destorying the hard drive

March 24, 2008

Re: destorying the hard drive

From: "thanatoid" <waiting@the.exit.invalid>

>This idea - as *fact* - was presented in a thread with the same

>subject (I wonder just HOW many of those there have been by now)

>by someone a few years ago. He claimed a "residue" of whatever

>is written to a HD /REMAINS/ even if you write over it a bunch

>of times - something like: new drive, zero-formatted - 100%

>magnetic signal retention, second write in the same sector -

>95%, third 90%, etc. I pointed out that simple logic would

>dictate that if anything like this was true, all drives would

>fail within a few weeks of being installed. There was no reply.

I think you're missing the distinction between analog and digital. HD's

record digital data as flux transitions, but the flux transitions can be

considered analog. When you read data back, the drive electronics

look for the transitions, and the timing of the transitions determine

what the data is. Distortions in the signal, as long as the drive

data-separator can still pull out the signal, will not affect what the

drive reads and reports as data. Underlying data can cause

timing distortions, but as long as the data-separator circuits detect

the transition within the window, the drive electronics will pull

out clean data. How dirty or distorted the signal is makes no

difference. In fact, it can be VERY dirty before the circuits will

loose lock and actually generate an error.

The main point of the drive electronics is to hide all the other stuff

from the user, and present to the user the data they are looking for.

It, by design, pulls out the latest and strongest signal and ignores

all else.

March 24, 2008

Re: destorying the hard drive

Lil' Dave wrote:

> "John John" <audetweld@nbnet.nb.ca> wrote in message

> news:uqQpngCjIHA.748@TK2MSFTNGP04.phx.gbl...

>

>>Lil' Dave wrote:

>>

>>>As stated in another reply, zero-write utilities, for the most part, are

>>>suitable for most purposes of preventing the locating of prior written

>>>personal data. Forensic tools can still find such data though. These

>>>rely on the latency of the magnetic field of each bit that may have

>>>existed due to prior writes created by prior use.

>>

>>FUD! There are no forensic tools available that can recover data on

>>securely wiped drives. If you think such tools exist please substantiate

>>your claim and post links to such tools or other verifiable information.

>>

>>John

>

> May take months to retrieve such data after its wiped like you indicate, but

> it exists.

No, Dave, it does not exist. No one has ever been able to do this, not

even Dr. Gutmann himself. It is nothing but a myth that started when

Perter Gutmann released his "famous" paper.

John

March 24, 2008

Re: destorying the hard drive

There is only one controlled and verifiable experiment that I know of

where data was "apparently" recovered on a wiped drive, this is the so

called "HelpHelp" test conducted by researchers at the Center for

Magnetic Recording Research at the University of California. The test

was conducted to determine the efficacy of Secure Data Erasure.

Before anyone makes assumption that this proves that data recovery is

possible on securely wiped drives they should read the papers that

detail how the test was conducted. In particular they should note the

following "skewed" factors which gave the researchers every possible

advantage in their search for the overwritten data, their mission was to

defeat secure data erasure and to help them all the odds were purposely

stacked in their favour:

1- The researchers had to know what to look for and where to look for

it, in the case of this test they were specifically told to look for the

written bits "helphelp" on a certain track on the disk. Without knowing

what to look for and where to look for it the researcher didn't have a

clue as to what they were looking at or seeing with their fancy tools!

2- The disk track where the helphelp bits were written was completely

wiped and tested before hand, this ensured a clean track and that the

only written bits on the track before the second test wipe were

"HelpHelp". As if condition 1 above wasn't skewed enough in favour of

the test, there were no other possible bits to weed through other than

the helphelp bits!

3- The researchers had to know the overwriting pattern of the wiping

software, when the overwriting was random and unknown the researchers

couldn't find the "helphelp" bits.

4- When two wipes were done on the drive the researchers couldn't find

the "helphelp" bits, the one pass wipe done for the test was hardly a

secure wipe!

What it boils down to is that in the end the test proved conclusively

that data recovery was impossible on securely wiped drives, the

effectiveness Secure Erasure was confirmed beyond the shadow of a doubt.

