Secure Data Removal

  • Thread starter Thread starter mcp6453
  • Start date Start date
M

mcp6453

I made the mistake of asking this question in alt.computer, so my
apologies for the somewhat duplicate post. I have some hard drives that
I am donating to charity. The drives contain confidential information
belonging to clients of a law firm. I have a free utility that writes
zeros on the drive, and there are commercial utilities that do multiple
writes. However, the commercial utility I found is $30, which is more
than I want to pay unless absolutely necessary. Can someone recommend a
free or less expensive multi-wipe utility for hard drives, all space,
not just empty?
 
I have used eraser in the past:
http://www.heidi.ie/eraser/
It is free and writes multiple patterns over the drive. Does it work?
Who really knows. I guess you take it on faith that it works, unless
you have the knowledge to try and get the data back after it is
overwritten.

Irwin
 
Previously mcp6453 said:
I made the mistake of asking this question in alt.computer, so my
apologies for the somewhat duplicate post. I have some hard drives that
I am donating to charity. The drives contain confidential information
belonging to clients of a law firm. I have a free utility that writes
zeros on the drive, and there are commercial utilities that do multiple
writes. However, the commercial utility I found is $30, which is more
than I want to pay unless absolutely necessary. Can someone recommend a
free or less expensive multi-wipe utility for hard drives, all space,
not just empty?
Click to expand...

Write zeros several times. After 10 times or so it should be as
secure as 2-3 random passes.

Arno
 
mcp6453 said:
I made the mistake of asking this question in alt.computer, so my
apologies for the somewhat duplicate post. I have some hard drives
that I am donating to charity. The drives contain confidential
information belonging to clients of a law firm. I have a free utility
that writes zeros on the drive, and there are commercial utilities
that do multiple writes. However, the commercial utility I found is
$30, which is more than I want to pay unless absolutely necessary.
Can someone recommend a free or less expensive multi-wipe utility for
hard drives, all space, not just empty?
Click to expand...

After running one or more of these "data removal" programs, run
a few "data recovery" programs, to check nothing is there !

A data recovery company can still get data off the drive by
dismantling the drive and using specialised hardware, but if you're
that bothered, don't give the drives away, just smash the platters !
 
I have used eraser in the past:
http://www.heidi.ie/eraser/
It is free and writes multiple patterns over the drive. Does it work?
Who really knows. I guess you take it on faith that it works, unless
you have the knowledge to try and get the data back after it is
overwritten.

Irwin
Click to expand...

Eraser installs a folder containing a floppy image of DBAN (Dan's Boot and
Nuke I think) which is good for sanitizing entire drives.
 
Can someone recommend a
free or less expensive multi-wipe utility for hard drives, all space,
not just empty?
Click to expand...

Darik's Boot and Nuke will do the job and it is open source:

http://dban.sourceforge.net/

Make a boot floppy, then boot from it and choose the number of passes
(from one pass of zeros to 35 passes of random data). It will nuke
everything, including the MBR, partition tables, etc., but it does
take a while to run.

Someone else suggested Eraser which is fine but it runs under Windows.
I think DBAN is the best choice for your application.

- -
Gary L.
Reply to the newsgroup only
 
After running one or more of these "data removal" programs, run
a few "data recovery" programs, to check nothing is there !
Click to expand...
A data recovery company can still get data off the drive by
dismantling the drive and using specialised hardware, but if you're
that bothered, don't give the drives away, just smash the platters !
Click to expand...

That is an unconfirmed myth with modern drives. 15 years ago this was
possible. Last year the german computer magazine c't tried to get
data recoverd after a single overwrite on a HDD. All better knowen
data recovery outfits clamied that they did not have this capability,
which means that such recovery is either impossible or very expensive
(think millions).

Arno
 
Arno Wagner said:
That is an unconfirmed myth with modern drives. 15 years ago this was
possible. Last year the german computer magazine c't tried to get
data recoverd after a single overwrite on a HDD. All better knowen
data recovery outfits clamied that they did not have this capability,
which means that such recovery is either impossible or very expensive
(think millions).
Click to expand...

The theory for multiple "shred" passes on these data eraser programs:

One pass is not enough to completely erase data, the hard disk heads
won't hit the same point 100% of the time (but will be within tolerance),
a few pases will "jitter" enough to hit a wider area.

With disassembly, pros could use a more precise head mechansim to
read old versions - the deleted data.

Are you saying this recovery is now limited to electron microscopy level
only ?
 
The theory for multiple "shred" passes on these data eraser programs:
Click to expand...
One pass is not enough to completely erase data, the hard disk heads
won't hit the same point 100% of the time (but will be within tolerance),
a few pases will "jitter" enough to hit a wider area.
Click to expand...
With disassembly, pros could use a more precise head mechansim to
read old versions - the deleted data.
Click to expand...
Are you saying this recovery is now limited to electron microscopy level
only ?
Click to expand...

