The Great Zero Challenge Remains Unaccepted

An anonymous reader writes "Not even data recovery companies will accept The Great Zero Challenge and only four months remain! We've all heard how easily data can be recovered from hard drives. We're told to make multiple overwrites with random data, to degauss drives and even physically destroy them just to be extra safe. Let's get the word out. The challenge is almost over! It's put up or shut up time. Can you recover the data?"

Comments

Do many companies really do EFM recovery?

[DigitAl56K]

Based on nothing more than personal suspicion, I think many professional recovery firms may be in the business of simply running expensive tools that scan through the partition and file table area and perhaps even the entire disk to locate data that has either been marked erased or had references removed (for a full disk scan) and then restoring it. Perhaps they'll also move the spindle from a dead drive into a new case to complete the operation, but I doubt there are many companies that will actually do electron force microscopy for you and even fewer that will do it at anything other than an astronomical fee. Powerful recovery tools can be purchased for a few hundred dollars now anyway. My opinion is that the recovery business is a focus around confidence that a professional will be doing the recovery and that you or your employees won't worsen the situation. In the event that a drive with critical data fails and you don't have a backup, who wants to be the person responsible for damaging the disk during recovery?

Anyway, IMHO this whole debate should be moot by now. If you want to secure your drive use full disk encryption (now freely available in TrueCrypt) and when it comes to destroying the data just overwrite the header area a thousand times with random garbage. It will take only a second or two, and the whole drive will be useless to anyone.

Of course it would also be nice if more manufacturers were producing encrypted disks as standard with verified schemes (there have been some lemons purporting to be secure that really aren't) so that we wouldn't have to do encryption in software.

Re:Do many companies really do EFM recovery?

[anagama]

Although the drive has to be in a living system and not on the shelf, it's worth noting the cold boot attack: http://citp.princeton.edu/memory/

Q. What encryption software is vulnerable to these attacks?

A. We have demonstrated practical attacks against several popular disk encryption systems: BitLocker (a feature of Windows Vista), FileVault (a feature of Mac OS X), dm-crypt (a feature of Linux), and TrueCrypt (a third-party application for Windows, Linux, and Mac OS X). Since these problems result from common design limitations of these systems rather than specific bugs, most similar disk encryption applications, including many running on servers, are probably also vulnerable.

Re:Do many companies really do EFM recovery?

[Justus]

If you want to secure your drive use full disk encryption (now freely available in TrueCrypt) and when it comes to destroying the data just overwrite the header area a thousand times with random garbage. It will take only a second or two, and the whole drive will be useless to anyone.

Except, of course, that the point of the challenge is that instead of encrypting and whatnot (which can be a good idea for other reasons, but I digress), you could just overwrite the drive with 0's once and dispose of the drive safely. This is most likely substantially faster than what many people propose, like overwriting many times or physically destroying the disk.

However, I think their methodology is pretty flawed. The reward for completing the challenge is $40 and the drive itself (which is worth $40-60). You also have to pay shipping, which will run maybe $10-15. I know that it's really not worth it for me to spend any time trying to recover the data from the drive—probably a fairly lengthy process—just for $85.

Re:Do many companies really do EFM recovery?

[DigitAl56K]

Although the drive has to be in a living system and not on the shelf, it's worth noting the cold boot attack

Not in this context because we're talking about how intentionally wipe the data from a drive, e.g. when you want to erase the data and dispose of the disk. The cold boot attack, although interesting, has nothing to do with recovering data from a drive after someone has attempted to destroy it, unless your implication is that someone would try to overwrite the header a split second before someone like the FBI breaks the door down. Even then, simply unmounting the volume will wipe the key from memory. If you have time to attempt an erasure you have time to unmount the disk. If you are in a situation where you have enough time to write zeros all over the drive, as in this challenge, you are certainly not at risk from the cold boot attack.

Re:Do many companies really do EFM recovery?

[anagama]

As I said: "the drive must be in a living system". I figured people would think of a "living system" as one in which the drive is installed and the computer running. I suppose I was wrong.

I think what is most interesting about the cold boot attack is how a system that was thought to be extremely secure, can fall to really smart people. Some really smart person/group in the future may figure out how to recover the old data on a drive despite zeroing or encrypting. Unless the drive is actually destroyed, there is always a chance, no matter how small, that the data will be recovered. Pirates had it right: dead men tell no tales.

Re:Do many companies really do EFM recovery?

[mikael]

I had an old drive which failed - one of those laptop Travelstar's that were known as 'deathstars' for the number of times they had died from overheating. Data recovery companies gave me a quote for anywhere between 300 pounds and 800 pounds, depending upon whether they would have to remove the spindle/platters from the drive and place them into a new one.

Fortunately, I managed to recover all the data from this drive for free, by putting it in external USB enclosure, place this in a freezer to cool it down, then give the enclosure a quick twist once the enclosure was plugged into an USB port. That was enough to recover the data.

You can recover the partition data of a drive erased using 'fdisk' by running the 'testdisk' utility.
(written by Christophe Grenier of http://www.cgsecurity.org/">CG Security

Re:Do many companies really do EFM recovery?

[BPPG]

... when it comes to destroying the data just overwrite the header area a thousand times with random garbage. It will take only a second or two, and the whole drive will be useless to anyone.

but that's the point they're trying to make; that's a myth and it's not necessary.

We're talking tin-foil hat, big brother paranoid level security here though. Your mom's not going to find the porn you deleted on your hard drive that was written over with random garbage, or had the headers deleted. But a super cyber-ninja might (not will, but might) be able to find a particular private key that you left on that same hard drive. And overwriting with garbage is really overkill, zeroes are all that's necessary.

Everything that 'might' happen is a security risk. If you think I'm being an alarmist, then stop thinking about security. It's necessary to talk in such absolutes. Using a random garbage writer is, well, random. With random, there's almost no chance of it happening. On the other hand, using straight zeroes, it's not possible to recover data from a disk full of zeroes at all. No multiple obsessive compulsive garbage writing necessary. Simple, elegant, and true.

That's the point of this challenge; it's because they don't think it's possible and all the smart people already know it's not possible. This is just to dispel the myths. Data destruction can be trivially achieved with just dd and /dev/null.

Re:Do many companies really do EFM recovery?

[Rich0]

Moreover, if I were concerned about people with the resources to detect residual data on a zereoed hard drive, I certainly wouldn't trust cryptography. If the crypto system is ever defeated chances are whoever has your drive could recover almost everything on it even without resorting to scanning/tunneling electron microscopes and all that.

Multiple writes with random data is the only way to be REALLY sure. If you don't anticipate government-scale attackers then a simple zeroing is sufficient - and /dev/zero is a whole lot faster than /dev/urandom on most systems.

Re:Do many companies really do EFM recovery?

[arth1]

The conditions are also made to trick ignorant journalists. Anyone knowing a bit about file systems know that being able to restore some data from a drive is a heck of a lot easier than being able to restore file names, which they demand. Not only do you have to be able to restore the sectors that contain the file name metadata, but you need knowledge of the file system in question, and how exactly it stores its file names. If it's stored in byte swabbed format, you won't even recognize it as a file name.
Try to do a dd to a file of a working partition and then extract the file names from it. Unless it's a DOS partition or other ancient format, it's not easy, and that's with no zeroing.