Here is one paper which mentions the so-called "HelpHelp" test:

Secure Erase of Disk Drive Data (PDF, 294kb)

Gordon Hughes and Tom Coughlin

http://www.tomcoughlin.com/Techpapers/Secure%20Erase%20Article%20for%20IDEMA,%20042502.pdf

John

Bill in Co. wrote:

> I certainly would expect that writing pseudorandom, or even identical, bytes

> to each and every sector on the disk would make it nigh impossible to

> recover anything, - IF that laboriously slow procedure was invoked. How it

> could possibly be otherwise makes little sense to me - unless we operate

> under the assumption that the electromagnetic writes are somewhat incomplete

> (that is, the magnetic domains on the disk are not fully reversed (or

> realigned) completely, but still have some very small residual leftover

> effects (i.e. retentivity) from a previous write operation). (I'm an EE,

> but I'm just making some basic assumptions here!).

>

>>John John wrote:

>>

>>>Mike Y wrote:

>>>

>>>>>you will not be able to recover any data whatsoever on a wiped hard

>>>>>drive, it can't be done, period!

>>>>>

>>>>>John

>>>>>

>>>>>And by the way, I do not work for any company that is in anyway

>>>>>involved

>>>>>in the sale or development of anything to do with computer technology

>>>>>or

>>>>>software.

>>>>

>>>>Well, I do, and did. I've been involved with the 380 chip set way back,

>>>>and

>>>>I do know a bit about how it and hard drives in general work. And while

>>>>I've

>>>>not personally done it, I AM aware of the technologies involved, the

>>>>theory

>>>>behind the technologies, and the practice implementing those

>>>>technologies.

>>>>Granted, I've not heard much about the techniques since drives moved

>>>>into

>>>>the ZBR (a LOT changed when drives went that route) world with the high

>>>>speed transfers (compared to early MFM), but there's nothing in the

>>>>techniques or theory that would make it impossible other than that the

>>>>tools and techniques have to stay 'ahead of the game' the same way they

>>>>were then.

>>>>

>>>>It's doable. Period!

>>>

>>>It cannot be done! Period! It is a theory only and it has never been

>>>proven! Not too long ago the US Department of Defense issued a tender

>>>call for someone to provide methods to recover data from wiped drives

>>>and no one stepped up to the plate to fill the tender request.

>>

>><snip>

>

March 24, 2008

Re: destorying the hard drive

You now have a case of battling scientific papers, and you're going to have

to do a lot more than just insist that you're guy's right. Or rather, you

should give it up until Gutmann himself fess's up. From where I sit, the

more you yell, the lower your credibility goes. Provide your references to

the best of your ability and then let them speak for themselves.

--

Gary S. Terhune

MS-MVP Shell/User

http://www.grystmill.com

"John John" <audetweld@nbnet.nb.ca> wrote in message

news:eCgWqSajIHA.4868@TK2MSFTNGP03.phx.gbl...

> Lil' Dave wrote:

>> "John John" <audetweld@nbnet.nb.ca> wrote in message

>> news:uqQpngCjIHA.748@TK2MSFTNGP04.phx.gbl...

>>

>>>Lil' Dave wrote:

>>>

>>>>As stated in another reply, zero-write utilities, for the most part, are

>>>>suitable for most purposes of preventing the locating of prior written

>>>>personal data. Forensic tools can still find such data though. These

>>>>rely on the latency of the magnetic field of each bit that may have

>>>>existed due to prior writes created by prior use.

>>>

>>>FUD! There are no forensic tools available that can recover data on

>>>securely wiped drives. If you think such tools exist please substantiate

>>>your claim and post links to such tools or other verifiable information.

>>>

>>>John

>>

>> May take months to retrieve such data after its wiped like you indicate,

>> but it exists.

>

> No, Dave, it does not exist. No one has ever been able to do this, not

> even Dr. Gutmann himself. It is nothing but a myth that started when

> Perter Gutmann released his "famous" paper.

