Question: If you write over an ENTIRE hard drive with data,

[PM Martin]

will any data that existed before the overwrite be recoverable? Yes? No? :shrug:

[NYC_SKP]

1. I think yes, some of it.

Because if it was that easy, people wouldn't recommend death by cutting up and melting them.

:hi:

[TheWraith]

33. To completely erase a hard drive, a minimum of three overwrites is required by the DOD.

The NSA uses seven.

[teddy51]

2. Nope. You, might with special software be able to recover something,

highly unlikely.

[Ian David]

3. If you fill your hard drive with porn, they may stop looking for hidden data, and just fap instead.

[Duer 157099]

4. Be more specific about what you mean by rewriting the entire hard drive

Do you mean over the course of some long period of time? With frequent defrags? Then maybe.

It's when it is overwritten quickly in a short period that, I believe, it can be undone, depending on how it was overwritten.

[itsrobert]

5. Why? Are you trying to hide from the feds?

Are did you steal a laptop?

[Speck Tater]

6. I'm pretty sure the answer is no.

I know that if you "erase" a drive that residual magnetism can sometimes be recovered, but if new data is written over the old then each spot on the disk is either magnetized one way or the other way, there are no half-way states. Old analog tapes like cassette and reel-to-reel audio tapes erasing often was not enough to make the information unrecoverable, but I'm pretty sure that new data will destroy all traces of any old data.

That said, I've heard "stories" that people like the CIA can recover overwritten data, but from my knowledge of electrical engineering I seriously doubt those stories. The stories were probably true in the analog era, but probably not in the digital era.

[PM Martin]

15. Thank you.

[bananas]

20. don't doubt those stories

www.zdnet.com/blog/storage/how-to-really-erase-a-hard-drive/129

[Aerows]

23. That's for IDE drives though

SATA drives don't function with the same debug type commands. Heaven knows I did enough debug low level formats back in the day.

[bananas]

38. My point is that securely erasing a drive requires much more than a couple of overwrites

It requires multiple overwrites using properly generated bit patterns.
A number of replies to the OP are unaware of this.

http://en.wikipedia.org/wiki/Data_erasure

<snip>

Regulatory compliance

Strict industry standards and government regulations are in place that force organizations to mitigate the risk of unauthorized exposure of confidential corporate and government data. These regulations include HIPAA (Health Insurance Portability and Accountability Act); FACTA (The Fair and Accurate Credit Transactions Act of 2003); GLB (Gramm-Leach Bliley); Sarbanes-Oxley Act (SOx); and Payment Card Industry Data Security Standards (PCI DSS). Failure to comply can result in fines and damage to company reputation, as well as civil and criminal liability.

<snip>

Standards

Many government and industry standards exist for software-based overwriting that removes data. A key factor in meeting these standards is the number of times the data is overwritten. Also, some standards require a method to verify that all data has been removed from the entire hard drive and to view the overwrite pattern. Complete data erasure should account for hidden areas, typically DCO, HPA and remapped sectors.

The 1995 edition of the National Industrial Security Program Operating Manual (DoD 5220.22-M) permitted the use of overwriting techniques to sanitize some types of media by writing all addressable locations with a character, its complement, and then a random character. This provision was removed in a 2001 change to the manual and was never permitted for Top Secret media, but it is still listed as a technique by many providers of data erasure software.<10>

Data erasure software should provide the user with a validation certificate indicating that the overwriting procedure was completed properly. Data erasure software should also comply with requirements to erase hidden areas, provide a defects log list, and list bad sectors that could not be overwritten.

Overwriting Standard 	Date 	Overwriting Rounds 	Pattern 	Notes
U.S. Navy Staff Office Publication NAVSO P-5239-26<11> 	1993 	3 	A character, its complement, random 	Verification is mandatory
U.S. Air Force System Security Instruction 5020<12> 	1996 	4 	All 0s, all 1s, any character 	Verification is mandatory
Peter Gutmann's Algorithm 	1996 	1 to 35 	Various, including all of the other listed methods 	Originally intended for MFM and RLL disks, which are now obsolete
Bruce Schneier's Algorithm<13> 	1996 	7 	All 1s, all 0s, pseudo-random sequence five times 	
U.S. DoD Unclassified Computer Hard Drive Disposition<14> 	2001 	3 	A character, its complement, another pattern 	
German Federal Office for Information Security<15> 	2004 	2-3 	Non-uniform pattern, its complement 	
Communications Security Establishment Canada ITSG-06<16> 	2006 	3 	All 1s or 0s, its complement, a pseudo-random pattern 	For unclassified media
NIST SP-800-88<17> 	2006 	1 	? 	
U.S. National Industrial Security Program Operating Manual (DoD 5220.22-M)<10> 	2006 	? 	? 	No longer specifies any method.
NSA/CSS Storage Device Declassification Manual (SDDM)<18> 	2007 	0 	? 	Degauss or destroy only
Australian Government ICT Security Manual<19> 	2008 	1 	? 	Degauss or destroy Top Secret media
New Zealand Government Communications Security Bureau NZSIT 402<20> 	2008 	1 	? 	For data up to Confidential
British HMG Infosec Standard 5, Baseline Standard 	? 	1 	All 0s 	Verification is optional
British HMG Infosec Standard 5, Enhanced Standard 	? 	3 	All 0s, all 1s, random 	Verification is mandatory