Yes, the "contest" is a farce, and any company that enters into it will lose credibility just by entering.

Re:Do many companies really do EFM recovery?

[Anonymous Coward]

Exactly, and even more so. The software recovery tools fail against the zero right. They only work against format and standard delete, since the drive is not completely zero written. After that, you must 'damage' the drive to get at the data... most people will not go after that level of recovery unless the data is highly valuable. That kind of recovery is also very expensive to do. $40 does not even begin to cover the cost. Instead, if they really are serious about this challenge. They should take it in and pay the big fee to see if they can and allow the drive to be damaged.

Re:Do many companies really do EFM recovery?

[fbjon]

The cold boot attack is possible if the FBI cuts the power before breaking down the door, then you won't be able to overwrite the memory. Unless you have a UPS, in which case you could have it auto-unmount all encrypted drives after a few seconds warning.

Re:Do many companies really do EFM recovery?

[Anonymous Coward]

Is anyone really going to blow their load over 4o bucks? If the organization is able to EMF, they don't need some cheap advertisement. I'm sure they already have a decent business going. Why would 40 clams induce anyone to enter a useless contest?

Re:Do many companies really do EFM recovery?

[cduffy]

Everything that 'might' happen is a security risk. If you think I'm being an alarmist, then stop thinking about security. It's necessary to talk in such absolutes. Using a random garbage writer is, well, random. With random, there's almost no chance of it happening. On the other hand, using straight zeroes, it's not possible to recover data from a disk full of zeroes at all. No multiple obsessive compulsive garbage writing necessary. Simple, elegant, and true.

You're absolutely right that we're talking big brother paranoid level security -- but if you write straight zeros, and writing a zero makes 1->0.05 and 0->0, it may be possible to tell the two states apart. As binary as the data may be, it's still getting written to a physical medium -- and the Real World lives in analogs. Even were this true, however, writing multiple passes of garbage would prevent an entity able to distinguish 0.00 and 0.01 from being able to determine the media's prior state -- and that's the whole point of this operation. Claiming that writing multiple passes of random garbage (or, better, patterns selected to-purpose -- see the Gutmann method) is somehow worse security than a single pass of zeros is complete bunk; the likely case is that it simply doesn't buy anything worthwhile at all, at a cost of time and electricity.

That said -- absolutely, this isn't a likely attack; if there were a cheap way to make equipment which could read data with that level of precision off of magnetic platters, we'd be using it to make higher-density magnetic platters... and tolerances for how the data is written to those platters is much, much lower today than it was twenty years ago. (Against a twenty-year-old hard drive, I'd expect the chances of someone with a STM and a lot of time to actually be quite good).

Re:Do many companies really do EFM recovery?

[Nursie]

I think what this event (or lack of) will end up proving is that recovery using anything other than standard (i.e. plug in, read and analyse raw data) recovery techniques is something that's both expensive and rare.

You're probably ok with a single overwrite, unless you get fingered for something really really big.

Re:Do many companies really do EFM recovery?

[Awptimus Prime]

I often had to use a small ball-peen hammer to get seized up Quantum drives to spin back up one last time to get data off them.

Let them cool down, apply power and gently tap on them from different angles and usually the bearings would work again, at least for a while.

It's always satisfying to fix a computer problem with a hammer, even though you are being very careful.

Re:Do many companies really do EFM recovery?

[Dare nMc]

That's the point of this challenge; it's because they don't think it's possible and all the smart people already know it's not possible. This is just to dispel the myths. Data destruction can be trivially achieved with just dd and /dev/null.

if thats the point of the challenge they cannot be successful. Since in theory it is possible, however it would currently require destroying the drive. If the goal was impossible and all know it, then the challenge would be big $$$ and plenty of analysis time, and resulting state of the drive wouldn't matter. This challenge only proves that your data, if it's of limited value, is currently hidden sufficiently easily. For example, if your the Catholic church and you were to discover proof your religion is false, simply doing a dd to destroy that data, then storing would be insufficient protection. Because it is theoretically possible to recover dd erased data. Which means within 20 years it may be trivial to recover that data with off the shelf technology. At that point the entire Vatican would be at risk of destruction (although proof probably would never destroy a religion.)

Re:Do many companies really do EFM recovery?

[Tassach]

Data destruction can be trivially achieved with just dd and /dev/null

You ALMOST got it. Data destruction can be trivially achieved AGAINST TRIVIAL ATTACKS with just dd and /dev/zero. There are quite a few published papers on how to recover data from a zeroed hard drive -- attacks that are a LOT more sophisticated than plugging the drive in to a working system and running a piece of software. These attacks aren't easy and do require special equipment and actual knowledge of ELECTRONICS ENGINEERING, not just general computer geekery.

As a side point, it's /dev/zero, not /dev/null. cat /dev/zero (or /dev/random) spews forth a never-ending stream of bytes. cat /dev/null returns zero bytes.

Re:Do many companies really do EFM recovery?

[guidojones]

I think they are way off base. The question isn't really can you recover the data leaving the drive intact. I think most would agree that you can't. You would need to get into the inner workings of the drive ... a much more expensive process. Very labor intensive and not something that they are going to do for $40. Possibly if the purse was 10K or greater, and once received the drive could be destroyed in the process. Anyone that has sent out "dead" drives for recovery knows that when they are returned they will in most cases have been disassembled. This is just a lame attempt to give the appearance that the data can not be recovered.

Re:Do many companies really do EFM recovery?

[KDR_11k]

Overwrite with random data encrypted using the same system you used for your regular data to add noise? It's probably harder to recover a drive when one or two missing bytes can already break the whole data and encryption is probably the best way to ensure that.

Re:Do many companies really do EFM recovery?

[kdemetter]

that chance is really rather slim. By the time they have taken out the memory and analyze it , the data will likely be gone.

Even so , it only works if your truecrypt volume was mounted at that moment. I don't auto mount it.

But that UPS gave me an idea though.Maybe it can be coupled to an auto forced dismount when the power is cut off.

Re:Do many companies really do EFM recovery?

[LaskoVortex]

but you need knowledge of the file system in question, and how exactly it stores its file names.

Its good you brought this up, because the poster went back in time and included it in TFA. Its people like you keeping these guys honest:

We did a default initialization and NTFS format from within Windows XP.

Re:Do many companies really do EFM recovery?

[Jah-Wren Ryel]

It's always satisfying to fix a computer problem with a hammer, even though you are being very careful.

It's called percussive maintenance.

Re:Do many companies really do EFM recovery?

[Kent Recal]

I can just picture it: The FBI kicks down your door at 3:40am, male voices scream "F-B-I", guns clicking, laser-sight dots hushing over the walls, someone jumps through your bedroom window, kicks you out of bed knocks you onto the floor, jams his knee into your neck... Then a nutty professor with fat glasses in a white coat runs onto the scene and screams "FREEZE!!!" as he sprays ice onto your RAM modules...

