On-Call-IT Assists In Government Data Destruction

covaro writes "Seems those on-site computer services may be helping to cover up government dirty deeds these days. The Wall Street Journal reports: 'Investigators learned that [Office of Special Counsel head Scott Bloch, who has been under investigation since 2005] erased all the files on his office personal computer late last year. They are now trying to determine whether the deletions were improper or part of a cover-up, lawyers close to the case said ... Bypassing his agency's computer technicians, Mr. Bloch phoned for Geeks on Call, the mobile PC-help service ... Bloch had his computer's hard disk completely cleansed using a "seven-level" wipe: a thorough scrubbing that conforms to Defense Department data-security standards. The process makes it nearly impossible for forensics experts to restore the data later.'"

Comments

Re:Why not just by a new hard disc

[pipatron]

And what to do with the old one? Throw away and let some scavenger hunter find the data? Wiping a drive like this sounds like the easiest way to get rid of it, compared to the alternatives.

Hire someone???

[pla]

Bloch had his computer's hard disk completely cleansed using a "seven-level" wipe: a thorough scrubbing that conforms to Defense Department data-security standards.

You have to wonder - For those who can't do such things themselves, wouldn't it cost less to just buy a new HDD, and take a sledgehammer (or thermite, where readily available) to the old one?

Sure, for most Slashdotters who can do their own "seven level wipe" (or whatever number the current rumors claim works infallably), saving a few hundred bucks for "good enough" makes sense. But if you plan to spend the money either on a drive or an "expert", why not just physically trash the drive?

Re:Hire someone???

[mh1997]

You have to wonder - For those who can't do such things themselves, wouldn't it cost less to just buy a new HDD, and take a sledgehammer (or thermite, where readily available) to the old one?

My DoD owned computer at work has the serial numbers recorded for all hardware installed inside the case.

Replace the HDD and somebody somewhere would know and think I stole the disk or data, wipe it and I just say I was removing porn. Porn would get me fired, stealing the HDD or data would get me fired and thrown in jail.

Re:Hire someone???

[couchslug]

I'd just dban the drive, then turn in the computer with the complaint it no workee. New comp shows up, old hd is destroyed, computer goes away to govliquidation.com on a pallet.

Re:Hire someone???

[NoMoreFood]

I can't say this with certainly, but with the type of advanced hardware they use to extract data, I imagine you could still extract information from a bent or cracked platter. And if they were 'monitoring' the fellow, that's something they probably would have picked out of the trash.

Re:Hire someone???

[TheSpoom]

Seriously. And it's not like it's that hard, either. It's not seven-level wipe (actually three level, which from my research suggests nobody could undo even examining every bit in an electron microscope), but all you have to do on a Windows system is run cipher /w C:\ after deleting any files you don't want someone to find.

1. You don't end up with a highly suspicious wipe and reinstall.
2. You don't have to download extra, suspicious software to do the wipe for you as cipher.exe is included with Win2K and WinXP.

Linux, of course, has the shred command anyway. But then, I suppose he's not a geek. It was a pretty stupid move to hire someone like that though without some sort of NDA.

Re:Hire someone???

[chis101]

Although without the proper screwdriver, I'd say a lot less than 1 in 10 have the ability to remove those screws. They can be tough.

Re:Hire someone???

[gweihir]

You have to wonder - For those who can't do such things themselves, wouldn't it cost less to just buy a new HDD, and take a sledgehammer (or thermite, where readily available) to the old one?

Sure, for most Slashdotters who can do their own "seven level wipe" (or whatever number the current rumors claim works infallably), saving a few hundred bucks for "good enough" makes sense. But if you plan to spend the money either on a drive or an "expert", why not just physically trash the drive?

Physically trashing the drive is allways a good idea in data destruction and loosing it afterwards (public trash can or the like) is a good idea in addition. Unless the drive is not yours and you have to be able to produce it.

What I do not understand is why the original OS and tools were not reinstalled in this case or only the free space was wiped. Especially wiping the free space would have been far less conspicuous and could have gone unnoticed.

Re:Hire someone???

[gweihir]

I can't say this with certainly, but with the type of advanced hardware they use to extract data, I imagine you could still extract information from a bent or cracked platter. And if they were 'monitoring' the fellow, that's something they probably would have picked out of the trash.

If he uses his own trash. As to bent or broken: Yes, data can be recoverd. At great cost and very slowly. Think 10's of millions and months to years. The one destruction you cannot recover from (besides a simple, complete overwrite) is heating the platters up past the Curie-point. A standard-issue blowtorch does that fine, especially on a notbook platter.

Re:Hire someone???

[TheSpoom]

Yes, but Win2K also had EFS. I don't have documentation on-hand but I can almost guarantee it was in there too.

Ah, there it is, cipher.exe was included in a hotfix.

Re:Hire someone???

[warpuck]

I agree that most slash doters can do complete cleaning of a system. I will go further and say most slash doters are more skilled than your local gov office. I would not trust the skills and the motivation of a local gov IT tech to do complete job. Most do not have any formal training. Their grasp of coding is barely beyond high school. I had one GS-9 level tech tell me that Open VMS was not A variant of Unix! You are hard put to find an A+, MCSE, CNE or any other qualifications at that level. Just call the the Geek Squad. They will use the proper software and sanitize your computer. Another effective method is firing up a hard drive while it is sitting on top or between two of large rare earth magnets I believe that the eddy currents would probably cook the magnetic media in the hard drive. I know that magnetic media does not survive high temps. Maybe it be something like sticking a cdrom in a microwave oven. I could try it an old 5Gb drive and see what happens.

Re:Hire someone???

[steeviant]

Uh... Open VMS is not a variant of Unix.

Re:Hire someone???

[ultranova]

The one destruction you cannot recover from (besides a simple, complete overwrite) is heating the platters up past the Curie-point. A standard-issue blowtorch does that fine, especially on a notbook platter.

Forget Curie point and just melt the sucker. Find an ironworks and throw the drive to a steel converter. Good luck getting data back from a railroad track which used to be a disk :).

If you don't have ironworks, take a welding equipment over every point of the surface of the disk until it physically deforms. For extra credit, use an electric welder.

Sometimes the surest solution is good old-fashioned brute force.

Re:Hire someone???

[gweihir]

Forget Curie point and just melt the sucker. Find an ironworks and throw the drive to a steel converter. Good luck getting data back from a railroad track which used to be a disk :).

I doubt very much you will be allowed to do that.

If you don't have ironworks, take a welding equipment over every point of the surface of the disk until it physically deforms. For extra credit, use an electric welder.
Sometimes the surest solution is good old-fashioned brute force.

Sounds more like good old-fashioned stupidity to me. The Curie-point is exactly as good or bad as melting a drive. It is, however, far more easily accomplished and only needs easily obtained equipment. Sadly one of these stupid comments crops up every time the topic is discussed. Don't you realize thet a high-effort way to destroy data is unlikely to be used? And that the transport to the Ironworks represnts additional risk? And that they may not want the contamination in there in the first place? Apparently not. I think you are living in a dream-world.

Re:Hire someone???

[ultranova]

The Curie-point is exactly as good or bad as melting a drive.

You can tell with a glance whether or not a drive has been melted. You can't tell with a glance whether or not a drive has been subjected to Curie point temperature on every point of the disk surface, just that it has been subjected to lots of heat. Melting the drive therefore ensures that no un-treated ones get thrown out by accident.

Furthermore, can you guarantee that the magnetic fields are the only mark left to the disk by writing ? Maybe somey three-letter agency might be able to use a scanning electron microscope to read the drive contents from the tiny deformations on the disk surface left by the long-standing magnetic fields. Melting the drive makes it completely unrecoverable for any technology short of reversing entropy.

It is, however, far more easily accomplished and only needs easily obtained equipment.

A spectographer to determine what the drive is made of to determine its Curie point, a thermometer to determine that is has reached that point, and a high-power oven - or a simple oxygen-acetylene torch aimed at the disk full blast until it melts. No, I think that my idea is simpler to implement.

Re:Hire someone???

