "help format" at the DOS prompt documents the function of

>several switches, including /U, which is supposed to "destroy all

>existing data":

I now recall doing some pertinent testing (on an NTFS volume from a

Win98SE box) in this group over a year ago. Here is what I found at

that time:

http://groups.google.com/group/microsoft.public.win98.gen_discussion/msg/7826f476393adc6b?dmode=source

"I was able to confirm that an Fdisk does write F6 data patterns to

those sectors identified in a previous post, but I was surprised to

find that neither Format /u nor Format /c (in real DOS mode) appeared

to write anything at all to the disc ... A Windows full format appears

to write the boot block, initialise the FATs with zeroes, and create a

new root directory containing a volume name and the Recycled folder.

It appears that nothing else is written to the disc - all the original

NTFS data are still there."

Sorry for my original disinformation.

- Franc Zabkar

--

Please remove one 'i' from my address when replying by email.

March 21, 2008

Re: destorying the hard drive

Ancient days, well before the technology that is the topic here.

--

Gary S. Terhune

MS-MVP Shell/User

http://www.grystmill.com

\

"dadiOH" <dadiOH@guesswhere.com> wrote in message

news:O2NQzw5iIHA.944@TK2MSFTNGP05.phx.gbl...

> Format. There was no such thing as a format with adjectives. No "low

> level", no "full", no "quick". Just plain format...

> "during which time the drive geometry - cylinders,

> tracks - is laid out, tracks are numbered, the entire drive is

> written

> with a byte pattern and verified."

> Except there were no cylinders on 5 1/4 floppies..

>

> dadiOH

> ______________

>

> Gary S. Terhune wrote:

>> What did?

>>

>> "dadiOH" <dadiOH@guesswhere.com> wrote in message

>> news:%23P7qnx1iIHA.1132@TK2MSFTNGP06.phx.gbl...

>>> Use to be just plain "format" (sans adjectives) :)

>>>

>>> dadiOH

>>> _____________

>>>

>>> Gary S. Terhune wrote:

>>>> What you describe is a "low-level" format, not a "full" format.

>>>>

>>>> "dadiOH" <dadiOH@guesswhere.com> wrote in message

>>>> news:ei9JBrziIHA.5504@TK2MSFTNGP05.phx.gbl...

>>>>> Bill in Co. wrote:

>>>>>> Even as I said, if you do a Full format, I think you'll be hard

>>>>>> pressed to recover much, despite what Gary said. But I think

>>>>>> Gary was thinking of the Quick Format (and I don't consider

>>>>>> that a real format).

>>>>>

>>>>> There is no longer such a thing as a true "full format" of a hard

>>>>> drive except the one done by the manufacturer originally.

>>>>> Certainly, not one by Windows...a full format of even a smallish

>>>>> hard drive would take many hours during which time the drive

>>>>> geometry - cylinders, tracks - is laid out, tracks are numbered,

>>>>> the entire drive is written with a byte pattern and verified.

>>>>>

>>>>> If the OP wants to destroy everything on the drive - including

>>>>> all intersector bytes - passing a magnet over it should do it.

>>> ...a help file of info about MP3s, recording from

>>> LP/cassette and tips & tricks on this and that.

>>> Get it at http://mysite.verizon.net/xico

>

March 21, 2008

Re: destorying the hard drive

I don't know that floppies are treated the same but I think so.

--

Gary S. Terhune

MS-MVP Shell/User

http://www.grystmill.com

"Bill in Co." <not_really_here@earthlink.net> wrote in message

news:e%23h2Wd5iIHA.1184@TK2MSFTNGP04.phx.gbl...

> OK, but I apparently stand corrected in assuming that it was as "thorough"

> on a hard disk as it was on a floppy - overwriting everything on the disk

> (or at least I'm pretty sure that assumption is still true for a floppy

> using full format).

>

> Hmmm. Perhaps I should have known better in at least one way, because

> I once tried one of those disk overwriting programs and it seemed it took

> forever.

>

> Gary S. Terhune wrote:

>> FORMAT C: takes a while because the default action is a Thorough scan by

>> Scandisk after formatting. To avoid this, use the /q (quick) switch.

>>

>> --

>> Gary S. Terhune

>> MS-MVP Shell/User

>> http://www.grystmill.com

>>

>> "Bill in Co." <not_really_here@earthlink.net> wrote in message

>> news:%23xU60M5iIHA.4396@TK2MSFTNGP04.phx.gbl...