I am saying that the harddrives are close to the s/n ratio of the
surface coating. There is just not enough space to squeeze two signals
into the place of one. The "imprecise positioning" will likely get
overwritten when the neighbouring tracks are written. In addition the
head-positioning has gotten extremely accurate for writes and tracks
have gotten very slim and close together. This is not floppy
technology anymore. It is quite possible that the original signal is
just not there anymore (i.e. vanished in the bachground noise) after a
single overwrite and _nothing_ can recover it.

Arno
 
Considering that the track pitch in modern drives is about 100 nm (and bit
length half of that), it's a miracle that they work at all!
 
Considering that the track pitch in modern drives is about 100 nm (and bit
length half of that), it's a miracle that they work at all!
Click to expand...


IMO the non-classified articles that described use of electron
microscope techniques are now several years old and disk capacities
have gone from the maybe 2GB to 200GB over that time. It's safe to
assume that the issues assiciated with forensic data recovery have
changed, and it's probably harder, much harder.

IBM developed much if the head and surface technology that made our
disks possible. A google for "disk proximal recording" will get you
some information.

I have no access to any seecrreet information.
 
mcp6453 said:
I made the mistake of asking this question in alt.computer, so my apologies
for the somewhat duplicate post. I have some hard drives that I am donating
to charity. The drives contain confidential information belonging to
clients of a law firm. I have a free utility that writes zeros on the
drive, and there are commercial utilities that do multiple writes. However,
the commercial utility I found is $30, which is more than I want to pay
unless absolutely necessary. Can someone recommend a free or less expensive
multi-wipe utility for hard drives, all space, not just empty?
Click to expand...

<http://msn.pcworld.com/downloads/file_description/0,fid,23100,00.asp>

This page has the ultimate boot PC. It has a tool, along with several, that
will erase a disk to DOD specs. You will need to burn the iso to a CD.
This will also take some time.
 
Previously Al Dykes said:
IMO the non-classified articles that described use of electron
microscope techniques are now several years old and disk capacities
have gone from the maybe 2GB to 200GB over that time. It's safe to
assume that the issues assiciated with forensic data recovery have
changed, and it's probably harder, much harder.
Click to expand...

Yes, and that is my point. The other is that if you cannot buy this
service commercially, and more so nobody admits being able to do it,
means that it is very expensive (no way to amortize the R&D cost over
a larger set of customers). You also have to keep in mind that before
recovery, it is not knowen to the attacker whether a specific disk is
worth the effort. In most cases it will not be, makeing it entirely
unlikely the advandec techniques needed (if they exist) will be used
on drives given to charity.

The other thing is that if, e.g., the NSA can do this, they would not
admit it because the method would then loose its value. I guess that
anything short of a planned terrorist activity would not justify
taking action on information gained with such a top secret forensic
method and thereby possibly compromising the method (i.e. making
people aware that it can be done). That means if you have evidence of
having, say, rapedn and killed a child on your hdd, wiping it several
times should put you in the clear, _even_ if they can recover it,
because they cannot admit being able to recover it for such a
''minor'' crime. (Of course if you are guilty of such a crime, I hope
they get you by other means and usually they do...)

Also for those being concerned about low grade trade secrets: Assume
it costs, say, 100.000 USD to recover a disk. Don't you think that
100.000 USD in bribes would get you the information without the risk
of not finding anything valuable on a disk?

For high-grade trade secrets, (i.e. information only stored on
computers in safe rooms and definitely not connected to any
network that leads outside of that room), by all means go for
physical destruction. I think that only very few computer
HDDs fall into this class and that it is generally not a
concern.

Arno
 
Yes, and that is my point. The other is that if you cannot buy this
service commercially, and more so nobody admits being able to do it,
means that it is very expensive (no way to amortize the R&D cost over
a larger set of customers). You also have to keep in mind that before
recovery, it is not knowen to the attacker whether a specific disk is
worth the effort. In most cases it will not be, makeing it entirely
unlikely the advandec techniques needed (if they exist) will be used
on drives given to charity.

The other thing is that if, e.g., the NSA can do this, they would not
admit it because the method would then loose its value. I guess that
anything short of a planned terrorist activity would not justify
taking action on information gained with such a top secret forensic
method and thereby possibly compromising the method (i.e. making
people aware that it can be done). That means if you have evidence of
having, say, rapedn and killed a child on your hdd, wiping it several
times should put you in the clear, _even_ if they can recover it,
because they cannot admit being able to recover it for such a
''minor'' crime. (Of course if you are guilty of such a crime, I hope
they get you by other means and usually they do...)