C'mon kids, won't happen. You've been to the movies too much. In the real world they just send you a letter. And you pay and/or get to clean some public spaces. And mommy will lock away the computer. That's it.

Re:Do many companies really do EFM recovery?

[arth1]

That doesn't explain exactly how it stores the file names. The onus is on the one doing the recovery to find that out, which is unreasonable.
If you manage to recover a few thousand humanly readable words, how are you to know which ones of those are file names, which ones are part of other metadata, and which ones are data, without being an expert in the file system in question?

(Also note that different version of NTFS may behave differently -- the position of the metadata on the disc, for example, has changed.)

Re:Do many companies really do EFM recovery?

[mrjb]

Anyone knowing a bit about file systems know that being able to restore some data from a drive is a heck of a lot easier than being able to restore file names

Bingo. I've recovered bunches of JPG files for someone, from an accidentally quickformatted hard drive, just by knowing which file format he was after. No, I didn't manage to figure out the original filenames. But he *did* get his photos back.

Occasionally, I also recover audio from drives in Alesis' proprietary HD24 FST format.

In my experience, pro recovery companies have *no clue* how to deal with that FS but will happily charge customers a bucketload for 'analysis'. Alesis typically recommends me for data recovery. So I guess I don't qualify as King of Recovery.

Re:Do many companies really do EFM recovery?

[oliderid]

that chance is really rather slim. By the time they have taken out the memory and analyze it , the data will likely be gone. Even so , it only works if your truecrypt volume was mounted at that moment. I don't auto mount it. But that UPS gave me an idea though.Maybe it can be coupled to an auto forced dismount when the power is cut off.

Geeks and their porn files...We always wonder how to hide them :-)

Re:Do many companies really do EFM recovery?

[permaculture]

Yes, lets get down to the anecdotes. A drive at my outfit was reimaged using Symantec Ghost. Despite the fact that Ghost doesn't rewrite every sector on a drive, I figured the data was gone.

The HOD sent the drive to a recovery firm, that charged 200 pounds without any guarantees. They weren't able to recover anything. The data was eventually pieced back together from printouts and old copies.

The user learnt that "Is your data backed up?" didn't mean "Have you saved your data from the screen onto the drive (that we're about to reimage.)" And a policy was instituted where we'd make the user sign a form before we'd reimage their drive.

Re:Do many companies really do EFM recovery?

[hobbit]

Why would you ever consider giving your business to a data recovery company that wasn't "an expert in the file system in question"?

Re:Do many companies really do EFM recovery?

[hobbit]

Why multiple passes of garbage, rather than just one? (Assuming, of course, that your garbage is actually a cryptographically strong source of entropy, for why would it be otherwise?)

Re:Do many companies really do EFM recovery?

[ekstrom]

About a decade ago I went with cash in hand to several data recovery companies and asked them to recover some wiped files on a working disk. Distructive techniques were allowed, and the budget would have paid for some elaborate processes. Several first-level telephone answering folks said "sure, we can do it", but when I told the same story to the next level no one was willing to try. There is, of course, that old report claiming that there is enough information physically present in a multiply erased bit position to permit recovery. Maybe the intelligence agencies can do it, but I have heard of no verified case where they - or anyone else - actually did.

Re:Do many companies really do EFM recovery?

[cduffy]

Why multiple passes of garbage, rather than just one?

Consider:

0->0 => 0.00
1->0 => 0.05
0->1 => 0.95
1->1 => 1.00
(this is admittedly oversimplified, as the initial state is never really a binary 1 or 0, but rather the result of all prior writes -- but the example here is that each write moves you 95% of the way from your present state to your desired target state).

If you have the sensitivity to distinguish between these four cases, the old data is distinguishable regardless of what the new data is. That's why multiple passes are needed.

That said, I'd urge you to read Gutmann's papers to appreciate any nuances I haven't made clear (ie. why multiple passes of "random" [or, preferably, built-to-purpose] data is superior to multiple passes of zeros). Again, I am not asserting that Gutmann's assumptions are correct with modern hardware -- something I personally doubt -- but I do assert that if they were correct, multiple passes would clearly be needed.

Re:Do many companies really do EFM recovery?

[Fross]

Then why doesn't someone use the information in those papers to do just that and win this challenge?

Re:Do many companies really do EFM recovery?

[Deagol]

Got cites?

I know of the original Gutmann paper, his follow-up debunking the "magical" 35-pass requirement, and then there was a dude who tried (unsuccessfully) to track Gutmann's original source material to see if any *real* data recovery had actually been done. This topic really interests me, and I've yet to find *any* evidence that data simply overwritten with zeros has *ever* been recovered (even partially) from modern hardware that even Gutmann himself feels is pretty immune to such techniques, given the density.

As illustrated in the old humorous "Physics Warning Lables" piece:

Advisory: There is an Extremely Small but Nonzero Chance That, Through a Process Known as 'Tunneling,' This Product May Spontaneously Disappear from Its Present Location and Reappear at Any Random Place in the Universe, Including Your Neighbors Domicile. The Manufacturer Will Not Be Responsible for Any Damages or Inconvenience That May Result."

Likewise, it's *theoretically* possible that such low-level magnetic scanning voodoo could recover overwritten data, but real-world evidence thus far has been nil. As others have pointed out, if such equipment sensitivity were feasible, then that technology would have been used to increase HD data density. In addition, if such techniques were truly feasible, any company that could do it would have enormous fame and financial success.

It's a shame that this particular "challenge" was so piss-poorly implemented. Maybe James Randi should put up some cash for such data recovery, as it pretty much can be filed under the "paranormal" category. :)

Re:Do many companies really do EFM recovery?

[cduffy]

Then why doesn't someone use the information in those papers to do just that and win this challenge?

Because it's not worth their time, and they can't justify it to the employer or institution that owns the equipment they'd need to use?

(Not, again, that I'm asserting that this is necessarily winnable with modern hard drives... but the argument that this "challenge" proves anything either way is ridiculous).

Re:Do many companies really do EFM recovery?

[arth1]

Because I wanted the raw data, not necessarily the files or other metadata.

Re:Do many companies really do EFM recovery?

[MrOion]

You summed this up nicely. There is one more thing to add about using electron force microscopy: It takes a huge amount of time. And it is not as accurate as most people seems to think since it is based on the disks inaccuracy on where the bits are written.

How you delete your drive data depends a lot on what level of security you need. One overwrite is enough for most people. Degaussing and/or physical destruction is only needed as a prevention against theoretical recovery techniques.

Re:Do many companies really do EFM recovery?

[xanadu-xtroot.com]

just overwrite the header area a thousand times with random garbage.

How does one do that? (Seriously I'm asking the question) Is it sored in a predictable place where you can

dd if=/dev/zero of=[this header]

?

Re:Do many companies really do EFM recovery?

[squidinkcalligraphy]

I'd be guessing the [insert favourite law enforcement agency TLA here] would be able to recover (at least some of) the data. The thing is, it is _good_ for them to think that overwriting with zeros kills the data without possibility of recovery. Just makes their job of recovering it easier than if overwritten multiple times with random data.

Re:Do many companies really do EFM recovery?