>>> That's it, for a hard drive??? OK, then I stand corrected. Must be

>>> only for floppies that it can do the whole shebang.

>>>

>>> I had thought, though, in the past, when I did a format c:/s, for

>>> preping

>>> a hard drive for Win9x, it was overwriting all the hard disk, as it took

>>> awhile (at least as I recall). Guess not.

>>>

>>> Gary S. Terhune wrote:

>>>> You're wrong. Full format has no effect on the data. Full format is

>>>> Quick

>>>> format followed by a cluster integrity check, no more.

>>>>

>>>> --

>>>> Gary S. Terhune

>>>> MS-MVP Shell/User

>>>> http://www.grystmill.com

>>>>

>>>> "Bill in Co." <not_really_here@earthlink.net> wrote in message

>>>> news:uNue8uxiIHA.4740@TK2MSFTNGP05.phx.gbl...

>>>>> Even as I said, if you do a Full format, I think you'll be hard

>>>>> pressed

>>>>> to

>>>>> recover much, despite what Gary said. But I think Gary was thinking

>>>>> of

>>>>> the Quick Format (and I don't consider that a real format).

>>>>>

>>>>> John John wrote:

>>>>>> Lee wrote:

>>>>>>

>>>>>>> Best advice yet is correct, but your advice on zero filled data is

>>>>>>> totally incorrect.

>>>>>>

>>>>>> No, his advice is totally correct! I challenge you, or anyone

>>>>>> reading

>>>>>> these groups, to offer concrete proof that they can recover zero

>>>>>> written/wiped files or to give us the names of data recovery firms

>>>>>> who

>>>>>> can do it.

>>>>>>

>>>>>> It cannot be done, it has never been done, no one has ever been able

>>>>>> to

>>>>>> do it and no one has ever been able to offer a shred of evidence that

>>>>>> they have successfully recovered files on securely wiped disks.

>>>>>>

>>>>>> John

>

March 21, 2008

Re: destorying the hard drive

Sounds about right. I realize, too, that I've been restricting my

considerations to HDs, not floppies.

--

Gary S. Terhune

MS-MVP Shell/User

http://www.grystmill.com

"Franc Zabkar" <fzabkar@iinternode.on.net> wrote in message

news:vr98u3ttfstv2k2gikbfshnlpk2697rdi5@4ax.com...

> On Fri, 21 Mar 2008 05:32:07 -0700, "Gary S. Terhune" <none> put

> finger to keyboard and composed:

>

>>You're wrong. Full format has no effect on the data. Full format is Quick

>>format followed by a cluster integrity check, no more.

>

> I think you're right. Maybe the confusion, at least in my case, is due

> to the different way the Format command appears to treat floppy

> diskettes as opposed to hard drives.

>

> Anyway, after "full" formatting a 320GB USB HD from within Explorer, I

> used a disc editor to view the HD and found that all the data appeared

> to be intact. I suspect that a "format /u" from within DOS would

> produce the same result but I don't have a spare HD to reliably test

> this (my USB HD stalls at 0%).

>

> OTOH, a full format of a floppy diskette writes F6 bytes to every

> sector in the data area. The same thing happens when I type ...

>

> format a: /u

>

> ... at a DOS prompt.

>

> A "quick" GUI format or a plain DOS format both leave the diskette's

> data area intact.

>

> Here are two of the FD images:

> http://www.users.on.net/~fzabkar/frmt_img.zip (4.2KB)

>

> I suspect that the difference in the treatment of FDs and HDs may be

> due to the fact that diskettes can be magnetically blank, ie they may

> have no prerecorded sector IDs, in which case they need to be low

> level formatted. HDs, OTOH, are already low level formatted at the

> factory.

>

> - Franc Zabkar

> --

> Please remove one 'i' from my address when replying by email.

March 22, 2008

Re: destorying the hard drive

Franc Zabkar wrote:

> On Fri, 21 Mar 2008 02:38:55 -0300, John John <audetweld@nbnet.nb.ca>

> put finger to keyboard and composed:

>

>>Lee wrote:

>>

>>>Best advice yet is correct, but your advice on zero filled data is

>>>totally incorrect.

>>

>>No, his advice is totally correct! I challenge you, or anyone reading

>>these groups, to offer concrete proof that they can recover zero

>>written/wiped files or to give us the names of data recovery firms who

>>can do it.