[vuffi_raa]

actually a verified wipe is more secure as forensics (which is part of my job as well as recovery and extraction/integration of data do a db) can recover a sledgehammered drive a X times wipe+ verify overwrites every byte of data on the drive though the article is wrong- 7X wipe is not the standard- 3X wipe and verify is the DOD standard 7X wipe and verify is above the stated DOD standard, in the high security environment that I work in we do 2 3X wipes on every drive on exit and entry if they are reused and if they are damaged we wipe what we can before a full dismemberment and shredding of the platters and controllers before secure disposal at the end of a client engagement.

Re:Hire someone???

[vuffi_raa]

actually the easier way would be to mislead by doing an image backup before any incriminating data was on the drive and a re image of the drive- the data would conceivably still be on the drive, but during a discovery process unless the gov't used a review company like mine (which there aren't any currently in the market) that integrates forensics and recovery you probably would not raise eyebrows when the drive comes in with standard data and no incriminating data- so it would never go into the deep examination process of write logs on the controller itself, files would just be looked at with the timestamps in the metadata and passed on
one of these days people will learn that getting rid of data is way more difficult than creating misleading data in a legal process, but for now we can depend on the stupidity of criminals

Re:Hire someone???

[gweihir]

Maybe somey three-letter agency might be able to use a scanning electron microscope to read the drive contents from the tiny deformations on the disk surface left by the long-standing magnetic fields.

Nonsense. No such effect exits.

Melting the drive makes it completely unrecoverable for any technology short of reversing entropy.

As does exceeding the Curie-temperature. As to determining the Curie-Temperature, a simple literature-seach does that. Temperature can be stimated by glow-color very easily. As a rule of thumb, a nice oragne-red is enough for allmost all meterials. However melting a drive is a dangerous operation or requires equipment not available in the average hardware store.

Re:Hire someone???

[ultranova]

Nonsense. No such effect exits.

To the best of your or my knowledge, no. Why take a risk that that knowledge is incomplete ? It seems to me that the one common factor in most breaches of security is that someone got overconfident at some point.

As a rule of thumb, a nice oragne-red is enough for allmost all meterials. However melting a drive is a dangerous operation or requires equipment not available in the average hardware store.

Welding equipment is sufficient to melt steel; that's what welding is based on. And making the drive red-hot will cause all flammable parts to catch fire and likely emit unhealthy smoke, and requires a heatproof area, and is nowhere near safe; it's just not that hard to go the extra step and plain destory the thing.

He's done nothing wrong

[Anonymous Coward]

This is a Rove smear, he is investigating Rove, and Rove always tries to smear anyone who tries to uncover his dirty lies.

Re:He's done nothing wrong

[DigiShaman]

Remember folks. It's the seriousness of the charge, not the lack of evidence that's important.

Guilty until proven innocent seems to be the mime around here.

Re:He's done nothing wrong

[warpuck]

The office of Special Counsel has the same function as Internal Affairs has in a police department. This is who you contact as an employee to blow the whistle. I would look a few more pay grades up the food chain to find out who really wanted those drives erased.

Sounds like

[Provocateur]

a resounding recommendation for Geeks on Call.

Unless they happen to be ex-DoD IT employees, trying to make ends meet.

Re:Sounds like

[rudeboy1]

Meh. I'm not terribly impressed. I'm guessing all the guy did was show up, ran a copy of DBan charged him $300 (because it's a government job), then left. Not that he did anything wrong. At least he knew the difference between formatting a drive and securely wiping it.

Exactly as I suspected

[GoofyBoy]

"The process makes it nearly impossible for forensics experts to restore the data later."

Notice the wording: _nearly_ impossible. But not impossible, huh?

Lessoned learned: don't trust a seven-pass DOD 5220.22-M. Use a 35 pass ( http://en.wikipedia.org/wiki/Gutmann_method ) because you never know who wants your private collection of pr0n.

Re:Exactly as I suspected

[bhima]

Not that I have a better idea but I was under the impression that this method was obsolete.
Also I wonder if this does not hasten the death of the drives it is used on.

Re:Exactly as I suspected

[bogie]

Gutmann method was only meant for drives from like 20 years ago. I believe he later stated that a few wipes of random data were about the best you could do.

Re:Exactly as I suspected

[Vellmont]

Notice the wording: _nearly_ impossible. But not impossible, huh?

I'm not sure if you're joking or not, but in case you aren't, do you really trust the some dumb WSJ journalist over what HD experts have been saying for years? What likely happened is said dumb WSJ journalist asked the local tech guy about wipes, he said "yah, if you do it right it can't be recovered..", so that became "nearly impossible".

HD technology isn't secret. There may be some techniques the HD makers don't like to share, but the technology itself is well known, and well understood. If it were possible to recover data from a complete wipe, we'd know about it.

Re:Exactly as I suspected

[Ortega-Starfire]

From your own article posted:

Gutmann himself has responded to some of these criticisms and also criticized how his algorithm has been abused in an epilogue to his original paper, in which he states:

" In the time since this paper was published, some people have treated the 35-pass overwrite technique described in it more as a kind of voodoo incantation to banish evil spirits than the result of a technical analysis of drive encoding techniques. As a result, they advocate applying the voodoo to PRML and EPRML drives even though it will have no more effect than a simple scrubbing with random data. In fact performing the full 35-pass overwrite is pointless for any drive since it targets a blend of scenarios involving all types of (normally-used) encoding technology, which covers everything back to 30+-year-old MFM methods (if you don't understand that statement, re-read the paper). If you're using a drive which uses encoding technology X, you only need to perform the passes specific to X, and you never need to perform all 35 passes. For any modern PRML/EPRML drive, a few passes of random scrubbing is the best you can do. As the paper says, "A good scrubbing with random data will do about as well as can be expected". This was true in 1996, and is still true now. "

Re:Exactly as I suspected

[a_nonamiss]

Really, a single wipe with random data would *almost* do it. It would render the system unrecoverable, but my guess as to why the DOD requires 3 wipes is that if you're talking about nuclear launch codes, you'd only need to recover a few bytes of information to get very, very valuable data. If you knew exactly where to look, and knew exactly what you were looking for, it's conceivable that you could re-create the missing data based on residual magnetic signatures and complex mathematical analysis of the exact levels of magnetic field for each bit. There are many values between "on" and "off". It wouldn't be easy, but the KGB had a lot of resources dedicated to such follies.

I couldn't imagine even a determined individual could recover anything from a drive that's been wiped twice, but the DOD always tends to overdo everything, so thrice is the magic number. Anything more is just wearing out your magnetic media.

Re:Exactly as I suspected

[myxiplx]

I actually read something about being able to detect many additional magnetic fields on a drive if you really need to recover data. The trick is to dismantle it instead of using it's own read/write head. I think it was using a scanning electron microscope.

The gist of the article was that when data's stored for a long time, it has a detectable effect on the surrounding areas. So, no matter how many times you overwrite the data, the signature of the original is still detectable if you have sufficient resources to throw at it.

Was a fascinating read, but it was a long time ago when I read that, and I'm too lazy to google a link for you I'm afraid :-)

Re:Exactly as I suspected

[gweihir]

Notice the wording: _nearly_ impossible. But not impossible, huh?

This is likely just incompetent journalism. There is zero evidence that anybody can recover data after one overwrite with zeros on a modern drive.

Re:Exactly as I suspected

[GoofyBoy]

http://en.wikipedia.org/wiki/Data_remanence

I wonder what is the theory erasing solid-state memory....

Re:Exactly as I suspected

[a_nonamiss]

Very interesting, and again, if you're talking about a 10 digit nuclear launch code, or (more realistically) 256-bit cryptographic keys used by government computers, it's probably worth the effort to make sure the thing's gone. They wouldn't have to or need to recover the entire key, for example. If you recovered some of the bits, you could brute force the remaining bits more easily. Not knowing which bits, if any, were correct would slow the process, but it would offer a huge advantage over random brute force attacks.

Re:Exactly as I suspected

[flyingfsck]

There is a delete utility built into all drives that actually does work. Most people don't know this and still waste money on erase utilities that don't actually work...

See this: http://cmrr.ucsd.edu/people/Hughes/SecureErase.shtml

Re:Exactly as I suspected

[ultranova]

Really, a single wipe with random data would *almost* do it. It would render the system unrecoverable, but my guess as to why the DOD requires 3 wipes is that if you're talking about nuclear launch codes, you'd only need to recover a few bytes of information to get very, very valuable data.

If you're talking about nuclear launch codes or other truly valuable data, don't wipe the disk, destroy it by melting it to slag and get a new one. They only cost $100 dollars apiece, after all.