Data can sometimes be recovered from a broken hard drive. However, if the platters on a hard drive are damaged, such as by drilling a hole through the drive (and the platters inside), then data can only be recovered by bit-by-bit analysis of each platter with advanced forensic technology. Seagate is the only company in the world to have credibly claimed such technology, although some governments may also be able to do this.

<snip>

[Aerows]

40. What file system/OS you are using is also relevant

I tried to explain how it happens under FAT, FAT32 and NTFS. If you rewrite with zero's and ones, repartition, full format, then repartition and format AGAIN under a different, AES encryption supported file system with a long password, the chances of getting anything are slim to none, because you have realigned the data patterns, with the added bonus that it's difficult to determine which FS you are dealing with, not to mention having to hassle with the fact that encryption also juggles around the bits.

There's a reason why there are encryption certification levels. Switching around file systems just makes it even messier to get anything.

[ROFF]

41. I don't think so

Peter Gutmann's Algorithm 1996 1 to 35 Various, including all of the other listed methods Originally intended for MFM and RLL disks, which are now obsolete

Nothing but nothing can erase a MFM disk.

I suggest a sledge hammer and a lot of fire.

[Aerows]

27. Also, you have to understand how file systems work

Different file systems handle formatting and deleting differently. For example under FAT16, FAT32 and NTFS (with the exception of under NTFS encryption), when a file is "deleted" those blocks of the drive are merely flagged as being available to be overwritten. That's why "deleting" isn't "deleting". Once repartition (wipe the file system), reformat, and then overwrite the entire drive with data, you've basically reset the entire drive.

As I suggested, if you want to get crazy, then repartition AGAIN with a different file system (ext4 is my preference since you can encrypt it, and it's Linux, so widely available) and then encrypt with a long password.

That's it. Not only have you destroyed the data, you've destroyed the filesystem twice AND encrypted it. Even taking apart the platters in a 1000+ certified clean room isn't going to get you anywhere because there's nothing to get.

[teddy51]

31. And if you haven't been consistant with defraging your HD, good luck

with recovery.

[Tesha]

50. It used to be that one could sometimes read old data by positioning the heads slightly off of the...

...track centerline. If the data was recorded off-center but over-written on-center,
you *MIGHT* be able to grab some of the old data.

But on a modern Winchester drive, after the NSA's seven recommended overwrites,
I doubt anyone can recover anything worth anything.

Tesha

[L0oniX]

7. No ...example: some wipe apps write 0's over the entire drive. Can't recover anything from that.

[htuttle]

12. It depends on how many times you write over it, however

If you only write zeros once, you (meaning someone like NSA or maybe the FBI) could conceivably retrieve something.

It goes like this: computers are digital, of course, and the information they store on the hard drive is indeed all zeros or ones. But hard drives are basically analog devices, storing magnetic data to represent zeros and ones. If you overwrite a 1 with a 0, what actually gets written is likely something like to '0.01' (to simplify a great deal). That stray charge, which is ignored as within tolerance for a zero by the hard drive circuitry, betrays that there used to be a one there instead of a zero. That's why mil-spec hard drive erasure overwrites with zeros (and/or random data) up to a dozen times.

Also, if you have a drive with S.M.A.R.T. functionality, it can mark sectors as bad so that they'll be skipped by your operating system. If there was data in the bad sectors, it might not necessarily get overwritten if you format and write zeros to it at the operating system level, since it will skip those sectors.

[Aerows]

21. Simple, rewrite zeroes and ones

Then repartition again, format under ext4 and encrypt with a 15+ password.

NSA can't even get to that if you've changed the file system a few times and encrypted.

[Speck Tater]

46. I don't think that would work

In spite of CIA/NSA propaganda to the contrary.

Given that there are four possible combinations: writing 0 over 1, 1 over 1, 0 over 0, and 1 over 0, and that that same spot may have been written many times previously, so that the initial state is unknown, it's highly unlikely that even 50% of the bits could be recovered accurately. Now suppose you can recover 50%, or 4 bits out of every byte. That means that out of the 256 possible values for one byte you've narrowed it down to sqrt(256) = 16 possibilities. So your odds of being correct on any one byte are 0.0625. Your odds of getting two bytes in a row correct are 0.0625^2 = 0.00390625. For getting 10 bytes in a row correct you have a probability of 0.0625^10 = 9.094947017729282379150390625e-13 (0.0000000000009).