>>

>>It cannot be done, it has never been done, no one has ever been able to

>>do it and no one has ever been able to offer a shred of evidence that

>>they have successfully recovered files on securely wiped disks.

>>

>>John

>

> The following article was written by a company that is selling data

> wiping software, so actual data recovery may be less plausible than

> they make out, if not impossible:

>

> http://web.archive.org/web/20070307054145/http://www.forensics-intl.com/art15.html

>

> The article states that "horizontal head alignment and vertical head

> placement is just a bit different every time data is written and

> rewritten to the same track". This results in horizontal and vertical

> magnetic "shadow data" which can be recovered by sensitive equipment.

>

> Curiously the article claims that "if you have an interest in

> researching and experimenting with shadow data, basic tools are

> available for free download over the Internet". However the authors

> qualify this statement by adding that "software solutions provide

> limited success because they rely upon the same mechanical flaws

> discussed above". I don't understand how software could do what the

> authors claim, although I expect that one could use undocumented

> commands (if they exist) to add track offsets and/or early/late data

> strobes to any read or seek command. But AFAICS this would only be

> useful in retrieving marginal primary data, not remnant data.

The perpetuation of the myth that data can be recovered on wiped drive

is a self serving exercise that sellers of drive wiping software have

long engaged in. No one has ever been able to recover files on securely

wiped drives. The notion that this *might* be possible was only

advanced by Peter Gutmann as background material for his paper on Secure

Deletion of Data on drives. Furthermore, Dr. Gutmann's research was

done on an old class of drives that is practically out of use today, the

techniques described in his paper are hardly applicable to modern hard

drives, which is a moot point anyway because they didn't even work on

the old class of hard drives!

John

March 22, 2008

Re: destorying the hard drive

Mike Y wrote:

> "John John" <audetweld@nbnet.nb.ca> wrote in message

> news:eT190Q1iIHA.1204@TK2MSFTNGP03.phx.gbl...

>

>>Mike Y wrote:

>>

>>>"John John" <audetweld@nbnet.nb.ca> wrote in message

>>>news:enRecXxiIHA.6084@TK2MSFTNGP06.phx.gbl...

>>>

>>>>Lee wrote:

>>>>

>>>>>Best advice yet is correct, but your advice on zero filled data is

>>>>>totally incorrect.

>>>>

>>>>No, his advice is totally correct! I challenge you, or anyone reading

>>>>these groups, to offer concrete proof that they can recover zero

>>>>written/wiped files or to give us the names of data recovery firms who

>>>>can do it.

>>>>

>>>>It cannot be done, it has never been done, no one has ever been able to

>>>>do it and no one has ever been able to offer a shred of evidence that

>>>>they have successfully recovered files on securely wiped disks.

>>>>

>>>>John

>>>>

>>>

>>>Special hardware can could overwritten data. Either with an analog

>>>analysis or looking for bit shifts. Don't get confused in thinking that

>>>digital is digital, it's still an analog media...

>>

>>That is not true, there is no such magical machine available at any cost

>>that can recover data on securely wiped (zero filed) drives. No one can

>>recover data on properly wiped drives, the notion that it can be done is

>>nothing more than a myth.

>>

>>John

>

> Well, when you say securely wiped, by that meaning multiple wipes, I agree.

> (The most secure is to wipe multiple times with multiple and DIFFERENT

> data)

>

> Also, if you imply that there exists no machine that interfaces to the IDE,

> then I also agree. At least, I've not heard of any. And I don't know of

> any manufacturer that has backdoor hooks to allow the capabilities needed

> to be implemented. (I'm not sure, but reasonably confident that most,

> if not all, drives out there don't have the capability, even if a hacker had

> ability to reprogram the firmware to do his bidding.)

>

> However, there are TWO methods that will extract 'overwritten' info

> from media. Both have strong points and caveats, and both involve

> being able to access the drive other than through the 'user' interface.

> Neither are 100% or secure, and neither can work through multiple

> wipes. Or at least none that I know of can. But then...

>

> It is NOT a myth.

>

> The myth is telling people that it cannot be done.

>

> Granted, it's beyond the abilities of almost any hacker I've heard of, but

> it's NOT beyond the capabilities of manufacturers or certain organizations.

>

> Risk to the consumer? Almost zilch.