Re:Exactly as I suspected

[Some_Llama]

"Gutmann method was only meant for drives from like 20 years ago. I believe he later stated that a few wipes of random data were about the best you could do."

From the Wiki article (Gutmann's words):
"If you're using a drive which uses encoding technology X, you only need to perform the passes specific to X, and you never need to perform all 35 passes. For any modern PRML/EPRML drive, a few passes of random scrubbing is the best you can do. As the paper says, "A good scrubbing with random data will do about as well as can be expected". This was true in 1996, and is still true now."

So that's how the WH lost 50,000 emails!

[romanval]

They just called a geek squad to cover their tracks!

It's strange how there's no outrage over these kinds of things. The need for transparent government is seriously overlooked.

Re:So that's how the WH lost 50,000 emails!

[argiedot]

Considering the other Slashdot article talking about how those techs copy whatever they find interesting, this may not be the smartest thing for a DoD man to do. Unless, of course, he was actually supervising the whole thing.

Re:So that's how the WH lost 50,000 emails!

[Ougarou]

Appart from that, I can't see why the IT department doesn't make backup copies, for when people do stupid things like this. Isn't there a weekly image they pull that can be restored?

Surely after all these years, you would expect governments to have some kind of backup system or plan. They should start using thin-clients, NFS (or any better thing) and do full backups weekly.

Re:So that's how the WH lost 50,000 emails!

[spikedvodka]

Weekly backups? Damn, I'm wasting tapes then. Small public school and we make nightly backups of *EVERYTHING*
our rotation goes like this:
2 sets of Monday - Thursday tapes, that rotate.
5 sets of Friday tapes, Friday 1 is always the first Friday of the month, Friday 2, the second, etc.

That we we always have 2 weeks worth of full back-ups, 1 months worth of weekly backups, and the Friday 5 tape only gets used once a quarter. On top of that student records and financial data is all backed up separately as well, and we keep the student data effectively forever (as required by law - until the confirmed death of the student). and the financial data for the required length of time as well.

Re:So that's how the WH lost 50,000 emails!

[totally bogus dude]

Does your *EVERYTHING* include every single desktop and lapop used by staff? Most organisations (like ours) don't do any backups of individual PCs, because most of the data is unimportant (on the disc image used to build the system in the first place), and there's no guarantee that the system will be on when the backups run.

That does sometimes mean people lose data when their disc drive fails (saving on the desktop or My Docs), but that's their own fault; everyone is told that if they can't afford to lose the data, it must be saved to the network.

We use a similar scheme to you, except our nightlies are usually incrementals for things that support it; otherwise there's just too much data (not to mention our main fileserver array is really slow, and takes about 24 hours to backup the slightly over 1 TB of data on it). Over the weekend we run full backups, which are taken offsite, and the last one every month is archived.

Re:So that's how the WH lost 50,000 emails!

[spikedvodka]

for the most part yes. Our desktops and laptops are set to use the file server for most storage. I know there's some stuff we miss, but we do what we can

Re:Why not just by a new hard disc

[pla]

And what to do with the old one? Throw away and let some scavenger hunter find the data?

Sledge hammer applied repeatedly.

Industrial shredder.

Thermite.

Persistant application of a grinding wheel.

Personally tossing in a large crucible of molten steel.

Fuming sulfuric acid.

We may not all have the resources to do all of the above, but I'd bet most of us can find a way to physically reduce a HDD to very very small chunks, if not completely dissolving/melting it at a molecular level.

So who will stand up for his Rights?

[capnkr]

Assuming, of course, (like most /.ers will), that this guy is automatically completely Guilty (well, the magical word "Rove" was invoked, so he must be, by association...), then I wonder who among those screaming for his head will accept that if he *is* guilty, he has the Right not incriminate himself.

Then again, the Inquisitors won't need the data, they can just torture whatever information they need out of him, in order to help prove that the current Administration is devil-spawn, while the promises of those who oppose it will be fulfilled, and All Will Be Made Right In The World, if only you elect them instead this next time.

No, this isn't a Troll. Think about it, before reacting, for once.

(Cluebat: There ain't no difference between the parties up there - their sole aim is to get and keep power, and the way they do that is by telling a different set of lies about what they'll do in order to get elected. Citation: See "Current Congress".)

Time for a third party. Time for a political Monkeywrench Gang.

Chances of that happening: Slim, to None.

Forecast: Same political shit, different day.

Sigh.

Re:So who will stand up for his Rights?

[StrawberryFrog]

Assuming that this guy is automatically completely Guilty (well, the magical word "Rove" was invoked, so he must be

Um, he's "The head of the federal agency investigating Karl Rove's White House political operation" (first line of TFA).

So the message is: In Bush's America, if you investigate the administration, and someone will investigate YOU.

Re:So who will stand up for his Rights?

[capnkr]

From OP: "Think about it, before reacting, for once."

From parent: "In Bush's America..."

So your kneejerk reaction is to criticize the current administration. While completely ignoring the fact that a Clinton Administration is completely capable of doing the exact same BS, for the exact same reasons. In fact, they have, and will - it is well known that the one thing you *don't* want to do is to cross The Hillary, not if you want to keep your sack intact. We saw what happens to folks back when Bill was Prez. Same shit, different Party.

Strawberry, neither of them gives a shit about you and your concerns, not really. They just want you to keep falling for the same bi-partisan media mania bullshit, so that they can both keep getting elected. They love their power at your expense, and if you perpetuate the two party system (by voting for candidates from either party, or by propagating either partys political message of scorn for the other side, like you did in the above post), it will never get any better for you as an individual Citizen. Your Rights, your Powers as a Citizen of the USA, your spending power over the money *you* make will all be in continual decline as long as you are willing to accept the false message of dichotomy that continually comes down from the halls of power, via the channels of information pressed on you by the mass-media kingmakers.

My hopes for my fellow Americans in general: Rid yourself of affiliation with Democrats and Republicans, in thought, word, and deed. Become independent and thoughtful. Don't automatically accept propaganda and political prejudice as Truth. See things for what they are. Demand change, and be willing to work for it. Call to account those folks who are in power up there in DC, and make them do what they say, or kick them out.

They are not there to play politics for their party, they are our elected employees, and should be working for *us*.

Stepping up to the plate and becoming The Boss (as we should) won't be easy, and demands that we open our eyes to the reality of the situation we are in right now.

Re:So who will stand up for his Rights?

[StrawberryFrog]

I take your point, but I simply don't believe that previous administrations were "just as bad". They weren't; the trend has been downward for a while.

Strawberry, neither of them gives a shit about you and your concerns, not really

I'd be surprised if they did really, since I live and vote in England. I am not now, never have been, and have no intention of becoming a citizen of the USA.

Re:So who will stand up for his Rights?

[Akaihiryuu]

I can envision this hidden back room, where Republicans and Democrats cast off their pretentions of being "different" and laugh about all this. "Hey Bob, I've been in power for 8 years now, people are demanding change...so why don't you go out there and show how bad I am and how good you are. They'll vote for you, and we can still keep the same power structure where we both benefit!"

Re:So who will stand up for his Rights?

[capnkr]

From parent: "I take your point, but I simply don't believe that previous administrations were "just as bad". They weren't; the trend has been downward for a while."

Not so, for what it's worth, despite (or more probably, *because of*) what you might see/hear "reported".

I know some insiders, including a good friend in the Secret Service, and I've heard the stories first-hand. Much of the truth about politicians in general, and in this case, the Clintons in particular, *never* gets close to being reported truthfully. The ties between politicians and media, the "favors" swapped back and forth, keep the Truth about the downright nastiness of those folks out of the public eye.

From historical readings, I think it has always been this way, sadly.

I find it interesting that you have such strong political viewpoints about American candidates, being at the remove that you are. I don't have the time in my life to study objectively the political affairs of another nation and its politicians in order to form strong opinions about it/them, and I damned sure don't believe what I read about them in the press, because it is just too obvious that these media companies have an agenda for my thoughts...

Re:So who will stand up for his Rights?

[capnkr]

Parent: "I can envision this hidden back room, where Republicans and Democrats cast off their pretentions of being "different" and laugh about all this."

They do, it's not hidden. They're called "Senate" and "Congress", but the snickering is reserved for times when the camera is not pointed at them.