>

> John

>

March 24, 2008

Re: destorying the hard drive

I have had private email conversations with Peter Gutmann on this

subject and he has told me that he was never able to recover data on a

wiped drive, all he could ever do was show presence of previous data, he

could not tell what the previous data was. His method was offered as a

theoretical method of data recovery, he used it to reinforce the need

for secure deletion methods. Read the Epilogue in his paper. In my

conversation with him I asked him if he knew if anyone had ever used his

method to recover data on a wiped drive, to which he replied that he

knew of none who had. He knew of one person working for a hard drive

manufacturer who had done research on the matter but to his knowledge

the research led nowhere. Dr. Gutmann would not give me the name or

address of this researcher because he (the researcher) was doing this

research without his employer's knowledge or explicit consent, Peter did

not want to put this person in an "uncomfortable" position.

John

Gary S. Terhune wrote:

> You now have a case of battling scientific papers, and you're going to

> have to do a lot more than just insist that you're guy's right. Or

> rather, you should give it up until Gutmann himself fess's up. From

> where I sit, the more you yell, the lower your credibility goes. Provide

> your references to the best of your ability and then let them speak for

> themselves.

>

March 24, 2008

Re: destorying the hard drive

I'll just make one comment in this discussion.

I would be extremely careful when making an FINAL statement on what can or

can not be done on supposedly securely wiped drives or any other claimed

event or finding.

Consider that "the world is flat", "the sun revolves around the earth",

"man can not fly", "ships will fall of the end off the ocean and men eaten

by monsters", "computers can never replace man because they must be

programmed by men", "the Internet is secure when using VPN connections",

"PGP can not be broken", "this connection is secure", and thousands of other

fallacies that were supposedly PROVEN as true, then later proven as false.

--

MEB

http://peoplescounsel.orgfree.com

--

_________

March 24, 2008

Re: destorying the hard drive

Bottom line: I will continue to assume that the US government and others

have the ability to retrieve data from a zero-filled drive (regardless of

how many wipes). As good as your data sounds, as good as your due diligence

seems to have been, I don't actually know you. Even if I did, it would make

no difference. Nothing you offer *proves* that it can't be done, and your

contention that it's never been done is, again, something I would have to

take on faith.

Now, ask me if I give much of a damn what the government can read from my

hard drive. They already know MUCH more than that about me. And about you,

too, and everyone else in this joint with their silly fears, aliases, etc.

If I have something to hide from the government or other major power, adding

a degausser to my toolkit and using it will be a minor issue. Your own

claims would be merely academic irrlevancies.

--

Gary S. Terhune

MS-MVP Shell/User

http://www.grystmill.com

"John John" <audetweld@nbnet.nb.ca> wrote in message

news:%23I7lHidjIHA.3940@TK2MSFTNGP05.phx.gbl...

>I have had private email conversations with Peter Gutmann on this subject

>and he has told me that he was never able to recover data on a wiped drive,

>all he could ever do was show presence of previous data, he could not tell

>what the previous data was. His method was offered as a theoretical method

>of data recovery, he used it to reinforce the need for secure deletion

>methods. Read the Epilogue in his paper. In my conversation with him I

>asked him if he knew if anyone had ever used his method to recover data on

>a wiped drive, to which he replied that he knew of none who had. He knew

>of one person working for a hard drive manufacturer who had done research

>on the matter but to his knowledge the research led nowhere. Dr. Gutmann

>would not give me the name or address of this researcher because he (the

>researcher) was doing this research without his employer's knowledge or

>explicit consent, Peter did not want to put this person in an

>"uncomfortable" position.

>

> John

>

> Gary S. Terhune wrote:

>> You now have a case of battling scientific papers, and you're going to

>> have to do a lot more than just insist that you're guy's right. Or

>> rather, you should give it up until Gutmann himself fess's up. From where

>> I sit, the more you yell, the lower your credibility goes. Provide your

>> references to the best of your ability and then let them speak for

>> themselves.

>>

>

March 24, 2008

Re: destorying the hard drive

What about the bogey man? Or the Abominable Snowman? Are they real?

Many speak of them but no one has ever been able to prove their

existence. Much the same as data recovery on securely wiped drives,

many speak of it but no one has yet shown proof of it.

John

MEB wrote:

> I'll just make one comment in this discussion.

>

> I would be extremely careful when making an FINAL statement on what can or

> can not be done on supposedly securely wiped drives or any other claimed

> event or finding.