>

> But please don't come out with your blatant statement that it's a myth or

> that it can't be done. You are just plain wrong, and either ignorant of

> the technologies involved (I'll grant you that much) or are spouting a

> 'company line'. Which is it?

It is you who is ignorant of the facts! Please substantiate your claims!

The notion that data can be recovered on wiped drives is a myth, plain

and simple. Data cannot be recovered on a zero filled drive, even if it

was only written once! This is not a blatant statement, it's the truth.

If you think it can be done please supply reference material, sources

and names of companies who can do this.

You can use Magnetic Force Microscopy (MFM) or Scanning Tunneling

Microscopy (STM) and examine hard drive platters all that you want and

you will not be able to recover any data whatsoever on a wiped hard

drive, it can't be done, period!

John

And by the way, I do not work for any company that is in anyway involved

in the sale or development of anything to do with computer technology or

software.

March 22, 2008

Re: destorying the hard drive

Mike Y wrote:

>>Nope that's a total myth.

>>No drive zero-wiped to government standards has even had any data

>

> recovered

>

>>from it.

>

> Actually, I'd suspect the 'government standard' is a myth. As far as I

> know, I've

> never been able to find ANY hard reference to a standard for wiping a drive,

> other than 'second/third' or a 'friend of a friend said that' kind of thing.

Which pretty well tells us a lot about your level of expertise in this

field.

US Dept of Defense Standard 5220.22-M

http://www.qsgi.com/usdod_standard_dod_522022m.htm

Before posting about hearsay and myths that you heard you should do a

bit of research.

John

March 22, 2008

Re: destorying the hard drive

"John John" <audetweld@nbnet.nb.ca> wrote in message

news:eT190Q1iIHA.1204@TK2MSFTNGP03.phx.gbl...

> Mike Y wrote:

>

> > "John John" <audetweld@nbnet.nb.ca> wrote in message

> > news:enRecXxiIHA.6084@TK2MSFTNGP06.phx.gbl...

> >

> >>Lee wrote:

> >>

> >>>Best advice yet is correct, but your advice on zero filled data is

> >>>totally incorrect.

> >>

> >>No, his advice is totally correct! I challenge you, or anyone reading

> >>these groups, to offer concrete proof that they can recover zero

> >>written/wiped files or to give us the names of data recovery firms who

> >>can do it.

> >>

> >>It cannot be done, it has never been done, no one has ever been able to

> >>do it and no one has ever been able to offer a shred of evidence that

> >>they have successfully recovered files on securely wiped disks.

> >>

> >>John

> >>

> >

> > Special hardware can could overwritten data. Either with an analog

> > analysis or looking for bit shifts. Don't get confused in thinking that

> > digital is digital, it's still an analog media...

>

> That is not true, there is no such magical machine available at any cost

> that can recover data on securely wiped (zero filed) drives. No one can

> recover data on properly wiped drives, the notion that it can be done is

> nothing more than a myth.

>

> John

Well, when you say securely wiped, by that meaning multiple wipes, I agree.

(The most secure is to wipe multiple times with multiple and DIFFERENT

data)

Also, if you imply that there exists no machine that interfaces to the IDE,

then I also agree. At least, I've not heard of any. And I don't know of

any manufacturer that has backdoor hooks to allow the capabilities needed

to be implemented. (I'm not sure, but reasonably confident that most,

if not all, drives out there don't have the capability, even if a hacker had

ability to reprogram the firmware to do his bidding.)

However, there are TWO methods that will extract 'overwritten' info

from media. Both have strong points and caveats, and both involve

being able to access the drive other than through the 'user' interface.

Neither are 100% or secure, and neither can work through multiple

wipes. Or at least none that I know of can. But then...

It is NOT a myth.

The myth is telling people that it cannot be done.

Granted, it's beyond the abilities of almost any hacker I've heard of, but

it's NOT beyond the capabilities of manufacturers or certain organizations.

Risk to the consumer? Almost zilch.

But please don't come out with your blatant statement that it's a myth or

that it can't be done. You are just plain wrong, and either ignorant of

the technologies involved (I'll grant you that much) or are spouting a

'company line'. Which is it?

Mike

March 22, 2008

Re: destorying the hard drive

>

> Nope that's a total myth.

> No drive zero-wiped to government standards has even had any data

recovered

> from it.