Re:So who will stand up for his Rights?

[zz5555]

Hmmm, he has the right to not incriminate himself, but he doesn't have the right to destroy evidence. IANAL, but it seems to me that the evidence that might have been on the computer does not constitute incriminating himself. If that were true, then if I were to kill someone and got their blood on my clothes, I would have a constitutional right to destroy my clothes. I don't think that's the case.

I don't know whether this guy is guilty of anything or not (although he's pretty high up in politics so he's probably guilty of something), but from the write-up it seems clear that what he did was wrong. (And, no, I didn't RTFA.) I agree with your statement about needing a third party (and a fourth, and a fifth), though.

Steve

Re:So who will stand up for his Rights?

[moxley]

Until people can get over the two party scam; (the false parameters perpetrated onto the people of this country and constantly reinforced by the media); until people can get over that, see it for what it is, and look past it - we can't even begin to think about truly reforming things.

Unfortunately I think it's too late to reform the elections system and false two part (opposite sides of the same coin) system. I hope it's not, but I am being realistic. Whether you believe it or not, the US government is being run as a criminal enterprise, and has been for quite some time. We have a group of insiders exploiting and manipulating everything; mainly via intelligence services - disregarding the rule of law; running international drug trafficking rings from production to wholesale for street sale (again, this is a fact, Iran Contra stumbled on to one of these oeprations and the agency's own documents prove this) which help fund all sorts of unamerican things.

This group of people is involved in so many things and is behind the descent into fascism in America. From what I can tell, here is what the future looks like in America:

You're going to see puches for laws (and tons of media coverage) about two things: One, how dangerous the internet is and how it is a tool for both recruiting terrorists and carrying out research and attacks; also that is is being used to "radicalize" american youth. This media and legislative stuff has already started. The internet provides too much information from too many uncontrolled sources and provides too great of a potential for oganization for the powers that be to allow it to continue uncontrolled.

You're going to see media coverage about American citizens being terrorists; especially people who look like good ol American kids. Likely trials of these people being publicized. The collapse of the dollar.

There will likely be another terrorist attack in the next 10 months. It will be (or at least will seem to be) a massive nuclear or biological/checmical attack, probably in multiple cities, definitely in DC. My guess is that it will be blamed on normal looking Americans...Martial law will be declared..The constitution will be suspended which cannot be reviewed by congress for at least 6 mo (yes, this is law, which has been made stronger by the current administration, and our fearless leader who has given himself sole authority to declare a "national emergency event" and to "ensure continuing constitutional government," look it up) Private defense contractors like Blackwater will be on the streets, people will be rounded up. The COG plan will kicxk in, FEMA will be in charge.

If you think this is exagerating, this is a great primer on why we aer in such a precarious position, (without even getting into any of the documentation, etc):

http://www.youtube.com/watch?v=RjALf12PAWc (The blueprint for crushing democracy, the 10 things which have happened in the US which indicate that we are fucked).

I highly recommend these articles (or anything by Catherine Austin Fits): http://solari.com/learn/articles_risk.htm

Also, the SPP (or North American Union) will be brought in after the collapse of the dollar or a massive attack.

I know this is dark and depressing stuff and that some people just refuse to even consider it being true. Unfortunately it is all laid out; the legal framework, the political blueprint for what is happening, and plenty of people with inside knowledge of some of this stuff are talking.

So my point really is that if you are comparing the corruption of the Bush administration to that of the Clinton administration you are wasting time and energy. They are both corrupt, they are both working toward the same end, basically. Yes, times were better (especially superficially) when Clinton was president, but overall the sickness in our system had already started long before either of them.

Re:So who will stand up for his Rights?

[RickRussellTX]

The right against self-incrimination refers to your testimony as a witness against yourself:

... nor shall be compelled in any criminal case to be a witness against himself

It's not carte blanche to destroy evidence on your government-owned computer at your government job. Lawyers, and particularly lawyers in the Office of the Special Counsel, should know that inviting a third-party to come into the building to destroy government documents is going to raise a huge red flag.

Re:So who will stand up for his Rights?

[iminplaya]

It probably goes more like this:

[Valentine overhears the Dukes talking in the bathroom]
Randolph Duke: Pay up, Mortimer. I've won the bet.
Mortimer Duke: Here, one dollar.
Randolph Duke: [chuckling] We took a perfectly useless *psychopath* like Valentine, and turned him into a successful executive. And during the same time, we turned an honest, hard-working man into a violently... deranged, would-be killer!
[laughs]
Randolph Duke: Now, what are we going to do about taking Winthorpe back and returning Valentine to the ghetto?
Mortimer Duke: I don't *want* Winthorpe back, after what he's done.
Randolph Duke: You mean, keep *Valentine* on as managing director?
Mortimer Duke: Do you really believe I would have a *nigger* run our family business, Randolph?
[Valentine's eyes widen with anger]
Randolph Duke: Of course, not. Neither would I.

Re:So who will stand up for his Rights?

[GPF(BSOD)]

You are a goddamned nut. Brazil, I hope. They're quite tasty.

Two words...

[Aphrika]

...plausible deniability...

Taking a hammer (or thermite) to a hard drive is considerably more suspicious than saying you "wiped your drive because you thought you had a virus". In todays security-conscious environment, an overzealous old guy wiping his drive in such a manner can easily be spun into something done with a good conscience... or if you're feeling brave, stupidity...

How about Hanlon's Razor; "never attribute to malice, what can be attributed to stupidity".

And that's your perfect answer "Oops I'm sorry, I wanted to make sure my virus had gone. I didn't realise it would get rid of evidence as well..." - this guy's smart, but probably not smart enough...

Re:Two words...

[ScrappyLaptop]

but...he also had them wipe the drives of several underling's laptops as well...and if he really had a virus, why not just call his own IT (the one's that said, "we don't do a level-7 for viruses we just reimage")...?

Thirty years ago, there was a huge uproar about some guy erasing a few minutes of tape. Nowadays, politicians get away with destroying evidence while under investigation...and the media doesn't even raise a stink. He who controls the media, indeed.

Re:Two words...

[ncalsmitty1369]

This kind of stuff is just crazy... Every time I tell a story like this to one of my friends they can't believe it. But stories like this keep happening.

What ever came of the White House email fiasco? Buried under the rug, forgotten in time?

Re:Two words...

[whit3]

>but...he also had them wipe the drives of several underling's laptops as well...

When the underlings left, their laptops and the data on them were going to be reissued;
a wipe to ensure confidentiality probably seems normal-practice to a lawyer (I know it
does to a doctor).

>and if he really had a virus, why not just call his own IT

Consider that a lawyer who doesn't trust his computer might not trust the IT folk who set it
up, either; getting outside support and a receipt that has that reassuring "all data wiped"
tickmark might just be the no-brainer reassurance this individual is comfortable with.
The geek squad doesn't have any reason to educate him on other options (a billable hour
is ... another $95). If the customer will pay for more work than necessary, they'll
prepare a suitable invoice... it's all good.

Re:Two words...

[apparently]

and that's your perfect answer "Oops I'm sorry, I wanted to make sure my virus had gone.

That's the polar opposite of the perfect answer. This is a government computer we're talking about. End-users aren't to be performing maintenance, contracting out maintenance, or any other such notion. The idea of "oops, I must've got a virus" complete bullshit: any IT department worth its paycheck has ensured their systems are virus-proof. In the event that a virus did manage to make its way through, mandatory SOP would be for the in-house shop to determine how security was compromise, the extent of the damage, and ensure that the issue has been resolved properly. Now take that up a notch for government systems, and "oops!" is far from a perfect excuse.

This fucker needs to be investigated.

Re:Two words...

[mrchaotica]

This fucker needs to be investigated.

No, this fucker's superiors need to be investigated. This fucker should now be presumed guilty and immediately punished!

Re:Two words...

[ScrappyLaptop]

...Except that there are very clear procedures that said lawyer is supposed to follow as an employee of the United Stated Government, plenty of which deal with things such as turnover of staff, virus infections, etc. He wasn't operating in a vaccuum. In fact, he should be at the very least *reprimanded* for not following said procedures. Allowing a private party access to those laptops, I was under the impression, is strictly prohibited unless they have a contract to do so...and the company representative stated that they've never done that before, so...

No need to waste money...