[NormalVisual]

Yup. I remember when I worked at Disney that percussive maintenance was often used when the contactors on a monorail would get fused. A tech would come out with a big 'ol nonconductive mallet, pop the lower skirts open, and bang on the contactors until the the tiny little weld cracked open. Close it up, power everything back up, and the train was good to go.

Re:Do many companies really do EFM recovery?

[hobbit]

Fine, if you want to piece that data back together yourself. Myself, I would prefer to employ someone who would do it for me...

Re:Do many companies really do EFM recovery?

[Anonymous Coward]

A tech would come out with a big 'ol nonconductive mallet, pop the lower skirts open, and bang on the contactors

Wow, Disney must have a really strong union if the employees can get away with banging on the contractors with a hammer!

Re:Do many companies really do EFM recovery?

[ion.simon.c]

As I said: "the drive must be in a living system". I figured people would think of a "living system" as one in which the drive is installed and the computer running. I suppose I was wrong.

Yeah.
It helps *everyone* if you fight the encroachment of language muddling "manager-speak". Please try to speak clearly and plainly when you communicate for the purpose of information transfer.

Re:Do many companies really do EFM recovery?

[ion.simon.c]

I think that the ntfs3g folks have a pretty good handle on how the filenames would be stored.

Re:Do many companies really do EFM recovery?

[ion.simon.c]

Why not?

Can you convince me that

dd if=/dev/zero of=/dev/hda

is significantly faster than

dd if=/dev/urandom of=/dev/hda

?

Re:Do many companies really do EFM recovery?

[ion.simon.c]

Ah. Spoke too soon.

Well, multiple passes of garbage for two reasons:
1) /dev/random is too slow, so we use /dev/urandom. /dev/urandom is (probably?) less random than /dev/random.
2) The theory goes that the more noise you write over the existing data, the weaker the "signal" from the existing data becomes. Make sense?

Re:Do many companies really do EFM recovery?

[TapeCutter]

"Not in this context..."

The "context" was the suggestion of encryption in the post he was replying to. Encryption is mildly offtopic but his post was certainly not out of context.

Re:Do many companies really do EFM recovery?

[Anonymous Coward]

but I doubt there are many companies that will actually do electron force microscopy for you and even fewer that will do it at anything other than an astronomical fee.

More to the point, what would be the benefit to the recoverer? Other than bragging rights / advertising value, it would be quite an expensive proposition.

Other than the commercial operators, the ones who have the money to throw at this (NSA-types, etc.) want you to believe they can do this, but they don't want you to know that they can, as long as you believe.

Just like crypto, concealing their true capability is far more important than demonstrating it. Prove to the world that ypu can break Truecrypt and everyone will go elsewhere. It's just another example of "fail to confirm or deny", in order to keep the FUD level as high as possible.

Re:Do many companies really do EFM recovery?

[Firehed]

Is it honestly relevant? The task is to determine whether a dd'd (...) drive can have its previous contents determined. Obviously the rules regarding how this can be done are somewhat problematic, but let's assume that all bets are off for recovery methods.

Find some guy with a couple grand sitting around. Put some crap on a hard drive. Wipe said drive with dd in the manner described in TFA. Send the drive to a recovery as any normal human with money would do. If they can recover it, dd isn't secure enough. If they can't, try a couple other places and if none of them can, it's probably secure enough. No special conditions, no 'security king' title, just a test that the recovery team doesn't know it's taking.

Re:Do many companies really do EFM recovery?

[Taxman415a]

Well this article is a response to Gutmann's Usenix paper where apparently everyone got the idea that STM could be used in a cleanroom to get data off a drive that has been overwritten. The response is written by someone at the National Bureau of Economic Research so who knows what qualifies them to write about this, but if you read it he does seem to have done his homework. He claims that Gutmann's paper isn't true and it's evidence doesn't pan out. I'm not really qualified to tell and I'm not sure how much drive technology which you mention changes the issue from 1996 when Gutmann wrote his paper.

In any case this Bureau of economic research guy claims no one can do EFM recovery so that's his opinion on the title question above. And you and the GP post both make good points that this is certainly extreme paranoid level even if someone could do that type of recovery. You'd have to have some awfully important data to protect. So even though the contest is indeed a farce as others have pointed out, they do make a good point that dd'ing zeros is good enough for anything but extremely important data.

Re:Do many companies really do EFM recovery?

[dlgeek]

Sure.
$ time dd bs=1024K count=100 if=/dev/zero of=foo.bin
100+0 records in
100+0 records out
104857600 bytes (105 MB) copied, 0.656254 s, 160 MB/s

real 0m0.673s
user 0m0.000s
sys 0m0.440s
$ time dd bs=1024K count=100 if=/dev/urandom of=foo.bin
100+0 records in
100+0 records out
104857600 bytes (105 MB) copied, 31.9296 s, 3.3 MB/s

real 0m31.989s
user 0m0.004s
sys 0m29.458s
$

Try it yourself if you don't believe me... random generation, even pseudo, non-secure random is much more computationally expensive than generating zeros.

Re:Do many companies really do EFM recovery?

[Tassach]

Because the offered reward is not worth the effort. The guy's a nobody, and the price is a joke. If it were a major university or an individual of some note in the information security community who were sponsoring a contest, then it might be worthwhile. Some nobody with an obscure blog? Give me a break. Even if I still had access to a fully-equipped electronics lab, I've got better things to do with my time and $60.

Re:Do many companies really do EFM recovery?

[Tassach]

Cites? You can Google as easily as I can.

Of course, that only covers unclassified research. The NSA has a high interest in this sort of thing. If it can be done, they can do it, as can any other major country's intelligence service.

The point remains that NSA and DOD guidelines for the destruction of magnetic media that has held classified data are pretty clear, and should only be disregarded at your own peril if you have super-sensitive information. If they give you a warning like that, they're as good as telling you "We can do this, and so can the opposition".

Nobody though Von Eck phreaking was as easy as it is until the NSA declassified some of their data on the subject. Nobody thought that you could build a dedicated DES cracker that was as cheap and effective as the EFF's Deep Crack box until they did it.

That said, I'm not so worried about the NSA or DOD (or the KGB, or Massad, or whomever). Considering that most of us are not involved in international espionage, that's not a threat we have to worry about.

Now if the FBI convicted someone based on data recovered from a zeroed hard drive, that might be cause for worry in some circles. If someone released a software tool that could do it, or a commercial service offered that capability, that's a real threat for most businesses and individuals.

Re:Do many companies really do EFM recovery?

[eonlabs]

I hear this and I have to wonder, what if someone wiped the headers as you mention, and then boot something like matlab up. I imagine a heavy program like that would immediately make data resident in 2GB of memory moot.

I also don't see why they don't open the challenge up to individuals who are published in the field of data recovery. If it costs over $500 bucks to recover the data, there will be no commercial takers, but opening to the research community might turn the tables on this a bit. The competition starts looking more like grant money...

Re:Do many companies really do EFM recovery?

[flyingfsck]

If a disk drive was encrypted, then you DON'T have to overwrite it. That is the whole idea with proper encryption. All you need to do is hit yourself upside the head with a brick so you forget the password...