Actually, I'd suspect the 'government standard' is a myth. As far as I

know, I've

never been able to find ANY hard reference to a standard for wiping a drive,

other than 'second/third' or a 'friend of a friend said that' kind of thing.

Yes, I've heard the '7-wipes with alternate data' thing. But I've never

seen

it where it could be formally referenced. Just hearsay.

March 22, 2008

Re: destorying the hard drive

Mike Y wrote:

>>you will not be able to recover any data whatsoever on a wiped hard

>>drive, it can't be done, period!

>>

>>John

>>

>>And by the way, I do not work for any company that is in anyway involved

>>in the sale or development of anything to do with computer technology or

>>software.

>

> Well, I do, and did. I've been involved with the 380 chip set way back, and

> I do know a bit about how it and hard drives in general work. And while

> I've

> not personally done it, I AM aware of the technologies involved, the theory

> behind the technologies, and the practice implementing those technologies.

> Granted, I've not heard much about the techniques since drives moved into

> the ZBR (a LOT changed when drives went that route) world with the high

> speed transfers (compared to early MFM), but there's nothing in the

> techniques or theory that would make it impossible other than that the

> tools and techniques have to stay 'ahead of the game' the same way they

> were then.

>

> It's doable. Period!

It cannot be done! Period! It is a theory only and it has never been

proven! Not too long ago the US Department of Defense issued a tender

call for someone to provide methods to recover data from wiped drives

and no one stepped up to the plate to fill the tender request.

I invite you to contact all the data recovery experts and all the data

recovery companies out there and tell them that you have done a Secure

wipe on a drive and then ask them if they can recover your data. 99.98%

of them will outright tell you that they cannot recover the data on the

drive, they will tell you that they can't even recover the data if it

was simply overwritten once with other data, never mind secure wiping.

Go ahead search the net and email them all and find out for yourself!

Of the .02% remaining who tell you that they can .01% are lying and the

other .01% will tell you to expect to pay at least $100,000 to even

"try" to recover the data and they will make no guarantee of anything

other than you will end up $100,000 poorer!

The claims that data recovery can be made on wipe drives comes from Dr.

Gutmann's research where he has shown that using Magnetic Force

Microscopy he might be able to recover data from wiped drives. Even Dr.

Gutmann later stated that many were making Voodoo science of his

research and that some were making greatly exaggerated claims of

successful data recovery on wiped drives, Dr. Gutmann stated that the

claims were even more so exaggerated considering the size of today's

hard disks, his research was done on a different class of disks and when

disks were relatively small.

Using MFM or software that analyzes analog magnetic signals it is said

that data can be recovered from wiped drives but keep in mind that MFM

actually takes photographs of the bits where data is stored, quoting one

source:

"This pains taking process takes several months, and when it is finished

these pictures have to be stitched together.

Consider that a 20GB hard drive consists of 160, 000, 000, 000 bits.

Including overheads that could rise to around 300, 000, 000, 000 bits,

with each individual bit represented by a magnetic flux change. Since

each MFM picture displaying this flux change uses around 100 bytes, the

result is 40 Terabytes of data to be analyzed. Data recovery by this

means can cost 100, 000s of Dollars..."

And once again, there is no guarantee that the above procedure will

recover data. On today's hard disks of hundreds of GB such recovery

efforts would take thousands of man hours to gather and years to analize!

The plain and simple fact, as stated in one of the reference papers

below, is that: "Although such exotic methods of data recovery are

theoretically possible, and have even been discussed in the

peer-reviewed literature [11, 12], I have found no evidence of

commercially viable recoveries being performed with them. Furthermore,

I have seen no public demonstrations of any of these methods that show

the recovery of files or even user data – only images or raw encoded data."

John

J. Sawyer- MAGNETIC DATA RECOVERY - THE HIDDEN THREAT (PDF)

http://tinyurl.com/2mvkay

Recovering Unrecoverable Data - The Need for Drive-Independant Data

Recovery 527KB PDF.