[mwilliamson]

Don't bother hiring IT services to wipe drives, just use DBAN.

Re:Why not just by a new hard disc

[mbone]

>And what to do with the old one?

Take it to a service and have it shredded. In fact, since a lot of forensic data recovery is done with scratch files, etc., that may be stored separately, take the whole computer to a service and have it shredded. (Yes, at least here in DC, there are such services.)

Since this wasn't his computer, but his employeers' computer, I expect that he may find that his easure wasn't as effective as he would of liked, and that he may now be in a lot of trouble.

Re:Why not just by a new hard disc

[cab15625]

Or a screw-driver followed by steel wool on the platters.

BTW, nitric acid would likely be more effective than sulphuric. And a mix of nitric and hydrochloric (commonly known as aqua regia) will probably do an even better job. The nitric acts as an oxidizing agent while the hydrochloric can help complex some of the resulting metal ions making the mixture more effective. Sulphuric would probably just get rid of some of the organic coatings in the time that it would take the aqua regia to chew through all the metals.

Re:Why not just by a new hard disc

[Anonymous Coward]

? Throwing your old hard disc on the fire is highly effective and free regardless of your level of technical knowledge and does not require paying someone to repeatable wipe your old one or for you to trust they are competent enough to have done it correctly.

hope someone's still got the backups

[petes_PoV]

Wiping your disk is fine. But if you work in any sort of competant organisation (does that include government?) someone will be taking regular backups of your data.

All that remains is to find the tapes ...

improperly worded?

[Anonymous Coward]

"determine whether the deletions were improper or part of a cover-up, lawyers close to the case said"

Like plain old deceit as opposed to actual fraud?
Or an ordinary murder as opposed to a bloody execution?

I'm glad these lawyers have their standards straight.

Re:Why not just by a new hard disc

[Nullav]

What, hard drives are indestructible? Goodbye, bricks!

business in destructable drives

[cinnamon colbert]

sounds like there is a business selling physically destructable drives - a drive witha an easy open case, and a method to physcially damage the platter

when i was a kid, an older geek guy told me, with admiration in his voice, about collins radio, and the manual that went with its equpiment for the military.
the 1st page of hte manual said something to the effect, if this equipment is about to be captured by the enemey, here is one thing you can do in 1 min to render the equiment unusable....

Re:business in destructable drives

[c6gunner]

That's not just the radio. Military weapons systems generally include instructions for destruction. Even machineguns are expected to be destroyed in order to prevent them falling into enemy hands, and as such there is are "suggested methods" for destroying them, such as blowing out the barrel and breech using a pull-cord, disassembling them and scattering the working parts, etc.

In other words, those instructions weren't there because the radio is so special, but rather because the military is so paranoid about letting ANYTHING fall into enemy hands.

Re:business in destructable drives

[Anonymous Coward]

all of my equipment was marked with a little red X. they expect you to put a pistol to the x and fire thus damaging the same components on every system thereby renduring systems useless even to cannibalism.

Re:business in destructable drives

[Vellmont]

sounds like there is a business selling physically destructable drives - a drive witha an easy open case, and a method to physcially damage the platter

Why do that? Just buy a large amount of flash ram. It can be erased rather quickly, and isn't recoverable. If you want to be "extra paranoid", do the 7 pass thing.

If you have a HD, just download, boot, and run dban on it. It's not all that difficult, even for a neophyte.

Re:business in destructable drives

[cinnamon colbert]

i guess the question is how are you sure - like in bet a months salary sure ?
software methods always leave a doubt
shredding the platter seems sure

Re:business in destructable drives

[mcrbids]

sounds like there is a business selling physically destructable drives - a drive witha an easy open case, and a method to physcially damage the platter

Actually, they already exist. They require an accessory that costs about $50.

Re:business in destructable drives

[Vellmont]

i guess the question is how are you sure - like in bet a months salary sure ?

Depends on what the conditions are. Recovering a single bit on the whole hard drive sure? No. Recover anything meaningful? Sure. (BTW, with shredding the harddrive, A determined attacker would most certainly be able to recover something meaningful). Those bits are packed tight.

software methods always leave a doubt

It seems like this attitude persists, but I've never heard of anyone recovering anything after a full wipe.

He should have used a Mac

[MichaelCrawford]

Launch Disk Utility from /Applications/Utilities. If you want to erase your boot drive, you'll have to boot off an OS X installer CD then run Disk Utility from the installer.

Select your hard drive from the list on the left. Note that you can erase either a whole drive, or just a selected partition.

Click on the Erase tab, then on the Security Options button.

Click on the 7-Pass Erase radio button. On Tiger (10.4) it says this provides a "highly secure erasure" of the drive; on Leopard it names the MIL-STD document that the erasure conforms to.

Click the OK button, then the Erase button, then confirm that you really want to wipe your drive.

Wait a long time.

Coverup!

For the truly paranoid, there is also a 35-pass erase option.

Re:He should have used a Mac

[kanweg]

Of course he didn't use a Mac. He was a bad guy, and in movies only the good guys use Macs.

It is easier than you describe, though. Just put your stuff in the trash and empty it. Then go to disk utility and ask it under the Erase tab to write all over the free space 7 times. No need to do format-like stuff.

Bert

Re:He should have used a Mac

[Brill]

but then he wouldnt have been able to claim he had a virus :)

So what would you do?

[Anonymous Coward]

You have a virus infection on a laptop which has an unknown history of security sensitive data being stored onto it. The previous or current owner can tell you just what data is important still.

You don't know just what the virus might have transmitted. Possibly this is not the first such case with unknown consequences.

So you just get rid of the virus for now, and leave unknown amounts of sensitive but no longer needed data there for the next virus which is bound to happen eventually?

Sorry, but I consider it eminently sensible to use the opportunity to actually clean out dangerous garbage before it blows up around your head next time.

Yes, this is not necessary for virus removal (iff the virus gets removed properly). It is to guard against sensitive but no longer needed data coming into the wrong hands later on.

Whether the "wrong hands" this has been for have been virus writers or law enforcement or both: one can't know without being involved.

I'm not sure what to think of this......

[klwood911]

All these thoughts come to mind:

1. What did they charge the GOVERNMENT to do this?
2. Should I be upset that this guy needed to use my tax money to hire an outside company to do something when my tax money goes for a goverment IT person making $100K+ that could do it or that the person could have used the theoretical $700 hammer to get the job done?
3. Did Geeks on Call have licensed software to do the job? (OK aBB reference)
4. Did Geeks on Call backup the data to a portable drive to take back to the office (Yes I know this was BB, but who else does this?)

So many questions and no answers. I'm sure I could think of more.

Re:I'm not sure what to think of this......

[Fnord666]

2. Should I be upset that this guy needed to use my tax money to hire an outside company to do something when my tax money goes for a goverment IT person making $100K+ that could do it or that the person could have used the theoretical $700 hammer to get the job done?

Because the in-house IT guy probably knows that a nice, clean backup of the drive prior to wiping is his ticket to an early retirement. For the less cynical of you, he is a lot more likely to know that this is a no-no and call someone about the issue.

Re:Why not just by a new hard disc

[jonbryce]

I tried destroying an old 1.2GB hdd with about 700MB of bad clusters using a sledgehammer. It was actually surprisingly robust under the blows from the hammer.

Just in case you are wondering what I was trying to hide, it was bank account details from about ten years ago.

Somewhat off topic...MOD down if you must.

[rindeee]

I just have a little gripe. It seems to me that we /. types and the public in general are obsessed with portraying anything the government of (insert western country here) does in a negative light. I think we've lost sight of the fact that the vast majority of people working in the public service sector are hard working neighbors of ours that go to work every day and do their part in an attempt to make society better. This isn't to say that the bureaucracy doesn't often screw up, create inefficiencies and from time to time do shady things, but more often than not these problems are the effect of a handful of idiots that have enough power to make things happen. Just like in a neighborhood, any large entity will have all types of people; good, bad, honest, dishonest, etc. Constant unending criticism from the general public neither productive or effective. It simply serves to cheapen the efficacy of justified criticism when it is in fact needed. What this guy did is without question 'shady' (not to mention illegal) but it doesn't reflect on the leadership as a whole. We have many good, hard working leaders, and many more working behind the scenes to make ours some of the best living in the world. Don't lose sight of that. Just my two cents.