Re:Do many companies really do EFM recovery?

[Anti-Trend]

That's the point of this challenge; it's because they don't think it's possible and all the smart people already know it's not possible. This is just to dispel the myths. Data destruction can be trivially achieved with just dd and /dev/null.

... I think you meant /dev/zero, but I'm not intending to nitpick here. :) That said, I agree. The recovery of zero'd out data is pretty damn difficult at best, especially if you have no idea what you're looking for in the first place. A zero wipe is probably enough for just about everybody.

Besides, a paranoid multiple nuke scenario where you're overwriting random garbage over a hard drive for days at a time will wear it out and make it much less useful. If you're going to destroy it, might as well crush and incinerate it; much more secure than hashing anyway.

Re:Do many companies really do EFM recovery?

[jarfil]

Then there is that rival company asshole, who pays a thug to steal your laptop so he can spray some ice on your RAM modules and run some silly memory-dump boot app from CD (did you remember to disable booting from CD in your BIOS?) so he can get to all the company data you stored on your laptop.

No kidding, that's as easy as pie.

Re:Do many companies really do EFM recovery?

[MR LOLALOT]

Kernel memory pages are usually not swappable. They will stay on physical memory.

Re:Do many companies really do EFM recovery?

[Hal_Porter]

The cold boot attack is possible if the FBI cuts the power before breaking down the door, then you won't be able to overwrite the memory. Unless you have a UPS, in which case you could have it auto-unmount all encrypted drives after a few seconds warning.

If the FBI is breaking down the door then they'll grab you and just lock you up for contempt of court until you provide them with an unencrypted copy of whatever information they subpoena.

Re:Do many companies really do EFM recovery?

[fbjon]

And then you give the key to the outer Truecrypt partition, of course.

Re:Do many companies really do EFM recovery?

[Hal_Porter]

Except that in the real world the FBI bust you because they have other evidence. If your Truecrypt partition doesn't have any trace of the stuff they know you've done they'll know it's the outer one, not the inner one.

The best way to avoid this sort of thing is to not do the sort of things that cause the FBI to go after you in the first place and not try to use your intelligence as a way to be completely immoral. Because we all know how well that worked out for Hans Reiser.

Re:Do many companies really do EFM recovery?

[AmiMoJo]

There are ways you can protect yourself from a cold boot attack anyway. For a start, setting your BIOS to do a full memory test is a good idea, because then as soon as the attacker reboots your machine the BIOS will erase every byte of RAM. Remember to password your BIOS to prevent them disabling the feature, and beware of BIOSs that allow you to cancel the memory test with a keypress.

The way an attacker gets around this is to remove the RAM from the computer and connect it to another one. This takes time, so make sure TrueCrypt is set to dismount your volumes when the screensaver kicks in, which should be set to something low like five minutes. TrueCrypt also has a feature to dismount a volume if nothing is written to for a certain amount of time or if the computer is put into sleep mode, which are also a good idea to use. Consider that the computer has to be left on while the techs check it out, figure out what kind of RAM it has, set up their own PC with a compatible motherboard and then do the swap.

It also helps to have lots of RAM modules, just to make the transfer process more difficult.

Of course, TrueCrypt has a hotkey for dismounting all volumes (or you can just hit the power button for start an emergency shut-down in Windows) and it's hard to see how anyone storming your house could do it fast enough to prevent you pressing one key.

Re:Do many companies really do EFM recovery?

[MoogMan]

Why would they?

These companies presumably target the typical consumer... the ones that don't wipe their disks purposely.

Probably the most common use case is: "Aargh, my disk has stopped working and I need to get my important documents off it". So the causes:

1) The disk has become corrupt. Doing a dd and re-constructing bits (MBR, file tables/trees, etc.) or scanning the disk for JPEG headers and the like is probably what's going to happen.

2) The disk has physically broken. First, move the platters to a working disk and follow the solution in cause #1.

Most of these companies probably don't deal with recovering purposely-destroyed disks. You'll likely have to talk to a government for that.

Re:Do many companies really do EFM recovery?

[Anonymous Coward]

Are you purposely ignoring the fact that they are offering you an additional $500.00?

Re:Do many companies really do EFM recovery?

[Corwn of Amber]

You can also write a couple of random bytes in random places on the disk, and it will become undecipherable even with the keys.

Re:Do many companies really do EFM recovery?

[DavidTC]

Right. The trick isn't to hide information, the trick is to hide information within the bounds of the law.

My theory: What you should do is overwrite the encrypted header on bootup, and rewrite it before shutting down. (Obviously, you'll need a UPS and a non-crashy OS.)

Then leave your computer on all the time, and rig up a tripwire on the door that cold powers it off. Or, even better, one that fries the memory.

Tada. Now you cannot decrypt the drive for the police. (To make sure you can prove this, be sure to overwrite the header with a specific string like 'DEADBEEF' or just all zeros, instead of random information they can claim is a real header.)

Just in case that happens accidentally, or your OS crashes, make a backup header CD and give it to someone else. You're still clear, because they can't make you tell who you gave it to, or that you have a backup at all, as that is clearly a Fifth amendment violation. (As opposed to making you tell the decryption key, which is not. At least, not legally, although it should be.)

Explain all this to the police the moment they break in. And tell them your password.

For all those who think this is somehow immoral, the decision that encryption keys are not protected by the fifth amendment is wrong and unconstitutional. My method would just restore them to where they should be. (The fact it can be turned into a fifth amendment issue is pretty clear evidence it was to start with.)

Alternately, you can just try hiding that CD instead of giving it to someone else. Legally, the police cannot make you tell them the location of things. For more fun, hide it outside of any logical scope of a warrant.

Re:Do many companies really do EFM recovery?

[DavidTC]

Of course, TrueCrypt has a hotkey for dismounting all volumes (or you can just hit the power button for start an emergency shut-down in Windows) and it's hard to see how anyone storming your house could do it fast enough to prevent you pressing one key.

That will get you in all sorts of legal trouble. The second you know it's the police, any sort of tampering is 'interfering in an investigation' and itself a crime.

However, you can use the fact the police have started carrying out 'no knock' raids against them. The power switch in modern computers is just a low voltage button, and you can easily splice in another cord and run that to wherever you want. Such as a button that gets clicked whenever the front door opens all the way.

It's not your fault that they pushed the button when they slammed open the door. If they had just asked you would have left your computer as-is, like you are required by law, but they stormed in and triggered the power saving switch you'd rigged up to shut down your computer as you went out the front door.

Re:Do many companies really do EFM recovery?

[Hal_Porter]

If you explained this in court they'd probably lock you up for destruction of evidence, contempt of court or something like that.

Re:Do many companies really do EFM recovery?

[DavidTC]

The Gutmman method has been disclaimed by Gutmann as needed on modern drives.

Which is the damn point the article is trying to make: There is not a single shred of evidence that anyone has ever recovered data on a hard drive overwritten once with zeros.

Re:Do many companies really do EFM recovery?

[AmiMoJo]

That will get you in all sorts of legal trouble. The second you know it's the police, any sort of tampering is 'interfering in an investigation' and itself a crime.