Charles H. Sobey Published April 14, 2004.

http://www.actionfront.com/whitepaper/Drive-Independent Data Recovery

Ver14Alrs.pdf

Secure Deletion of Data from Magnetic and Solid-State Memory

Peter Gutmann

Department of Computer Science

http://www.cs.auckland.ac.nz/~pgut001/pubs/secure_del.html

Overwitten data: Why even the Secret Service can't get it back

http://www.computerworld.com/blogs/node/5756

Is overwritten data really unrecoverable?

http://blogs.computerworld.com/node/5687

Can Intelligence Agencies Read Overwritten Data?

http://www.nber.org/sys-admin/overwritten-data-guttman.html

Ontrack Eraser

http://www.ontrackdatarecovery.com/hard-drive-software/ontrack-eraser.aspx

Examining DoD-level secure erasure guidelines

http://searchsecurity.techtarget.com/expert/KnowledgebaseAnswer/0,289625,sid14_gci1273281,00.html

Secure Erase

http://cmrr.ucsd.edu/people/Hughes/CmrrSecureEraseProtocols.pdf

http://cmrr.ucsd.edu/people/Hughes/DataSanitizationTutorial.pdf

http://cmrr.ucsd.edu/people/Hughes/SecureErase.shtml

John

March 22, 2008

Re: destorying the hard drive

> you will not be able to recover any data whatsoever on a wiped hard

> drive, it can't be done, period!

>

> John

>

> And by the way, I do not work for any company that is in anyway involved

> in the sale or development of anything to do with computer technology or

> software.

Well, I do, and did. I've been involved with the 380 chip set way back, and

I do know a bit about how it and hard drives in general work. And while

I've

not personally done it, I AM aware of the technologies involved, the theory

behind the technologies, and the practice implementing those technologies.

Granted, I've not heard much about the techniques since drives moved into

the ZBR (a LOT changed when drives went that route) world with the high

speed transfers (compared to early MFM), but there's nothing in the

techniques or theory that would make it impossible other than that the

tools and techniques have to stay 'ahead of the game' the same way they

were then.

It's doable. Period!

I'll give you one hint... Writing a 0 or a 1 DOESN'T totally erase what is

under it. Can you understand that? All writing a 0 or a 1 does is put

(actually,

'TRY' to put ) flux transitions down on the media at specific points. Or

try to.

Data already down on the media will influence where those transitions

actually

end up being detected on readback (digital), or distortions in the signal

(analog) ...

I'm through arguing with someone who obviously doesn't know what they are

talking about. You just cannot prove something doesn't exist or that

something

is impossible. You're putting yourself in the same reference frame as

people

who said manned piloted aircraft will never exceed the speed of sound. Or

that rockets just couldn't carry enough fuel in a 'step rocket'

(multi-stage)

to make it to the moon. In both cases, relatively simple technology

advances

led to the solution to the problem. You just can't understand that the

technology you see and touch is not the only technology that may exist.

March 22, 2008

Re: destorying the hard drive

> Which pretty well tells us a lot about your level of expertise in this

> field.

>

> US Dept of Defense Standard 5220.22-M

> http://www.qsgi.com/usdod_standard_dod_522022m.htm

>

> Before posting about hearsay and myths that you heard you should do a

> bit of research.

>

> John

Ok, got me. Hmm, I'll bet that came well after... Well, I'll leave that

one

alone. But thank you for the reference.

What I was actually alluding to (and you failed to quote) was the off-touted

'7 times overwrite' often billed (by even the Norton Utilities WipeDisk at

one point) as an NSA standard. That I could never find a hard reference

to no matter how hard I looked.

I really do thank you for that link.

But you actually make my case. That you post something the government

is actually concerned about (because they CAN do it).

From a practical matter, data recovery is probably possible but not solid

at one overwrite, 'iffy' with two, and probably secure at three. And these

are with methods of mathematical analysis in 1993 or so that I'm sure

by now have come a long way. But that's just my gut call. Since drives

went ZBR how the data would interact to an overwrite may be radically

different than before. Who knows, it may be easier!

March 22, 2008

Re: destorying the hard drive

I certainly would expect that writing pseudorandom, or even identical, bytes

to each and every sector on the disk would make it nigh impossible to

recover anything, - IF that laboriously slow procedure was invoked. How it

could possibly be otherwise makes little sense to me - unless we operate

under the assumption that the electromagnetic writes are somewhat incomplete

(that is, the magnetic domains on the disk are not fully reversed (or

realigned) completely, but still have some very small residual leftover

effects (i.e. retentivity) from a previous write operation). (I'm an EE,

but I'm just making some basic assumptions here).

John John wrote:

> Mike Y wrote:

>

>>> you will not be able to recover any data whatsoever on a wiped hard

>>> drive, it can't be done, period!