>

> Consider that "the world is flat", "the sun revolves around the earth",

> "man can not fly", "ships will fall of the end off the ocean and men eaten

> by monsters", "computers can never replace man because they must be

> programmed by men", "the Internet is secure when using VPN connections",

> "PGP can not be broken", "this connection is secure", and thousands of other

> fallacies that were supposedly PROVEN as true, then later proven as false.

>

March 25, 2008

Re: destorying the hard drive

"thanatoid" <waiting@the.exit.invalid> wrote in message

news:Xns9A6B864CD5D6Fthanexit@66.250.146.158...

> Hmm... A /little/ beyond my knowledge of physics and

> electronics, but I /think/ I kind of get it. So in "stupid"

> terminology, there is a mess of data (I'll leave aside the a/d

> distinction since it kind of threw me) in each sector, some of

> it may be weak, some may be stronger, but the latest write will

> (hopefully) be the strongest and easiest to read. With time it

> all gets messier, but the latest signal remains the strongest,

> which is why even though there's noise, it never reaches the

> point where the drive would be unreadable. The latest writes,

> anyway. I would seem the garbage underneath - certainly the

> older writes - is for all intents and purposes garbled beyond

> any recoverability.

>

> Did I sort of understand you?

>

Pretty darn close, in a logic sense. But it's a bit more complicated than

that. The 'garbage underneath' as you put it, in a digital sense,

influences slightly the timing of the flux transitions. In a digital data

stream, as long as the timing is 'in the window', then it doesn't matter.

It's like saying 1200 baud vs 1199 baud. Could you tell? As long

as each bit by the end of the word is still in the timing cell, so what.

But if you were to carefully analyze the 1199 baud data stream, you

could see that the 'bits' were not aligning quite right. Heck, you could

hide a secret (low speed) message inside a serial data stream by

adjusting the speed up and down but still within valid timing constraints

of the 'official' speed.

Anyway, that's one aspect of it. The other is residual analog data. While

the data is digital, the magnetic field imprinted on the media is analog.

Again, as long as any aberrations of the field is not causing the digital

data to go outside of the 'windows' it should be in for correct digital

data,

it doesn't matter.

And remember, disk drive electronics have evolved over the years to

get more and more robust with regard to pulling out the last recorded

data and ignoring everything else that is there.

Hmm, just think back to HiFi tape days... I know, it's not directly

applicable to this, but from a purely analog point of view, did you

ever make a tape, then tape over and (on some equipment) if you

cranked up things hear a faint remnant? Usually that was just due to

cheap equipment that didn't fully erase, but in a 'master studio' if the

tape wasn't 'brand new' out of the box, it just wasn't used to master.

Sure, equipment evolved and it quickly became a non-issue. But

that was analog in an analog world. Residual data in magnetic drives

wasn't an issue, the issue was just making sure the latest data was

the data it extracted. Yeah, they did improve the recording technology

a bit, but almost all the 'improvements' were in the reading and

data separation areas.

March 25, 2008

Re: destorying the hard drive

"thanatoid" <waiting@the.exit.invalid> wrote in message

news:Xns9A6B8652E670Dthanexit@66.250.146.158...

>

> Do you remember when people started using VHS tapes JUST to

> record music - in the Hi-Fi mode - since, even though analog,

> its quality rivaled digital?

I had one of the early HiFi VHS decks, and never really liked it. There

was Stereo VHS also, but that was different, I don't remember exactly

how. I was actually a Beta guy, having one of the early SL-7200

machines. (Beta I only, 90 minutes with the 750 tape. There was a

longer tape, but some machines would eat it on a regular basis.) Then

went SL-8200 for 2-speed. Finally ended up with a Beta-HiFi deck.

It actually recorded the audio on 4 subcarriers, so the head would

switch 2 and 2 as it spun without dropouts and collisions. The deck even

had an 'audio' switch on it that did something to some of the other

subcarriers

(luminence if I remember right) that supposedly gave it even better

audio quality when used just for audio. It supported Beta II and III,

but not Beta I. Oh well.

> (Straying further off-topic, I have always considered the

> Philips audio cassette as one of the great inventions of the

> last century. If they had ONLY included a 50 or 60 Hz "sync"

> (for 100% speed accuracy) track like VTR's do, they would have a

> format that IMO would still be viable today. In fact, it would

> not entirely surprise me if, frustrated by DMCA, DRM, etc.