Re:Somewhat off topic...MOD down if you must.

[redelm]

It is the American way to be mistrustful of all governments, even/especially our own. This is common among all parties, although the Dems worry about different govt actions than the Rs. And the Libs and others worry about still different ones.

This is a major latent difference between Americans and the English and much of RoW who accept the legitimacy of government even though they frequently complain about certain implementation details and effects.

Re:Somewhat off topic...MOD down if you must.

[stormguard2099]

Here's the reason, there are so many news articles about government mistakes. When the vast majority that you speak of do their job right, it isn't news worthy because they are doing their job. We don't have news articles proclaming the garbage man sucessfully collected the trash today in the same sense that we don't have articles claiming that X senator didn't receive a bribe. We expect these things. On the other hand, when officials, especially public ones, make mistakes the press covers these things. Since most of us don't live next to public officials, our only source of information is the press in general, therefore giving the general public a sckewed view on how most officials are. As far as justified criticism vs unjustified, I think that's more of a matter of opinion. People hold different standards on what is to be expected but given the bias I mentioned above it's hard to blame the general public for having a negative view in general.

Re:Somewhat off topic...MOD down if you must.

[LifesABeach]

Ironically, this country exists because of mistrust of government. Even more ironic is when one sees the actions of the current administration, it becomes easy to understand why Tigers sometimes eat their young.

Re:Somewhat off topic...MOD down if you must.

[symbolic]

I agree with you - but your assessment unfortunately doesn't apply to most people that aren't in "leadership" positions. You know, the ones we elect from time to time - the ones that are supposed to be directly accountable to their constituency. The ones that seem to perpetuate this pronounced disconnect between what they say, and what they do.

Re:Somewhat off topic...MOD down if you must.

[h4rm0ny]

I think we've lost sight of the fact that the vast majority of people working in the public service sector are hard working neighbors of ours that go to work every day and do their part in an attempt to make society better.

People can be good people and still be ordered to do bad things. Some will resign or risk firing, more will complain and protest, but many will mainly reassure themselves that it's not their responsibility, obey orders and feel bad about the people affected. It takes a lot to stand up and refuse to obey orders for most of us. I was put in that position last year. I kicked up a massive storm with my manager, walked out for the afternoon, came back next day and did the task in a shoddy, semi-sabotaged way. I'm ashamed I didn't refuse point blank. It wasn't a big thing, not something most of the people concerned would care about, but it wasn't something I was comfortable doing and that's what matters here. I resigned some months later when I'd found a different job. I like to think of myself as an independent sort of person but I was still very uncomfortable telling my employers that I wouldn't do what they asked me to.

The people who work in government can be your good, conscientious, hard-working neighbours. But we need to keep the government itself on a choking leash because it is hard for the legs to control the dog sometimes.

Re:Somewhat off topic...MOD down if you must.

[Allicorn]

This is a major latent difference between Americans and the English I don't think "latent" was quite what you meant there.

Nor was "English".

In any case, your point is rather muddy. You describe Americans "worrying about" the actions of their government whilst the Brits "complain about implemention and effects". This would seem to amount to pretty much the same thing; I'm either concerned about what my government does and how it impacts upon me, or I'm not?

In terms of "illegitimacy" Americans have plenty to gripe about due to controversies over the last couple presidential elections, the erosion of personal liberties and unpopular actions in the middle east and a perceived tide of anti-American sentiment throughout much of the rest of the world. And so on and so forth.

Mind you, here in the UK we have a premier who wasn't elected into that role, the highest density of surveillance cameras per head, comparable and equally unpopular actions ongoing in the middle east and a government widely recognized under the moniker "Nanny State", etc.

Re:Somewhat off topic...MOD down if you must.

[redelm]

Actually, I used both latent and English after some thought: Latent because the different attitudes towards government are present but not directly visible.

English because I don't believe the Scots, Welsh nor Manx have the trait to the same extent. At least not more than the French. The N.Irish do and are more like the English.

I may well have been unclear: everybody worries about the actions of their governments. Americans doubt the legitimacy of their own govt. And this is not new with G.Bush but has existed to approximately the same extent since the Revolution. This gave rise to the the checks-and-balances and designed gridlock.

The Commonweath with it's Parlementary system has none such. The PM is an elected dictator. I was utterly astounded at Labour Tony Blair supporting the US in Iraq. And his ability to put down multiple revolts in his own party. Something's seriously wrong ...

I am proud ...

[Anonymous Coward]

... that they overcharged the shit out of this guy. $1100 to run a utility? Score.

Policy

[unenviabletask]

Why is there no policy in the government that means his use of another company to remove data from his system was an automatic breach with serious consequences. I have implemented that policy in my company, namely don't install unapproved software or attempt to change any setting at all without IT approval.

Most new HDDs have intenral "secure wipe" function

[Anonymous Coward]

which can be accessed with Secure Erase, a free disk wiping utility.

Takes a few minutes, and is allegedly more secure than DBAN but still not as secure as physical destruction.

You're welcome.

I broke the cardinal rule...

[stormguard2099]

and actually RTFA. The article's focus is not on how they are paying too much to get rid of their tracks like half of the comments are about. the real issue is that a higher-up called a private business to handle it for him instead of using his own IT department. Yes, they ran a 7-level wipe on it but he claims he wasn't trying to remove data. His reason for the call was a virus, or so he claims. Suspicious? Sure, it's possible that something like that is required by regulations for his department but I would think there would be something against people using private IT businesses for company machinery, especially considering the hefty pricetag (charged as a business expense no less)

He also directed Geeks on Call to erase laptop computers that had been used by his two top political deputies, who had recently left the agency.

Jeff Phelps, who runs Washington's Geeks on Call franchise, declined to talk about specific clients, but said calls placed directly by government officials are unusual. He also said erasing a drive is an unusual virus treatment. "We don't do a seven-level wipe for a virus," he said. Those just puts the icing on the cake as far as suspicious activities in my book.

Re:I broke the cardinal rule...

[Bios_Hakr]

It isn't unusual to wipe hard drives of employees that leave. We do that all the time. This ensures that the "next guy" can't claim the files on his drive came from his predecessor.

Any "work product" should be kept on the servers. Within about a month, if no one asks for "missing report B", we do a thorough wipe and re-image.

This could have been a case of "while you guys are waiting for this wipe, can you look at something else".

Re:I broke the cardinal rule...

[Ffakr]

Your post really glosses over the facts in this case.

Mr. Bloch was appointed to an office charged with providing oversight for the administration. The irony was, Bloch was appointed by George Bush but that position does not serve 'at the pleasure of the President'. The person in that position has a 5 year term and can not be removed except through disciplinary means. Theoretically, Bloch was independent from the WH and above partisan politics.

Bloch was charged with investigating whether or not the Whitehouse violated the Hatch Act by directing non-political employees to work for the reelection of the Republican party. Not surprisingly, President Bush's appointee, Bloch, has made no perceivable progress in his oversight duties even though there has been rafts of evidence that the Whitehouse broke the law.

Doan, in the GSA presented a powerpoint presentation to several groups of non-political staff, that presentation's purpose was specifically about helping Republicans in tough races. At least 20 people in one meeting have testified to hearing the Doan finished the presentation by asking, 'What can we do to help our party in the upcoming election' [paraphrased on my part]. That presentation was put together by Rove's office in the WH.

Bloch is either incompetent [surprise] or another partisan political hack appointed by Bush [surprise].

That is the back story. Here is where we are at now:
- Bloch was under investigation precisely because he wasn't doing his oversight duties. I believe Doan is STILL in office.
- While under investigation he called in an outside private group to 7-way wipe his drive and the drives of others in his office.
- His office (which he RAN) has clear policy stating that no outside IT were allowed to work on their machines.
- Bloch's excuse is beyond pathetic. A Virus? Our government has become so corrupt I sometimes think they say crap just to see if they can get away with it, or rather because it makes them feel powerful to know that they can get away with the most ridiculous claims.

I fear for the future of our nation.

Re:Why not just by a new hard disc

[NinjaTariq]

I have done a similar thing, they are surprisingly resilient. However in the battle between hammer and harddrive, the stamina of the hammer eventually wins out.

My reasons were the hard drive for some reason made my PC unstable, so I took a few months frustrations out on it. After that day my PC worked fine.