Think about this for a moment - get in trouble for hitting the power switch (a year max, if that?) or get in trouble for having something that could put you away for life on your PC? Not a hard decision to make.

Anyway, you could always claim it was coincidence, and if they enter the house from the ground floor and you are in an upstairs bedroom there would be no way of knowing if you started the shut-down before or after they entered.

Of much more concern are laws like the RIP act. Even then it's stupid, because the maximum penalty for not disclosing your password is two years, where as something like plotting an act of terrorism is 10-15.

However, you can use the fact the police have started carrying out 'no knock' raids against them. The power switch in modern computers is just a low voltage button, and you can easily splice in another cord and run that to wherever you want. Such as a button that gets clicked whenever the front door opens all the way.

Many keyboards have a power button these days. Assuming you don't encrypt your system partition, you could just sleep the PC (much less suspicious) or use the auto-dismount hotkey. If the system drive needs to be dismounted too, you could set up a hotkey on that Microsoft dev tool that causes an instant blue screen, or just hit reset and better still hit reset and watch as the BIOS erases your RAM during the full RAM test.

Re:Do many companies really do EFM recovery?

[hobbit]

Read my comment again. I said "why multiple passes of garbage, rather than just one?", not "why one pass of garbage, rather than one pass of zeroes?"

Re:Do many companies really do EFM recovery?

[hobbit]

See also http://www.nber.org/sys-admin/overwritten-data-guttman.html

Re:Do many companies really do EFM recovery?

[feenberg]

No drive has ever been "recovered" with STM. The claims by Guttman and others that claim this is routine are simply overwrought. Data recovery firms can find overwritten files, since overwriting a file only removes the name and some links. They can't retrieve overwritten data sectors.

I have posted some background at nber.org

Re:Do many companies really do EFM recovery?

[DavidTC]

'Contempt of court' is limited to doing something the court said not, or violating the basic rules within the court. They can't get you for things that happen before the court gives you instructions. (This is including instructions to simply show up in court.)

As for 'destruction of evidence', there is no law against destroying whatever property of yours you want, or rigging that destruction to happen whenever you want. (Within the bounds of basic safety, of course.) It would be illegal to do that after the police arrest you, or when they tell you to stop...which is why you rig it up beforehand.

Granted, if the police show up with a warrant and present it to you, or if you even know they are there, and you let them trip it, a case can be made you allowed evidence to be destroyed if you didn't attempt to stop them, so do that...but you can't magically know that they're about to pull a surprise raid on you.

This is why I didn't suggest putting the system on a timer where you have to enter a deadman's code, or a screen-lock with a timed erase. If there's any way you can stop what is happening after you know the police have a warrant, you will, indeed, be found guilty of destruction of evidence if you fail to do that.

So do not give yourself that option. Yeah, getting a CD from someone else is a pain in the ass, but failing to inform the police that someone else has evidence that can be used to convict you is certainly covered by the fifth amendment.

Destroying 'evidence' before the police inform you you're under investigation is not illegal. I know people think it is, but it isn't. This is because it is not evidence until then.

Re:Do many companies really do EFM recovery?

[ion.simon.c]

I suppose that you missed this, then?

http://slashdot.org/comments.pl?sid=955869&cid=24906241

Re:Do many companies really do EFM recovery?

[ion.simon.c]

I wonder if there might be something else going on, too?
Is it probable that the FS is doing something special when it knows that it's going to fill a file with zeroes?

Hmm. I'll code something up...
http://simoncion.wargameweaver.com/code/temp.c
(Not sure what this proves... Prolly that I'm too lazy to write a block device driver to generate a halfway decent test.)

I think that I'm convinced that you're right... I'm surprised that working with /dev/urandom is *that* much slower... I would have thought that disk IO would have been the bottleneck. Oh well.

$ #./temp* are the runs from my code:
$ time ./tempAlternating

real 0m9.254s
user 0m7.230s
sys 0m1.320s

$ time ./tempZeroes

real 0m8.154s
user 0m6.950s
sys 0m1.180s

vs:

$ time dd bs=1024K count=100 if=/dev/zero of=tempfile.tmp
100+0 records in
100+0 records out
104857600 bytes (105 MB) copied, 2.09533 s, 50.0 MB/s

real 0m2.267s
user 0m0.010s
sys 0m1.120s

$ time dd bs=1024K count=100 if=/dev/urandom of=tempfile.tmp
100+0 records in
100+0 records out
104857600 bytes (105 MB) copied, 32.4097 s, 3.2 MB/s

real 0m32.532s
user 0m0.000s
sys 0m32.520s

Re:Do many companies really do EFM recovery?

[craagz]

It is an NTFS Partition.

Western Digital (WD800JB) 80GB hard drive. We paid roughly $60 USD for the drive. It is new. Yes, it works. We did a default initialization and NTFS format from within Windows XP. It was the smallest and least expensive hard drive we could purchase new. It's also a very plain, common drive. Data recovery firms should have a lot of experience dealing with this type of hard drive.

Re:Do many companies really do EFM recovery?

[phision]

The point in the challenge is that the data recovery companies are a farce.

The guys from 16systems claim that three companies said they can't recover the data and that's it. No money mentioned, nor the kind of data.

Re:Do many companies really do EFM recovery?

[hobbit]

Makes sense in a kind of "can't do any harm" sort of way. But does it really do any good?

Re:Do many companies really do EFM recovery?

[NateTech]

In the real world, the number of computer user versus the ones the FBI are actually interested in is a HUGE ratio.

All these geeks with "protected" hard drives, and no FBI stomping in the door to stop them drooling Cheeto juice while watching pirated copies of the Matrix.

They must be bummed that no one cares.

challengers

[pxlmusic]

challengers: they never appear.

Re:challengers

[anagama]

The challenge does not seem well designed. First of, the person attempting it has to pay postage both ways, deposit $60 with the organization hosting the challenge and forfeit the deposit if the drive is not returned in the same condition as it was when sent (how are you going to use a scanning tunneling microscope if you don't take it apart), they only get three days, and the reward is a whopping $40.

Re:challengers

[Drantin]

It does allow for it to be taken apart by any registered data recovery services, and also allows them to keep it for 30 days instead of the 3 normal people get.

Re:challengers

[Anonymous Coward]

Do they get to keep the $60 if you don't return it within 30 days? How do we know they didn't buy the drive for $40? Sounds like a nice little earner to me.

Re:challengers

[CityZen]

I imagine that you could get "low-level" access to the analog bits on the drive by just tapping into the analog data lines coming from the read/write heads (at the point where they attach to the circuit board on the outside).

This of course assumes that the A/D conversion happens on the outside circuit board, and not inside the sealed part of the drive.

Once you get such access, you could use a more sensitive A/D converter to try & make something from the data.

Like other posters have noted, though, data is encoded onto drives in a self-clocking manner that requires the absence of long series of 1's or 0's. So even though all 0's were written, the encoded bits are still a combination of 1's & 0's. Combined with the fact that drives use PRML (partial response, maximum likelihood), this makes data recovery VERY difficult, since even reading the data that was intended to be written is already quite difficult.