> someone someday tried to bring back the analog cassette -

> hopefully WITH the sync track feature.)

The Philips cassette was definitely neat. I heard that the license was

such that all future cassettes had to be back compatible. That's why

they laid the stereo tracks adjacent so they would play on a mono

deck, and mono tapes would play on the stereo. Sorta killed it for

4-channel though. For a short time there were '2-speed' cassette

decks. Nice. But they disappeared pretty quickly from the market.

I don't know how they handled the license restrictions...

March 25, 2008

Re: destorying the hard drive

"Gary S. Terhune" <none> wrote in message

news:OkgVhwdjIHA.2276@TK2MSFTNGP05.phx.gbl...

> Bottom line: I will continue to assume that the US government and others

> have the ability to retrieve data from a zero-filled drive (regardless of

> how many wipes). As good as your data sounds, as good as your due

> diligence seems to have been, I don't actually know you. Even if I did, it

> would make no difference. Nothing you offer *proves* that it can't be

> done, and your contention that it's never been done is, again, something I

> would have to take on faith.

>

> Now, ask me if I give much of a damn what the government can read from my

> hard drive. They already know MUCH more than that about me. And about you,

> too, and everyone else in this joint with their silly fears, aliases, etc.

> If I have something to hide from the government or other major power,

> adding a degausser to my toolkit and using it will be a minor issue. Your

> own claims would be merely academic irrlevancies.

>

> --

> Gary S. Terhune

> MS-MVP Shell/User

> http://www.grystmill.com

>

> "John John" <audetweld@nbnet.nb.ca> wrote in message

> news:%23I7lHidjIHA.3940@TK2MSFTNGP05.phx.gbl...

>>I have had private email conversations with Peter Gutmann on this subject

>>and he has told me that he was never able to recover data on a wiped

>>drive, all he could ever do was show presence of previous data, he could

>>not tell what the previous data was. His method was offered as a

>>theoretical method of data recovery, he used it to reinforce the need for

>>secure deletion methods. Read the Epilogue in his paper. In my

>>conversation with him I asked him if he knew if anyone had ever used his

>>method to recover data on a wiped drive, to which he replied that he knew

>>of none who had. He knew of one person working for a hard drive

>>manufacturer who had done research on the matter but to his knowledge the

>>research led nowhere. Dr. Gutmann would not give me the name or address

>>of this researcher because he (the researcher) was doing this research

>>without his employer's knowledge or explicit consent, Peter did not want

>>to put this person in an "uncomfortable" position.

>>

>> John

>>

>> Gary S. Terhune wrote:

>>> You now have a case of battling scientific papers, and you're going to

>>> have to do a lot more than just insist that you're guy's right. Or

>>> rather, you should give it up until Gutmann himself fess's up. From

>>> where I sit, the more you yell, the lower your credibility goes. Provide

>>> your references to the best of your ability and then let them speak for

>>> themselves.

>>>

>>

>

If anyone intends to hide anything from an entity with the resources of the

U.S. government, a PC hard drive is the last place to hide same.

--

Dave

How about a tax to support any military conflict/police action over 3 months

old?

An actual war, we can do what's been done in the past.

March 25, 2008

Re: destorying the hard drive

"thanatoid" <waiting@the.exit.invalid> wrote in message

news:Xns9A6BECCAB8555thanexit@66.250.146.158...

> >> (Straying further off-topic, I have always considered the

> >> Philips audio cassette as one of the great inventions of

> >> the last century. If they had ONLY included a 50 or 60 Hz

> >> "sync" (for 100% speed accuracy) track like VTR's do, they

> >> would have a format that IMO would still be viable today.

> >> In fact, it would not entirely surprise me if, frustrated

> >> by DMCA, DRM, etc. someone someday tried to bring back the

> >> analog cassette - hopefully WITH the sync track feature.)

> >

> > The Philips cassette was definitely neat. I heard that the

> > license was such that all future cassettes had to be back

> > compatible. That's why they laid the stereo tracks

> > adjacent so they would play on a mono deck, and mono tapes

> > would play on the stereo. Sorta killed it for 4-channel

> > though. For a short time there were '2-speed' cassette

> > decks. Nice. But they disappeared pretty quickly from the

> > market. I don't know how they handled the license

> > restrictions...