>>>

>>> John

>>>

>>> And by the way, I do not work for any company that is in anyway involved

>>> in the sale or development of anything to do with computer technology or

>>> software.

>>

>> Well, I do, and did. I've been involved with the 380 chip set way back,

>> and

>> I do know a bit about how it and hard drives in general work. And while

>> I've

>> not personally done it, I AM aware of the technologies involved, the

>> theory

>> behind the technologies, and the practice implementing those

>> technologies.

>> Granted, I've not heard much about the techniques since drives moved into

>> the ZBR (a LOT changed when drives went that route) world with the high

>> speed transfers (compared to early MFM), but there's nothing in the

>> techniques or theory that would make it impossible other than that the

>> tools and techniques have to stay 'ahead of the game' the same way they

>> were then.

>>

>> It's doable. Period!

>

> It cannot be done! Period! It is a theory only and it has never been

> proven! Not too long ago the US Department of Defense issued a tender

> call for someone to provide methods to recover data from wiped drives

> and no one stepped up to the plate to fill the tender request.

<snip>

March 22, 2008

Re: destorying the hard drive

"John John" <audetweld@nbnet.nb.ca> wrote in message

news:ORSKBd8iIHA.5152@TK2MSFTNGP02.phx.gbl...

> Mike Y wrote:

>

> >>Nope that's a total myth.

> >>No drive zero-wiped to government standards has even had any data

> >

> > recovered

> >

> >>from it.

> >

> > Actually, I'd suspect the 'government standard' is a myth. As far as I

> > know, I've

> > never been able to find ANY hard reference to a standard for wiping a

drive,

> > other than 'second/third' or a 'friend of a friend said that' kind of

thing.

>

> Which pretty well tells us a lot about your level of expertise in this

> field.

>

> US Dept of Defense Standard 5220.22-M

> http://www.qsgi.com/usdod_standard_dod_522022m.htm

>

> Before posting about hearsay and myths that you heard you should do a

> bit of research.

>

> John

Found something else on that link. In a blurb about software they sell.

"The software has the flexibility to overwrite a hard drive up to 99 times.

Each additional overwrite further minimizes the possibility of recovering

any data."

Seems pretty obvious to me that they are concerned about someone reading

data after a single overwrite...

Granted, they sell the software so it means they are not neutral, but

still...

I'm done with this. Again, thanks for the link.

Mike

March 22, 2008

Re: destorying the hard drive

"Jim Madsen" <justme@nobody.com> wrote in message

news:%23ks9OztiIHA.5280@TK2MSFTNGP02.phx.gbl...

> My daughter has an old Gateway computer running Windows 98. She says no

> one wants it because it is slow and obsolete and she wants to turn it into

> the local recycling place.

>

> She is worried about (personal) data on the hard drive. I wonder if

> reformatting the HD will destroy all the data? My old W95 computer, I

> took the HD out and smashed it with a sledge hammer, but she doesn't want

> to do that.

>

> She took it to a computer store, and they offered to "hose" the HD and

> dispose of the computer for $50.00.

>

> Any suggestions?

>

> Jim

Its my understanding regarding using format.com that:

A quick format simply uses the current file allocation table, indicating

lack of file data in the previously written file allocation table. Does not

verify the data locations as usable.

A format (full) removes/wipes the current file allocation table, verifies

the usable writing area for data file storage, updates that for writing new

file allocation table, then, writes the new file allocation table.

In either case, the file data still exists. And, easily recoverable with

most current data recovery software.

As stated in another reply, zero-write utilities, for the most part, are

suitable for most purposes of preventing the locating of prior written

personal data. Forensic tools can still find such data though. These rely

on the latency of the magnetic field of each bit that may have existed due

to prior writes created by prior use.

Regarding unformat. Was last available in dos 6.22. Its purpose was to

revert to the prior file allocation table. One cannot write files in the

interim and expect full file data access. An immediate unformat is expected

after realizing formatting was a mistake on the user's part. FAT32 did not

exist in the time frame of dos 6.22.

--

Dave

March 22, 2008

Re: destorying the hard drive

Lil' Dave wrote:

> As stated in another reply, zero-write utilities, for the most part, are

> suitable for most purposes of preventing the locating of prior written

> personal data. Forensic tools can still find such data though. These rely

> on the latency of the magnetic field of each bit that may have existed due

> to prior writes created by prior use.