Simple answer

[billcopc]

Let's suppose for a moment that whatever was on that hard drive would prove him guilty of all charges; the penalty for that would be severe, like a stiff fine and jail time.

Now let's suppose he did a good job of destroying all the evidence, now he can only be tried for destroying evidence, which is pretty bad, but perhaps not as bad as whatever it is he actually did.

If you were wanted for heinous crimes against humanity (I don't know uhh... biological warfare!), and the only person with any proof winds up dead at your hands, you just need to defend yourself against the murder charge.

Re:Why not just by a new hard disc

[Torvaun]

There are plenty of places out there that do data recovery, and some of them can retrieve quite a lot of data from hard drives that have been through house fires and the like. If your fire doesn't leave the platters in a molten pool of metal, it's not good enough.

Security depends on attack capabilities

[redelm]

Whether a 7 pass or 35 pass wipe is good enough has to depend on exactly how data can be recovered. Does anyone have a good reference on current technological capabilities?

I suspect that even after a single zero pass, the disk has to be mounted in some sort of electron microscope. Maybe it can stay mounted but the heads have to have analog circuitry attached. In either case, the question is over magnetism remaining after overwriting. I suspect that three good [uncracked] pseudorandom passes is more than sufficient. But perhaps not if more than 10% magnetism remains after over-write (which I doubt because the BER would then be beyond ECC).

Re:Security depends on attack capabilities

[boa13]

This paper provides a great explanation of the current state of the data recovery industry. How modern hard drives work, how they fail, how they can be recovered, myths and realities.

[PDF] Recovering Unrecoverable Data

Unless the company has made great advances in the product they advertise at the end of the paper, you can be sure that two passes are more than enough to prevent anyone from recovering your data. Intelligence agencies are more likely to kidnap and torture you than invest the extraordinary time and money to get your bits back.

Re:Security depends on attack capabilities

[Psarchasm]

Sure. The answer, on any drive > 15GB, is 1-Pass.

Stunning eh? I'll challenge anyone to prove that it is possible to recover anything from a modern hard disk that has been overwritten once with anything other than a magnetic microscope. And even that is questionable.

Modern drives are so dense that drive makers have a hard enough time getting data back off of them after its been written.

But you asked for documentation:

NIST Guidelines for Media Sanitization
http://csrc.nist.gov/publications/nistpubs/800-88/NISTSP800-88_rev1.pdf

Storage Networking Discussion
http://storage-networking.org/Discussion/forum_posts.asp?TID=59&PN=1

Guttman's Revised Paper
http://www.cs.auckland.ac.nz/~pgut001/pubs/secure_del.html

Re:What do they mean difficult to recover

[subterfuge]

"Well, in his defense employees should have the right to permanently remove personal data from their work stations such as emails, web surfing history, porn or whatever other private data a person might collect...reasonable level of privacy."

There is no such thing as a reasonable level of privacy for the things you list [regardless of gov/corp status]. An employee has no right to use the employer's equipment/services for personal purposes, that includes "emails, web surfing history, porn or whatever other private data a person might collect" - it should not be on the PC unless it [the PC] is yours.

I field this issue on a regular basis [desktop admin weenie for a smallish health insurance company]. We have the full backing of management to immediately delete any unathorized apps/data ["...yes, I did remotely delete iTunes and all of the music files on this PC, please address your complaints to Corporate Data Security, the Ethics and Compliance department, HR and every manager in my food chain...would you like their cell phione numbers?.."]. Despite the assumption that everyone seems to have that you have privacy at your place of employment you actually have very little [restroom with no camera/mic...thats about it]. The PC,hard disk, network, innerweb connection, email systems, telephone and every bit of airspace on the property are paid for by the employer - you have rights to pretty much none of it as an employee.

Re:Why not just by a new hard disc

[Kadin2048]

I tried that once, too, and won't try it again. Just boring a few holes through it with a drill press is a lot easier. While it's perhaps not quite as destructive as actually scrubbing the platters or shredding them, it does enough for most purposes. It also makes the drive obviously un-usable, which I figure means it's more likely to stay in the trash than one that looks functional.

For the most fun, though, nothing beats shooting them. (I'm a fan of 5.56mm at about 100 yards, since it keeps you well away from any flying debris.)

Re:Why not just by a new hard disc

[dcollins]

Most people don't know what a hard disk is, what one looks like, how to get it out of their case, or what their options are. They call the tech guy and say "trash my data so no one can get it back". And the tech guy does that literally.

I'm pretty sure you can do it...

[$pace6host]

I haven't opened any drive more recent than a 200MB (i.e. >10 yrs old), but all I needed to do that was a torx driver. I've never encountered one built to resist intentional opening (unless you count those stickers!) The platters are a non-magnetic material (aluminum in my experience, though I hear glass is used, too) coated with a thin layer of ferromagnetic material. I'm pretty sure that a few minutes with an orbital sander on this layer would make it "effectively unrecoverable" by even the best data recovery house. It's hard to say what the pattern of magnetic orientations might have been once they're scattered in a completely random pile of dust. You give me 30 minutes, I'll make sure your data can't be read. And, I can get some windchimes and rare earth magnets at the same time! Bonus!

Re:Why not just by a new hard disc

[$pace6host]

Sorry, now that I reread your comment, you weren't saying that one couldn't destroy it, only that tossing it on a fire wouldn't be good enough. Now why didn't that sink in the first time? I think someone's been sanding my brain platters.

He should have used a Mac

[alchemist68]

Mac OS X uses the 7 & 35-pass Gutmann method for securely deleting files. Deleting files is not wrong, that's why we delete them! Incidentally, both President Bill Clinton and George W. Bush use Apple Macintoshes for their personal and profession computers. Probably for this and other reasons.

Seven-level wipe?

[bluefoxlucid]

The DoD standard calls for inverting all bits (i.e. each byte ~0xff), then all 1, then all 0, then verify. In reality, a single overwrite with random data will keep forensics experts from finding the data itself; they can MFM the drive but the hardware takes years and years to run and can't reconstruct the data accurately really (it's statistical, you have either 1.001 or 0.001 after writing, but you've done this so many times you have like 1.037 or 0.049 etc, the numbers go up and down...).

Forensics experts can glaringly tell when you've faked dates on files or wiped files due to the placement of data on the drive by sector itself. They can't get the data, but they can tell you what you did with it. It's like paleontology, but you can only tell that bones were there, and not what kind or shape or size.

Re:Seven-level wipe?

[CodeBuster]

but you can only tell that bones were there, and not what kind or shape or size.

Not if you wipe all the freespace (non-file or empty sectors) as well, which any good secure delete tool (like the open source Eraser) will do for you. Just give it eight (8) pases of pseudorandom and the whole drive is either intact files or psuedorandom background noise. About the only thing that an investigator can tell you then is that a secure deletion tool has been used, not what was deleted or even where it existed on the drive before it was wiped as subsequent secure file deletions merge into the noise that was created by the previous freespace wipe(s). The computer forensics stuff works best against non-skilled or ill informed opponents (i.e Joe Sixpack) but it will do little or nothing to expose a professional who has taken steps to ensure privacy.

Re:Seven-level wipe?

[bluefoxlucid]

As I said, one pass of wipe is more than enough to get good deletion on a used drive. Recovering overwritten data is non-trivial and a multi-billion dollar process taking years to complete. Your 8 passes are excessive, even the DoD spec gives 3 passes for SECRET data.

An investigator can tell you that there was data on the drive at various locations that got freespace wiped. He can tell you subsiquent files were securely deleted at various locations, and in what likely order. The secure deletion scribbles over the filename and messes up the file's data, but tends to leave the file in the same size (which stays in the file system meta-data), and then truncate it to zero, so a really obsessive person can f. Even if it screws with the file atimes and ctimes and other meta-data, the inode is still on disk. The chunks of deleted data are marked out start-for-start still in the inode table, and even a little analysis can sometimes identify different trends in random data (hey when we cross this block barrier the entropy drops a tiny bit and then levels off again...)