>

> Yes, the double speed must have produced excellent sound. And

> even at 1 7/8, Nakamichi had some very impressive technology

> enhancements and the tapes sounded great - when the decks

> actually worked. An audio repair technician coworker of mine

> used to say "Nakamichi - great, as long as you never press the

> power switch!" (he used to say the same about B&O).

>

> Then there were the weirdo vari-speed portable cassette decks

> used for business and as dictaphones... Ah, the memories... ;-)

>

> I think the restrictions of the Philips original were quite

> relaxed after a while - I /believe/ the original even specified

> 30, 60 and 90 mins. as the only OK lengths. Not to mention

> chrome, metal, super-avilyn (never DID find out what THAT was,

> but the BEST sounding cassettes of the 500 or so I still have

> were the TDK AD's, not chrome or SA, but "enhanced standard").

>

> Did you ever see the weirdness that was the attempt in the mid

> 90's to make a digital cassette format physically based on the

> Philips specs, but which would play back the regular AND record

> (and play, obviously) digital? Sometimes you really wonder what

> people are thinking of. I wonder if even 200 of those decks were

> ever sold worldwide.

>

> Nice chatting. Cheers.

>

I remember some cassette deck that had helical scan, and the first thought

in my mind was how to handle condensation in a car. But I don't

think that was standard cassette. Hey, if it weren't for the clocks on

home VCRs, there's still be 'DEW' warnings. My first two Beta units

had external clocks (mechanical) that turned the thing on and off. If

the DEW light was on, you had to wait to use it. Once clocks were

in VCRs, then they stayed warm enough to not be a problem, since

power would never be turned off.

B&O... Great sound, but... My girlfriend bought me a B&O MMC4000

cartridge for my system for Christmas one year. It was utterly

fantastic. But about 3 years later got intermittent on one channel.

I had a friend with a Nak deck. Nice. But I picked up an Hitachi that

sounded better. The Nak was quieter. In fact, was the quietest tape

unit I ever heard (or didn't hear). But my Hitachi had front panel

bias controls, had front panel level tracking, and internal generators

so you could set record/playback and even bias for Dolby levels.

It was a 3-head unit, and the -3db and -20db curves NEVER intersected

in the audio band! Unfortunately it didn't do metal tape. I never tried

the TDK AD but did try the SA. Not bad, but I ended up with

Maxell UD-XL Type II and bought that in 'case lots' so I only had

to set the tape up once (although I always did it every time, it was

so easy).

March 26, 2008

Re: destorying the hard drive

On 24 Mar 2008 19:09:09 GMT, thanatoid <waiting@the.exit.invalid> put

finger to keyboard and composed:

>Franc Zabkar <fzabkar@iinternode.on.net> wrote in

>news:rngeu3dsf5jflvcius8rpdq1g9r3al3ipk@4ax.com:

>>>This idea - as *fact* - was presented in a thread with the

>>>same subject (I wonder just HOW many of those there have

>>>been by now) by someone a few years ago. He claimed a

>>>"residue" of whatever is written to a HD /REMAINS/ even if

>>>you write over it a bunch of times - something like: new

>>>drive, zero-formatted - 100% magnetic signal retention,

>>>second write in the same sector - 95%, third 90%, etc. I

>>>pointed out that simple logic would dictate that if

>>>anything like this was true, all drives would fail within a

>>>few weeks of being installed. There was no reply.

>>

>> Yeah, that makes sense.

>

>What HE said or what I said? Having read the last few posts, I

>now think he was correct (although perhaps not expressing

>himself as well as he could have) but that (consistently with my

>regrettable black-and-white way of looking at everything) I

>interpreted his statements not unlike using a sledgehammer with

>a push-pin.

Maybe I didn't understand you or the other person correctly. FWIW this

is how I would look at it.

Let's assume we have three recordings, A, B, and C, where A is the

first and C is the latest. Let's also assume that we are starting with

a blank magnetic medium and that each recording is only 90% efficient,

ie 10% of the previous signal is not erased.

After recording # A, the recorded signal consists of 100% A.