FUD! There are no forensic tools available that can recover data on

securely wiped drives. If you think such tools exist please

substantiate your claim and post links to such tools or other verifiable

information.

John

March 22, 2008

Re: destorying the hard drive

Better calm down there, John John. Gonna blow a gasket. If the "recoverable

using special testing" story is a fairy tale, it's a harmless and rather

useful one, don't you think? You've posted your "proof", others have posted

other info. You've made your demands clear. Think maybe that's enough?

Besides, far as I can tell, the answer's the same: "Zero-fill the hard drive

once (or thrice.)"

--

Gary S. Terhune

MS-MVP Shell/User

http://www.grystmill.com

"John John" <audetweld@nbnet.nb.ca> wrote in message

news:uqQpngCjIHA.748@TK2MSFTNGP04.phx.gbl...

> Lil' Dave wrote:

>

>> As stated in another reply, zero-write utilities, for the most part, are

>> suitable for most purposes of preventing the locating of prior written

>> personal data. Forensic tools can still find such data though. These

>> rely on the latency of the magnetic field of each bit that may have

>> existed due to prior writes created by prior use.

>

> FUD! There are no forensic tools available that can recover data on

> securely wiped drives. If you think such tools exist please substantiate

> your claim and post links to such tools or other verifiable information.

>

> John

March 22, 2008

Re: destorying the hard drive

On Fri, 21 Mar 2008 23:48:43 -0300, John John <audetweld@nbnet.nb.ca>

put finger to keyboard and composed:

>Mike Y wrote:

>

>>>Nope that's a total myth.

>>>No drive zero-wiped to government standards has even had any data

>>

>> recovered

>>

>>>from it.

>>

>> Actually, I'd suspect the 'government standard' is a myth. As far as I

>> know, I've

>> never been able to find ANY hard reference to a standard for wiping a drive,

>> other than 'second/third' or a 'friend of a friend said that' kind of thing.

>

>Which pretty well tells us a lot about your level of expertise in this

>field.

>

>US Dept of Defense Standard 5220.22-M

>http://www.qsgi.com/usdod_standard_dod_522022m.htm

>

>Before posting about hearsay and myths that you heard you should do a

>bit of research.

>

>John

I tried to locate references to "overwriting" in the Feb 28, 2006

NISPOM document but was unable to. See either of the next two URLs.

DoD 5220.22-M, "National Industrial Security Program Operating Manual

http://www.dtic.mil/whs/directives/corres/html/522022m.htm

NISPOM, National Industrial Security Program Operating Manual

reissued February 28, 2006

http://www.fas.org/sgp/library/nispom.htm

However, the following URL led me to an April 1, 2004 "DoD overprint"

of the NISPOM document:

http://www.fas.org/sgp/library/nispom_dod_overprint_rev1.pdf

The DoD's NISPOM overprint has additional DoD stipulations, including

overwriting procedures. It seems to me that industry is not as

paranoid about rigorous data wiping as is the DoD. Then again, the

DoD's April Fools Day 2004 document is two years behind the current

2006 NISPOM.

- Franc Zabkar

--

Please remove one 'i' from my address when replying by email.

March 23, 2008

Re: destorying the hard drive

"John John" <audetweld@nbnet.nb.ca> wrote in message

news:uqQpngCjIHA.748@TK2MSFTNGP04.phx.gbl...

> Lil' Dave wrote:

>

>> As stated in another reply, zero-write utilities, for the most part, are

>> suitable for most purposes of preventing the locating of prior written

>> personal data. Forensic tools can still find such data though. These

>> rely on the latency of the magnetic field of each bit that may have

>> existed due to prior writes created by prior use.

>

> FUD! There are no forensic tools available that can recover data on

> securely wiped drives. If you think such tools exist please substantiate

> your claim and post links to such tools or other verifiable information.

>

> John

May take months to retrieve such data after its wiped like you indicate, but

it exists. Does not rely on a previously written file table. No one is

willing to spend that much time and patience nowadays for some trivial

personal data retrieval unless paid enough. And, since there is no

guarantee sensitive data like SS#, credit card #s, bank account #s were

previously written to an unknown wiped hard drive; no one in their right

mind would spend such amount of time hunting such. That is why a simple

zero wipe is adequate.

http://www.cs.auckland.ac.nz/~pgut001/pubs/secure_del.html

--

Dave

March 23, 2008