The chances of recovering a 1 megabyte file correctly are 0.0625^1048576 which gives a number that is so small as to be meaningless even to physicists who play with quarks and electrons.

In other words, this whole hysteresis thing sounds good in theory but a little statistical analysis and mathematical common sense says it's just not within the realm of possibility anywhere but in a James Bond novel. I think the whole thing is an urban myth and I think the people who wrote "mil spec" on erasure fell hook line and sinker for the same urban myth. Either that or they went WAAAAAY overboard "just to be safe", when the threat never existed in the first place.

Remember, this is the same government that has thrown billions down the rat hole fighting "terrorism" in Iraq and Afghanistan when drunk drivers kill hundreds of time more people that terrorists So what do THEY know about assessing real "threats"?

[htuttle]

49. I've had that same thought over the years

The standard reasoning for multiple rewrites seems to assume that you're starting with a fresh, blank drive and only write to it once. I'm only an application-level programmer (whose only dabbled in kernel extensions for fun), but it does seem like the quality of the data retrieved would be pretty crappy (that's a technical term, I believe).

You're probably right, the mil-spec erasure thing is probably a bit of 'better safe than sorry' and another bit of 'good marketing by a contractor'.

[teddy51]

8. Did you reformat the drive, or delete and over write? You might try

Googling Data software recovery software, and see what's out there.

[inademv]

9. Just do a full drive encryption

[Scuba]

10. Maybe. Better is to "degauze" it by exposing it to a strong magnetic field. n/t

[Dennis Donovan]

11. Aren't you the same DUer that wanted to wipe his drive and send it back under warranty on the 21st?

The amount of queries about this subject from you is starting to trouble me...:scared:

[truedelphi]

13. Maybe a system restore set to a date before the computer

Had material re-written and thrown over the other stuff might get the original stuff back. (?)

I can't say for sure, but it could be worth a try.

[chrisa]

43. When completely overwriting a hard drive, this wouldn't work.

What system restore does is take snap shots of certain files, which would still be stored on a hard drive (hence they would also be written over).

[truedelphi]

51. Gotcha. Thanks for the explanation.

As someone whose notion of fixing a broken stereo is to simply put the unit in a large hefty bag, and place it in the cooler recesses of my basement for ten months, hoping it will then work, I'm not always sure of how to approach computer malfunctions.

However I have found the above stereo repair ideology will get the unit to work, three times out of four! A few chants to my Tiki god might be what does it - otherwise it's unexplainable.

[Jack Rabbit]

14. If you do that, you're pretty well screwed

Not good, not good.

[Rex]

16. Yes.

You need to low level the hard drive. Overwrites can be moved and the old data found...of course this is if someone wants to spend thousands on data recovery.

[DainBramaged]

17. I don't know anyone in my 19 years of IT experience who worried about data

on a formatted or rewritten drive.


The crooks can get your information way way easier than trying to read data off an old hard drive.

[Aerows]

19. Exactly, repartition, format, rewrite.

If you want to go the full throttle, do an aes256 encryption under ext4 with a 15+ password. Good luck to anyone getting anything even if they are in high end data recovery.

[DainBramaged]

24. Simple super write software I have used on drives containing customer data

delete the partion, FDISK and format, and plugging it into my external housing using DPWipe http://www.dpaehl.de/

One wipe will suffice.

[Aerows]

25. Good utility

Some of us are old-fashioned and do it the geeky way :D.

Seriously, any amount of rewrite and then file system reshuffling + encryption is going to render it useless to get anything.

[Aerows]

18. If you do a repartition, format and full rewrite with zeroes and ones

Then encrypt the drive with a long password (15+ char) via AES256 under a new ext4 repartition/format, even using several graphics cards in parallel via GPGPU it will take about a 1000 years to crack the encryption. Forensically, maybe 20 years in the future someone could access that data taking the steps I described, but I don't see why they would, since by then, the interface will probably have changed and it would be a little like trying to crack a 5 1/4 inch floppy for fun and profit.

i.e., no point.

Didn't I already answer this?

[guyton]

22. os-x 'secure erase' ...

will overwrite with zeros once, 3 times or 7 times depending on how thick your tin-hat is.

Personally, I used to fill disks with ascii "post no bills" over and over as being much more interesting than zeros :-)

[Silent3]

28. I thought 7 and 35 overwrites were the only built-in options...

...when using "Secure Empty Trash" from the Finder, or in Disk Utility.

