Disk wipes

  • Thread starter Thread starter John Johnson
  • Start date Start date
J

John Johnson

Just curious
I just used a little program Diskkill to wipe my drive before
returning it.
It was freeware and just allowed one wipe, though I don't see why you
just couldn't run the program again
But its paid version lets you wipe 7 times.
Some government agencies require at least 4 wipes.

It basically as far as I know just writes 1s and 0s randoming on the
entire drive.

But why would more than one wipe make it betters. Seems it all the 1s
an 0s are changed who could anyone get anything off the drive.
 
Just curious
I just used a little program Diskkill to wipe my drive before
returning it.
It was freeware and just allowed one wipe, though I don't see why you
just couldn't run the program again
But its paid version lets you wipe 7 times.
Some government agencies require at least 4 wipes.

It basically as far as I know just writes 1s and 0s randoming on the
entire drive.

But why would more than one wipe make it betters. Seems it all the 1s
an 0s are changed who could anyone get anything off the drive.
Click to expand...

It might seem that way but that would be wrong. Read this paper which
goes into a bit of detail,
http://www.cs.auckland.ac.nz/~pgut001/pubs/secure_del.html
 
Just curious
I just used a little program Diskkill to wipe my drive before
returning it.
It was freeware and just allowed one wipe, though I don't see why you
just couldn't run the program again
But its paid version lets you wipe 7 times.
Some government agencies require at least 4 wipes.

It basically as far as I know just writes 1s and 0s randoming on the
entire drive.

But why would more than one wipe make it betters. Seems it all the 1s
an 0s are changed who could anyone get anything off the drive.
Click to expand...
The more times a disk is overwritten the less chance of retrieving
*any* data off of it. There are free utilities out there that will do
a government level wipe for free - Dban being one.
 
I think it has to do with the "edges" of the cirlcles that are written on.
The heads are not perfect so there are minisucle imperfections in the
circles, creating elipses. Sophisticated software can read the residual
data left in the spaces between the circles on the edges of the elpsises.
By writing over it 7 times, that is sufficient to randomize out the data on
the edges. Once isn't enough.

This makes me wonder if the same thing is true when you format a drive.
Does anybody know if data can be retreaved off a drive that has been
formatted?
 
Most data can be retrieved after a drive has been formatted.
Formating just marks that the sectors can be used for another
file. The original data is still there until it is overwritten with
new data.
 
Most data can be retrieved after a drive has been formatted.
Formating just marks that the sectors can be used for another
file. The original data is still there until it is overwritten with
new data.
Click to expand...

I believe that this is true of a 'quick' format but that a regular format
actually overwrites the data (once) such that it is not easily recoverable.
Deleting a file just modifies the directory so that a files data remains
intact until one of the sectors that formerly was used by the file is
allocated to a new file. For a free eraser try 'Eraser':

http://www.heidi.ie/eraser/download.php
 
I think it has to do with the "edges" of the cirlcles that are written on.
The heads are not perfect so there are minisucle imperfections in the
circles, creating elipses. Sophisticated software can read the residual
data left in the spaces between the circles on the edges of the elpsises.
By writing over it 7 times, that is sufficient to randomize out the data on
the edges. Once isn't enough.

This makes me wonder if the same thing is true when you format a drive.
Does anybody know if data can be retreaved off a drive that has been
formatted?
Click to expand...

The URL posted in a previous reply explains this process.

I believe that paper is a few years old and may not reflect what is
possible with modern disks (last 5 years), which use much more
"analog" modulation and readback much like detecting a signal in a
noisy channel like an AM radio does. Google "proximal detection IBM"
for more info. As I understand it, it is harder to read lower
layers of data on a modern disk.

The serious people that try to read "erased" data use tricks like
custom software flashed into the ROMS on the disk electronics, and
examination of the platters under a device based on an electron
microscope in a cleanroom environment. Not something the person that
buys your old PC on ebay is likely to have.

This process is so expensive that only the most important national
security cases get the full treatment.

OTOH, if you are looking for a spy then finding a name, or a telephone
number on a disk may be a critical discovery and worth millions. This
means that reading all the blocks as noise and finding one single
block (512 charecters) with meaningfull ASCII text is valuable, but
they don't expect to recover entire files as intact Word documents
with a disk that'd been erased.

IMO running a full format over a disk a couple times is fine. Nobody
other than the Spooks will be able to read your data, and maybe not
then. If you are in their sights, you have other problems.
 
Back
Top