000 00 00000 000000000

[MillionthMonkey]

000 000, 0 000 0000 0000000 0 0 0 0000 00000! 000 0 000 000 0000000 000 000000 00000? 00 000 000000!

000 000 00 0000 000.

Re:000 00 00000 000000000

[thermian]

11111 111 1111 111 11111 11 11111 1111111111 :)

Re:000 00 00000 000000000

[Toe, The]

2

(ala Futurama, I believe)

Re:000 00 00000 000000000

[Bogtha]

That's just what I'd expect a monkey like you to say.

Re:000 00 00000 000000000

[MillionthMonkey]

That's just what I'd expect a monkey like you to say.

Well maybe 00000000 you can help me with my typing here. I've been trying to decide, 000000 should I have Hamlet's mother die in the last act or just kill off Claudius and have a happy ending 000000000000?

Re:000 00 00000 000000000

[TeknoHog]

0 0 1 1 0 0
0 1 0 0 1 0
0 1 1 1 1 0
1 0 0 0 0 1
1 0 1 1 0 1
1 1 0 0 1 1

Re:000 00 00000 000000000

[Anonymous Coward]

Oh no! Someone overwrote your post with zeroes! It's unreadable and there's no way to recover it!

Re:000 00 00000 000000000

[FormOfActionBanana]

That's really funny :-)

Hmm, what's the opposite of "whoosh"?

Re:000 00 00000 000000000

[Anonymous Coward]

*in the original UT-announcer voice*
HEADSHOT!

"....less than a zero percent chance"

[Joce640k]

That word "percent", I don't think it means what you think it means...

Re:"....less than a zero percent chance"

[Reality Master 101]

I think their problem is with understanding the concept of "zero", rather than "percent". Either that, or your understanding of hyperbole is flawed. :)

Re:"....less than a zero percent chance"

[cortesoft]

Nah, you can have a negative percent chance of succeeding in a task. For example, if you have a -5% chance of succeeding, not only will you fail every time you make an attempt, you will also fail 1 in 20 times that you don't even try.

Re:"....less than a zero percent chance"

[antifoidulus]

I've been looking for a slashdot comment that succinctly sums up my life, and now I've found it!

Re:"....less than a zero percent chance"

[Anonymous Coward]

Well, 0% chance means that it's anything inside the interval [0%, 1%) with probability 99%. Another example: 0.00% means 99%-confidence interval [0%, 0.01%).

Re:"....less than a zero percent chance"

[bhtooefr]

Same here. :(

(And, I wanted to mod this up +1, Sad.)

Re:"....less than a zero percent chance"

[RpiMatty]

Its like how much less data could you possibly recover? the answer is on this drive you can't possibly recover any less data.

Re:"....less than a zero percent chance"

[Anonymous Coward]

Excellent.

Re:"....less than a zero percent chance"

[magus_melchior]

"You tried your best, and you failed miserably. The lesson is, never try."

--Homer Simpson

Re:"....less than a zero percent chance"

[Tycho]

http://arxiv.org/PS_cache/hep-th/pdf/0110/0110253v2.pdf

Re:"....less than a zero percent chance"

[Anonymous Coward]

Nah, you can have a negative percent chance of succeeding in a task. For example, if you have a -5% chance of succeeding, not only will you fail every time you make an attempt, you will also fail 1 in 20 times that you don't even try.

So that means I have a 95% chance of succeding by not trying, with less than no chance if I try? Wow, I'm glad that works like that - I'm never going to try again - in fact this post was submitted without me even trying... ;) I don't even know I was successful... Is that some sort of weird quantum effect only Parmenides and you know about?

Re:"....less than a zero percent chance"

[Blympf]

I think Im going to stop trying to do stuff from now on....

Re:"....less than a zero percent chance"

[Kjella]

The parent post is even sadder than the grandparent IMHO.

Re:"....less than a zero percent chance"

[Anonymous Coward]

So if you don't try, you succeed 19 in 20 times?

Re:"....less than a zero percent chance"

[Anonymous Coward]

It's more complicated than that. Both -5% and 0% chance of succeeding on their own mean that you can't successfully complete the task, e.g. recover the data. However, if you use an Enchanted Electron Force Microscope +5% of Data Recovery, then you'll have, respectively, 0% chance and 5% chance of succeeding. Thus, if you're base chance of success was -5%, you have no chance of recovering the data even with the temporary boost from the enchanted item. If it was 0%, though, you've got a 1 in 20 chance of doing it.

Re:"....less than a zero percent chance"

[not-my-real-name]

So, this would be like random women calling you up and telling you that they don't want to date you?

Re:"....less than a zero percent chance"

[DanielLC]

... you will also fail 1 in 20 times that you don't even try.

Wait, so if you don't try, you'll probably succeed?

Re:"....less than a zero percent chance"

[Anonymous Coward]

You sir are awesome. That is one of the greatest comments I have ever read. I wish I could buy you a beer to repay you for your wisdom.

Anonymous Coward (no, not that one, a different one).

Pop Quiz

[DingerX]

Okay, so what's the logical fallacy at work here?

Re:Pop Quiz

[phantomfive]

Your logical fallacy? Laziness, I guess. Or general failure to read the article.....

not trying to insult you (or maybe I am, I don't know, but I have nothing personal against you), but the prize purse is $40, as has been mentioned several times already in the comments, and what he is proposing is probably impossible, and if it's not, whoever has that ability probably won't want to share the technique for a mere $40.

Re:Pop Quiz

[pla]

Your logical fallacy? Laziness, I guess. Or general failure to read the article.....

Er, no, you missed the GP's point. He referred to argumentum ad ignorantiam , one of the classic logical fallacies: Absence of evidence does not mean evidence of absence (or feasibility).

In this case, it applies because the test has a one-sided bias... If someone accepted the challenge and succeeded, it would of course prove the viability of recovering a wiped drive. IF, however (as has happened), no one succeeds at the challenge... That doesn't prove the task as impossible.

Re:Pop Quiz

[WK2]

Sumary of the fallacies I've seen mentioned on Slashdot so far:
1) lack of reward ($40, plus used 80GB drive worth $30-$40 new, minus shipping).
2) risky. You have to pay a deposit of $60, you have to pay shipping, and you only get the drive for 3 days.
3) You aren't allowed to take the drive apart, which, theoretically, would be necessary for EMF recovery
4) lack of publicity. Many of us didn't even know about the challenge until today. Most professionals probably will have never heard about the challenge even when it is over.

Basically, they are assuming that if nobody does the challenge, that nobody could.

The do have a valid point though. DOD 3-pass is more than enough for 99% of people. Common criminals and the FBI wouldn't recover that, and the NSA might not either. Destroying perfectly good drives is a waste of money and resources, and the practice should stop in 99% of cases.

Unfortunately, 16systems doesn't have enough funding to prove this. It would be nice if a more wealthy person/company would duplicate this challenge, but have several hard drives, pay shipping, have a reasonable reward ($5000+, the more the merrier), and be able to advertise the challenge better.