Those those who are less paranoid, more impatient, and not afraid to use the Terminal, "srm -s filename" does a quick one-pass overwrite with random data, which I consider quite sufficient.

[Aerows]

30. We don't know what OS or file system the OP is using

So it's hard to say.

[Silent3]

37. The guy I replied to mentioned OS X...

...so my comment only applied to that post in particular, not the OP.

[Aerows]

39. Oh, I see

In any case, we don't truly have enough information to give a full answer, other than offering our general collective experience on how to eradicate data.

But you are quite right in your assessment for HFS/HFS+

[guyton]

47. lion disk utility

I was just reporting what the current disk utility options were for erasing the free space on a disk partition, this was os-x 10.7.2.

[Silent3]

26. There are some pretty stringent (govt.?) standards for 7 or even 35 overwrites...

...with random data to declare a drive "securely" erased, but I suspect those standards derive from early days of hard drive technology when data densities were much lower than today, when there were more places where residual magnetic signals might hide.

For extra protection, don't store critical data in both uncompressed and unencrypted form. Most forms of compression and encryption make every bit critical to correctly reading large chunks of data. Misread one bit, and the entire block of a file containing that bit, or even the entirety of the file from that bit onward, become unreadable. Once data is encoded like that, even one pass of overwriting the data with zeros will cause misread bits all over the place, preventing recovery of any meaningful content.

[johnd83]

29. You need to "flip" the bits a number of times

to completely remove any magnetic hysteresis. This takes time and computer knowledge to do. There are also special machine that you place the hard drive on, and they completely destroy the magnetics within the hard drive.

[Aerows]

32. File systems are very different within even the last ten years, though

Data of value is no longer stored as ASCII, either, and even with high end app data salvation utilities, it's a crap shoot under plain old repartition/format scenarios. Overwrite the drive, change up the file system and encrypt it, and getting it back would be so cost-prohibitive and labor-intensive that someone would have to have a VERY good reason to even invest in the time and money it would take, because the chances of success would be minimal.

[BadgerKid]

34. Depends on how you overwrite.

Look for secure erase / delete /wipe. Look for programs that implement the Gutmann method, though some people say you don't need to overwrite as many times.

[karnac]

35. Yes and No

While true that digital data is represented is represented as 1s and 0s, it still has to be translated down to an imperfect analog format and levels. even on a modern hard drive. say anything below .5 is a 0 and above a 1. reasonable.

Now for argument's sake your hard drive's electronics can bump up a level a maximum of .8 when writing.

if your original data was .0, and your new data is digitally 1, you actually only bumped it up to .8. someone reading the data with an analog device will KNOW your original data was a digital 0.
if your original data was .8(a digital 1) and you re-wrote 1 to it, the analog data would appear as a solid 1(or .99 whatever). so whomever has the proper equipment would KNOW your original data was a 1.

And the reverse is true also.

The point is this, with the *right* equipment and data recovery software it CAN be done. However, with each progressive rewriting it it becomes exponentially harder and harder to analyze and extract the original data.

Your best bet is to COMPLETELY overwrite your hard drive at least twice with completely different data or pattern each time. If you are really paranoid, do it again.

Couple notes.
Format overwrites with a predictable pattern. quick format doesn't overwrite except for a few special bytes.

Delete doesn't destroy data. merely makes appear empty on a drive. can EASILY be extracted..

[backscatter712]

36. Mere mortals won't be able to recover anything.

There's a chance the NSA might have tools - they could examine the contents of spare sectors that may have been swapped by the hard-disk's error-correction system.

As for recovering the data itself, there's theories - overwriting data is something like putting a single white coat of paint over a checkerboard pattern - you might still be able to see the checkerboard.

But for all intents and purposes, unless you've got the resources of a three-letter federal agency, you won't have the tools or expertise to do such things.

And if you use something like DBAN, which will overwrite all visible sectors of a hard disk multiple times, with various patterns including random patterns, the odds of anyone being able to recover usable data afterwards are nil.

[ProgressiveProfessor]

48. Actually most computer forensics labs can get back all/part of it today

The tools have become fairly common and inexpensive.

Only reasonable effective means is multiple overwrites with varying patterns

[Duer 157099]

42. Tutorial on Disk Drive Data Sanitization (link to PDF)

http://cmrr.ucsd.edu/people/Hughes/DataSanitizationTutorial.pdf

http://cmrr.ucsd.edu/people/Hughes/SecureErase.shtml

[ProgressiveProfessor]

44. NO

Requires multiple passes with random data blocks. Check out Eraser a free tool that can do it for you.

[Sen. Walter Sobchak]

45. We use DBAN on any computer with European customer information on it

before bringing it into the US, the liability if a computer was confiscated at the border (which has happened) and the European information was leaked would be ruinous.

http://www.dban.org/