COVERUP - My Rejected Submission

[Jeremiah Cornelius]

A U.S. official overseeing a probe of former Bush aide Karl Rove yesterday refused to give federal investigators copies of "personal files" he deleted from his office computer, after it was discovered he hired a private computer-help company to erase all the hard drives belonging to him and two deputies. Special Counsel Scott J. Bloch hired a firm to perform a DoD-wipe, guaranteeing the files could never be restored. Bloch said he suspected his computer was infected by a virus - an unorthodox remedy. The receipt for the work performed makes no mention of a virus. Bloch refuses to turn over other files saved online and claims no documents relevant to any investigation have been purged. "We don't do a seven-level wipe for a virus," said a manager of Geeks on Call - the firm that was hired.

Couldn't do it himself... but many can.

[binaryspiral]

Laptops are rarely backed up. Even if they are its typically only what the user wants to backup. Archiving files at the server level (email, web, and ftp proxies) would be the better choice.

And why didn't this guy just do a simple google search and use a DBAN boot disk? Moron had to call for help...

Speaking on behalf of this guy...

[GoofyBoy]

... $1100 for a tech guy or at least ten times that amount for a lawyer explaining what was on the hard-drive. Score.

Backups?

[PPH]

Unless this is one of those ancient 20th Century operations, its quite possible that periodic backups have been performed on all systems data.

Oh, wait. This is a gov't operation. Never mind.

Re:Why not just by a new hard disc

[jacquesm]

hey, it's only *nearly* impossible, that means it is certainly possible.

Re:Why not just by a new hard disc

[Gordonjcp]

Or just fill it with data and delete a few times. Once you're certain that every sector has been overwritten, you're clear.

No, you cannot read data back once it's been overwritten. Not even if you're the NSA. Not with modern drives, anyway, modern being "any drive made in the last ten years".

Shame on Geek Squad, too

[jhRisk]

Besides the shadiness which I completely agree is there I'm disappointed with Geek Squad. Granted coming in and quickly wiping systems regardless of the issue is what I've heard is their approach (not passing judgement either since the model works for general consumers) but didn't anybody from the tech to dispatch question whether they should be doing this? During my time consulting I certainly scrutinized all aspects of the tasks assigned to me since blindly following instructions in technology can lead to so many problems. Wonder what their liability, if any, is here as well since they should have known better than to wipe such a system.

Nearly impossible????

[gweihir]

This is nonsense. There is very good indication that a single overwrite with zeros on modern drives makes recovery completely impossible. And don't cite Gutman at me, read his addendums first. He agrees.

A seven times overwrite of a modern disk with some random passes in between cannot be recoverd from by any means in this universe, that has to read the data from disk. The disk cannot hold 7 times as many data. It is not a question of reading equipment, but a coating material limitations. Magnetic microscopy, or the like, cannot read what is not there.

Three little words

[Corgha]

And what to do with the old one? Throw away and let some scavenger hunter find the data? I think what we really need to ask is: Will It Blend?

(Sadly, that's just a video of an iPhone -- couldn't find one of a hard drive.)

"Overwriting Everything" is surprisingly hard

[billstewart]

It's usually pretty easy to overwrite most of the data on a disk. But the operating system, disk controller, and various drivers make it hard to get absolutely everything, so depending on what you're trying to hide, you may not want to risk that.

• Bad Block Remapping - Once a block goes bad enough to not be reliably writeable, or reliably readable, it'll get mapped out and replaced by another block, and after that, nothing's going to erase it. Normal tools aren't going to be able to access it, but forensics tools usually can.
• Host Protected Area - HPA is a really annoying feature introduced in ATA-4 in 2001 which lets the disk driver hide data from the normal operating system tools and requires special BIOS tricks to access. It seems to have a couple of common uses - OEM-provided recovery operating systems, and making disk drives appear smaller than they actually are (for instance to let you use s 160-GB drive on a computer that doesn't know about drives >128GiB. There are some rootkits that use HPA to hide themselves. I'm currently annoyed at Maxtor because some of their external-USB-disk enclosures use HPA to map large non-OEM drives down to 128GiB, including the 500GB drive I bought to replace a failing 200GB drive, and not only do Maxtor and Seagate's tools not seem to be able to fix the drive, neither do the Linux tools I was able to find....
  

So if you want to overwrite everything on a disk, you may need to talk to the disk controller at a lower-than-usual level rather than using your regular OS tools, and there still may be blocks that the controller can't successfully overwrite.

Re:"Overwriting Everything" is surprisingly hard

[Gordonjcp]

Ok, so you've got a mapped-out bad block. Really really clever software, possibly including replacing the firmware in the drive, will then be able to read 512 bytes of data, assuming it can be read from the bad block at all. You know, on account of it being bad, and all...

These days, drives don't use simple "on/off" transitions to mark data. It's a gross oversimplification to say it's an analogue signal that gets recorded to the disk, but that's essentially what it is. The idea of detecting vague afterimages of the last bit doesn't work when you're using quadrature.

To be fair, the NSA could probably recover overwritten data from the 25-year-old DEC RL02 packs I have sitting about.

Plausible Deniability

[Greyfox]

He should have wiped it first, THEN chucked it in the microwave for a couple of minutes, THEN reported to his boss that a power surge has destroyed his hard drive. You may also need to take a stun gun to the rest of the machine for that to hold up...

Two words that fuck up your plan.

[Chas]

Government
Official

Most of the mouth-breathers who work for the government (especially the fogeys in the upper echelons) count themselves lucky if they know how to breath and spread bullshit at the same time.

Computers? That's like, magic or something...

In short, can you smell the Lud?

Dban also doesn't work

[flyingfsck]

This does work: http://cmrr.ucsd.edu/people/Hughes/SecureErase.shtml

Not at all.

[b1scuit]

Improper could simply be a deviation of SOP, perhaps even due to a suspicion of the integrity of the IT dept. (GASP) It's unlikely, but it's still /possible/ and any investigator worth his salt would want to determine just how foul the play was before proceeding. The question here isn't whether the incident was inappropriate, it was. It's a question of motive, of degree.

And in the case of a murder, yes, that's exactly right, it would be prudent to determine the method and motivation behind it before moving forward with some kind of punishment. You are aware that both crimes (fraud and murder) prompt different penalties depending on the degree of the infraction according to US law? Not saying I agree with it, but that degree has to be ascertained before punishment can go forward.

Happens all the time

[cerberusss]

Bypassing his agency's computer technicians, Mr. Bloch phoned for

Regardless of whether there was ill intent, I'd just wanted to mention this bypassing happens all the time. I knew a business manager once who said that when wishing for a simple application, he would run into their internal department who were used to big projects. So instead of starting building (or even analyzing) with said app, they'd respond with giving him forms for access to new servers, allocating helpdesk people, assigning a project manager, et cetera.

When all he needed was a speedy and communicative developer. Yes sometimes the big mill has to start churning. And at other times, we just need a little app for a limited time.

Good Night

[stupidpuppy]

How many Bush operatives are going to get nailed for deleting files?

If there's a legal requirement to keep something I read or write at work, I kind of just assume that deleting data will not eradicate it. You know -- if it's a felony to delete my email, I would just assume that IT would have that covered and be saving all of my email, instead of requiring me to archive it on my own computer (which isn't backed up).

This is one of the reasons they are going after Rove. He read some email and then deleted it. Add in IT idiots and all of the sudden it's a coverup -- turns out there was no archive other than his inbox.

Nothing weird here

[JeffTL]

For me, standard decommissioning procedure for any computer is the 7-pass option on the Mac OS X Disk Utility if it's an Apple, or Derek's Boot and Nuke if it's not. Not sure how DBAN would come up in routine maintenance, but in a secure government situation I could imagine a standard procedure of scrambling the drive whenever it needs a format, just in case you wind up replacing the disk instead.

Re:Exactly as I suspected -- almost

[bcnstony]

While I agree with you that a few random passes will completely delete everything it touches, there is one tiny exception. As far as I remember, hard drives are built to be slightly larger than their advertised size, with firmware that recognizes and simply avoids bad sectors (given the size of modern hard drives, a bad sector or two is nothing). Occasionally, the HD Firmware will recognize an area going bad during daily use of the HD, copy the data to a good sector, and simply avoid the bad sector from then on, mapping it right out.

Performing a few random passes (or 35, for that matter) will never touch data in sectors that went bad during the use of the hard drive. The chance of that data being important and being recoverable is far less likely than you being struck by lighting twice (yes, I pulled that statistic out of my ass), so no one worries about it. But this is slashdot, so I felt a need to add to the conversation.

--
whereisstony.blogspot.com