Also for those being concerned about low grade trade secrets: Assume
it costs, say, 100.000 USD to recover a disk. Don't you think that
100.000 USD in bribes would get you the information without the risk
of not finding anything valuable on a disk?

For high-grade trade secrets, (i.e. information only stored on
computers in safe rooms and definitely not connected to any
network that leads outside of that room), by all means go for
physical destruction. I think that only very few computer
HDDs fall into this class and that it is generally not a
concern.

Arno
--
Click to expand...

Agreed.

I'll add that for the kind of national security case this
capability would be used for, they don't expect to recover large
chunks of email or documents intact.

They attempt to recover 512 byte blocks> Each block is examined for
something that looks like a phone number, a name, or a bank account
number. In other words just short byte strings. Any of these can
assciate the disk (and it's owner) with someone else in a major case.
Some of these fragments might be a "crib" used to attack a backlog of
encrypted messages, kept for just such a break.

Our governemnt has computers full of as-yet uncrackable messages,
waiting for just such a break.
 
A data recovery company can still get data off the drive by
dismantling the drive and using specialised hardware, but if you're
that bothered, don't give the drives away, just smash the platters !
Click to expand...

No, they cannot. They cannot even read a disk that was not overwritten
at all.
 
Darik's Boot and Nuke will do the job and it is open source:

http://dban.sourceforge.net/

Make a boot floppy, then boot from it and choose the number of passes
(from one pass of zeros to 35 passes of random data). It will nuke
everything, including the MBR, partition tables, etc., but it does
take a while to run.

Someone else suggested Eraser which is fine but it runs under Windows.
I think DBAN is the best choice for your application.

- -
Gary L.
Reply to the newsgroup only
Click to expand...

And, if a disk manager was used?
 
Yes, harder, and possibly /currently/ out of price range of commercial
services, but in time technology moves on ...smash those disks now to
be sure ;)
Yes, and that is my point. The other is that if you cannot buy this
service commercially, and more so nobody admits being able to do it,
means that it is very expensive
Click to expand...

OK, but technology has a habit of becoming faster cheaper and more
accurate, just as a 1024bit RSA key might have seemed uncrackable in
the past.

I'll accept it may not be possible at commercial level at the
moment to recover overwritten sectors, that doesn't mean it will never
be feasible to recover such data from current disks.

The OP was just donating some old disks to a charity after all, so only
really needed protection from the next owner using software data
recovery tools, so a software disk eraser is fine.

Physical destruction is still safer IMO ;)
Also for those being concerned about low grade trade secrets: Assume
it costs, say, 100.000 USD to recover a disk. Don't you think that
100.000 USD in bribes would get you the information without the risk
of not finding anything valuable on a disk?
Click to expand...

That 100,000 may be less in future, as technology moves on ...in, say 5
years time, with the sensitive info still on a current technology 40Gb disk
 
Svend said:
No, they cannot. They cannot even read a disk that was not overwritten
at all.
Click to expand...

Huh?

Its relatively cheap to get data back if it hasn't been overwrittem, even if
there is a drive controller failure!
 
Huh?

Its relatively cheap to get data back if it hasn't been overwrittem, even if
there is a drive controller failure!
Click to expand...

Do you have a reliable source that indicates that someone today can
read a disk platter in anything else than the original disk?
 
Previously Mike Redrobe said:
[...]
That 100,000 may be less in future, as technology moves on ...in, say 5
years time, with the sensitive info still on a current technology 40Gb disk
Click to expand...

I doubt it. In 5 years the commercial recovery providers will offer
services based on the disks in use then. They will not have a large
market for recovery of overwritten information on 7..10 year or so
old disks. In fact there may not be any market at all, since most
commercial information is worth nothing after 5 years. The occasional
fammily photographs lost to overwrites are unlikely to justify
the investment into researching the technology. That is, of course,
if it is at all possible to do this recovery in any meaningful way.

My personal guess is that recovery of overwritten data on magnetic
HDDs will never again be commercialy interesting. I also somewhat
doubt that the intelligence community is investing heavily into this
technology, since it is far quicker to physically destroy a hdd than
to wipe it. Overwriting, e.g., a current 40GB drive a single time
takes around 20 minutes. In that time people will have opened the
drive and blow-torched the platters several times over. No chance of
recovery at all if the Curie-temperature is reached.

Still, there might be enough stupid terrorists around.

BTW, "smashing" is not a good idea. That mode of destruction
may be relatively easy (just expensive) to recover from. It may
even be withing the capacity of commercial recovery companies,
since the magnetic information stays intact.

Arno
 
Back
Top