After recording # B, the recorded signal consists of 90% B and 10% A.

After recording # C, the recorded signal consists of 90% C, 9% B and

1 % A.

The above result is a lot different than your example. AFAICT, in your

example the noise component would grow every time you wrote new data

to the same sector because you would accumulate contributions from all

past writes.

>Do you remember when people started using VHS tapes JUST to

>record music - in the Hi-Fi mode - since, even though analog,

>its quality rivaled digital?

Yes, that was quite common. IIRC, the frequency response was better

than 20Hz - 20kHz. I also remember VHS tape and standard analogue VHS

VCRs being used as computer backup for office systems such as Corvus

during the 1980s.

- Franc Zabkar

--

Please remove one 'i' from my address when replying by email.

March 26, 2008

Re: destorying the hard drive

On Mon, 24 Mar 2008 19:25:51 -0500, "Mike Y" <joe@user.com> put finger

to keyboard and composed:

>Hmm, just think back to HiFi tape days... I know, it's not directly

>applicable to this, but from a purely analog point of view, did you

>ever make a tape, then tape over and (on some equipment) if you

>cranked up things hear a faint remnant? Usually that was just due to

>cheap equipment that didn't fully erase, but in a 'master studio' if the

>tape wasn't 'brand new' out of the box, it just wasn't used to master.

>Sure, equipment evolved and it quickly became a non-issue. But

>that was analog in an analog world. Residual data in magnetic drives

>wasn't an issue, the issue was just making sure the latest data was

>the data it extracted. Yeah, they did improve the recording technology

>a bit, but almost all the 'improvements' were in the reading and

>data separation areas.

As you have already said, in the analogue domain you have degrees of

magnetisation whereas in the digital domain you have flux reversals. I

notice that analogue recording devices such as VCRs and compact audio

cassette recorders have an erase head before the read/write head. When

an erase circuit fails in a VCR, a ghost of the previous audio signal

remains after new audio information is recorded. IIRC, such a failure

does not significantly impact on the video signal. You should be able

to see this for yourself if you hold the erase head away from the tape

path during recording. I think the bias oscillator (via the

record/play head) tries its best to randomise the magnetic domains but

there is always a small audible remnant of the previous recording.

Therefore the erase head is necessary to completely wipe the tape. In

the digital domain, however, there is no erase head, only a read/write

head. AIUI, a separate erase head is not required because the

magnetisation is always "full on", ie either positive or negative.

Zeros and ones are encoded as flux transitions, not flux levels, so

there is no portion of the medium that is not fully magnetised. Since

the circuitry is designed to detect these flux reversals, then it does

not discriminate between a 100% one bit or a "noisy" 70% one bit. Both

are seen as a logic 1.

- Franc Zabkar

--

Please remove one 'i' from my address when replying by email.

March 26, 2008

Re: destorying the hard drive

"Franc Zabkar" <fzabkar@iinternode.on.net> wrote in message

news:op5ju3hvdtjsic3icon7vnoncaqht3o3on@4ax.com...

> On Mon, 24 Mar 2008 19:25:51 -0500, "Mike Y" <joe@user.com> put finger

> to keyboard and composed:

>

> >Hmm, just think back to HiFi tape days... I know, it's not directly

> >applicable to this, but from a purely analog point of view, did you

> >ever make a tape, then tape over and (on some equipment) if you

> >cranked up things hear a faint remnant? Usually that was just due to

> >cheap equipment that didn't fully erase, but in a 'master studio' if the

> >tape wasn't 'brand new' out of the box, it just wasn't used to master.

> >Sure, equipment evolved and it quickly became a non-issue. But

> >that was analog in an analog world. Residual data in magnetic drives

> >wasn't an issue, the issue was just making sure the latest data was

> >the data it extracted. Yeah, they did improve the recording technology

> >a bit, but almost all the 'improvements' were in the reading and

> >data separation areas.

>

> As you have already said, in the analogue domain you have degrees of

> magnetisation whereas in the digital domain you have flux reversals. I

> notice that analogue recording devices such as VCRs and compact audio

> cassette recorders have an erase head before the read/write head. When

> an erase circuit fails in a VCR, a ghost of the previous audio signal

> remains after new audio information is recorded. IIRC, such a failure

> does not significantly impact on the video signal. You should be able

> to see this for yourself if you hold the erase head away from the tape

> path during recording. I think the bias oscillator (via the

> record/play head) tries its best to randomise the magnetic domains but

> there is always a small audible remnant of the previous recording.

> Therefore the erase head is necessary to completely wipe the tape. In

> the digital domain, however, there is no erase head, only a read/write

> head. AIUI, a separate erase head is not required because the

> magnetisation is always "full on", ie either positive or negative.

> Zeros and ones are encoded as flux transitions, not flux levels, so

> there is no portion of the medium that is not fully magnetised. Since

> the circuitry is designed to detect these flux reversals, then it does

> not discriminate between a 100% one bit or a "noisy" 70% one bit. Both

> are seen as a logic 1.

>

> - Franc Zabkar

You hit it pretty square on the head. Mostly. In writing, the current is

not 'full on'. It's balanced with where the head is positioned on the

media.

Early drives had reduced write current controls that the controller was

responsible for triggering when the head was positioned halfway towards

the center of the spinning media. That means there were only two levels,

and in each 'zone' there would be areas where the current was reduced

under optimum. And always remember, the circuitry was designed to

give 'reliable readback' of data, it was NOT necessarily designed to

mandate magnetic saturation at all points on the media. If two much

current caused distortions and errors, and too little meant reduced S/N

ratios that could be compensated for with PLL recovery schemes, then

you can bet the MOST the current would ever be set for was before it

saturated and caused data errors and let the data separators do their

job on read.

And your statement about the 100% or 70% both being seen as a logic

one is dead on. Well, in FM recording. In MFM and later formats, the

bits are NOT 1 or 0, they are time marks, and the time marks determine

0 or 1. But the same idea applies.

Anyway, drives went from FM to MFM to RLL to ESDI (5 different

ESDI speeds if I remember right) to finally IDE, where the drive and

the controller are one. Why separate them? Once the drive and

controller are one, does it matter what's inside the bubble? Nowadays,

most drives lie worse than the last car salesman I DIDN'T deal with.

But it doesn't matter, all that matters to the user is the 'data packets'

that come out the IDE bus (IF it's an IDE drive, the SATA interface

if it's a SATA drive, or SCSI if it's SCSI) are correct and contain

the information desired. With the new drives the media is now

referred to, if I remember right, ZBR, or something like Zone Bit

Recorded. Basically it means the controller in the drive breaks the

media up into 'Zones' and changes things as it feels necessary. That

is, the number of sectors on a track changes, depending on the

velocity under the head (near the rim is faster) and even the RATE

of flux changes is adjusted for best performance and capacity.

The end result is that with modern drives, the user at the 'interface

point' to a drive is even FURTHER isolated from what goes on in

the sealed box call a hard disk drive, and reading anything from the

drive other than what the drive is designed to read and report would

be quite impossible.

March 26, 2008

Re: destorying the hard drive

The difference being that, even though the ghost is there and visible,

there's no way to separate the earlier image from the later image. It's one

signal from a mixed source. The human brain can identify the ghost as a

ghost, but that's a trick technology hasn't yet mastered.

With a digital format it's possible, in theory, to analyse the analogue

signal from the drive read head and to identify flux transitions from

previous recordings. Any existing flux transition on the disk surface will

affect the way that the later transition gets recorded. The idea is that

with modern high speed DSP the analogue signal can reveal the artefacts in

a flux transition that reflect the previous version of the digital data.

Combined with pattern matching technology and some guesswork, the earlier

version flux transitions could be re-created from those remnants, and the

original digital signal reconstructed.

Whether anyone has actually done it is doubtful, but the paranoid amongst us

will claim that the lack of any evidence simply proves that the CIA can do

it, and has managed to keep it secret.

--

Jeff Richards

MS MVP (Windows - Shell/User)

"Franc Zabkar" <fzabkar@iinternode.on.net> wrote in message

news:op5ju3hvdtjsic3icon7vnoncaqht3o3on@4ax.com...

> On Mon, 24 Mar 2008 19:25:51 -0500, "Mike Y" <joe@user.com> put finger

> to keyboard and composed:

>

>snip <