Re:Pop Quiz

[Vexorian]

meh? I thought it was argumentum ad awardium or proof by offering a money award... Hey, even telekinesis skeptics use it...

Re:Pop Quiz

[mdmkolbe]

http://en.wikipedia.org/wiki/Argument_from_ignorance

So, um did I at least win more than the original challenge offered?

Re:Pop Quiz

[Perf]

2) Risky - You send a money order for $60. If it is a scam, why should he/she send the drive?

Re:Pop Quiz

[Macman408]

OK, so the reward is now $500, they can take the drive apart, there's no deposit, and it's been publicized on Slashdot.

The reward is still waaaaay too small. A normal fee would be well over $1,000. And that's only if your drive is broken. This probably requires specialized equipment beyond what most recovery companies have. So yeah, zeroing your drive is probably usually safe, as long as the NSA, FBI, or your company's Chinese competitors don't have an interest in it. Or a random Materials Science or Electrical Engineering student, they might be able to hack something together too. ;-)

The key issues here

[symbolset]

The operating system that wiped the disk is not the one that was running on the PC, but a "known good" one. Otherwise a rootkit in the PC could lie to the wiping software about overwriting the disk.

The disk wiping completes successfuly overwriting all the blocks, not just the first few blocks of partition table and directory structure - all the data must be overwritten.

Although I use DBAN by preference because it's faster and wipes multiple drives at once, dd is a capable choice.

For "failed to wipe" drives, physical destruction is required.

Wow, what a prize!

[Dahan]

So the prize for winning is a $60 hard drive, plus $40? Damn, I don't know why people aren't just jumping all over that!

Also, disassembling the drive is against the rules of the challenge, unless you're a "established data recovery business ... or a National government law enforcement or intelligence agency".

This "challenge" is stupid.

Re:Wow, what a prize!

[agurk]

Actually they also ask you to tell how you did it. Even though they claim it is not a scam it seems like a scam in the sense that they after this weird experiment have proven that recovery is impossible.

It is like me setting up a challenge - can ketchup stains be removed from my white t-shirt?

Send a self-addressed, postage-paid box you pay shipping both ways with packaging material to the address listed below along with a sixty $60 USD deposit United States Postal Service Money Order only and I will mail the t-shirt to you.

If you can remove the stain you get to keep the t-shirt and I will give you the amazing amount of money $50 and the right to become "official stain remover". Btw, if you can't prove you are a established ketchup removal business - you cannot use water or any other fluid.

If this challenge is not taken within a year I have the right to tell the world that the worlds dry cleaners can't remove ketchup stains. The whole clothes cleaning industry is a hoax.

Re:Wow, what a prize!

[Renraku]

The challenge isn't stupid, the rewards are.

If this were an X-prize type of deal, it'd be a lot better. Who's going to bother with EFMing a drive for $40? I guess some college students with access to those machines might, but those are very fickle and easy-to-fuck-up machines..aka..kept under lock, key, and password.

Re:Wow, what a prize!

[Simon80]

This is exactly the problem with this challenge, there's no reason why anyone would participate. Anyone in the (forensic) data recovery business would probably prefer to keep quiet about what it takes to destroy data anyway, lest people make their lives more difficult.

Re:Wow, what a prize!

[gEvil (beta)]

I think your analogy would be a bit more apt if the "prize" was closer to $5 and the t-shirt. But I totally agree with your assessment of the situation.

Re:Wow, what a prize!

[kestasjk]

Most sites which run ads would pay well over $40 just to run a story on /. , it is a truly pitiful prize.

Re:Wow, what a prize!

[Blakey Rat]

Well, the "challenge" is obviously designed to fail, so in a few months when it expires they can sell their brilliant new drive formatting software (or whatever the hell this is trying to promote) with the marketing phrase: "this software made the drive un-recoverable, even when a cash prize was offered for recovery!" They just have to be careful not to mention that zero companies took the "Zero Challenge" and that the prize was trivial.

Re:Wow, what a prize!

[StarsAreAlsoFire]

The challenge IS stupid. You can't pull the drive apart, by the rules of this 'challenge', so you can't EFM it.

Re:Wow, what a prize!

[Lost Race]

I don't think EFM is necessary to recover overwritten bits from a hard drive. Custom firmware might be enough. Read the raw bits (with no ECC decoding) say 1000 times and do some statistical analysis of the variation of the bits. (Or less than 1000 times, but in different environmental conditions -- temperature, orientation, vibration, whatever.) My understanding is that current hard drives lean very heavily on ECC because the bit densities are so high that no one bit is ever very reliable. The variability of a bit can probably give some information about its history -- how many times it's been rewritten and what values it's had in the past.

Does such custom firmware already exist? Could anyone other than hard drive engineers write it? I don't know.

Even if firmware couldn't do it, custom controller circuitry might have a better shot.

Firmware can easily be modified without opening or disassembling the drive at all; circuitry can be swapped back and forth without damaging the drive or leaving evidence that it's been tampered with.

For all we know, the hard drive makers might have laboratories already set up to do this kind of recovery, or might sell kits for big $$$ with big NDAs. I think multiple random overwrites are still warranted if you really don't want the data recovered by anyone, ever.

Re:Wow, what a prize!

[Anonymous Coward]

If this were an X-prize type of deal, it'd be a lot better. Who's going to bother with EFMing a drive for $40?

Indeed, it'd probably need to be at least $400 even before Uncle Joey's Data Recovery Service thought it worth sending a big guy with a baseball bat around to the challanger's house to "recover the data" with a swift blow to the left knee followed by a friendly chat!

Re:Wow, what a prize!

[Anonymous Coward]

If this challenge is not taken within a year I have the right to tell the world that the worlds dry cleaners can't remove ketchup stains. The whole clothes cleaning industry is a hoax.

Screw all you nay-sayers. I'm going to patent this idea and make fools of all of you.

So far, I've got:

"A method and process for inducing legitimate data recovery researchers and practitioners to reveal their deepest trade secrets for a lousy eighty bucks. This patent covers all similar activities in any business, profession, hobby or pastime that my lawyers can stretch it to include."

Re:Wow, what a prize!

[Trogre]

From TFA, it's been raised to $500 now. Still less than the standard fee for such services, but a step in the right direction. I think this challenge is a good idea in principle, but needs someone with a deeper money pot. Perhaps we can get that Randi skeptic in on this.

It might even make a good Mythbusters episode. I'm sure they could work ballistics gel somewhere in there.

Re:Wow, what a prize!

[childoftv]

Here's a thought: I just accidentally erased a drive fulla my favourite/most mission critical data by "mixing up the or and else clause" when I was running dd or somesuch. I know that normal companies would charge $$$ for the service of recovering the data and those are $$$ I don't have. But I think, "hey Slashdot is awesome", maybe if I put it up as a challenge with a social rather than significant financial reward (see Predictably irrational by Dan Arielly) I'll get my frickin data back?

Jeez

[trifish]

Interestingly, the most important thing is missing from the summary -- the prize. So, what the prize is you ask?

An incredible, unbelievable, astonishing and amazing amount of... wtf... fourty (40) US Dollars? Yes, you heard that right! No wonder nobody has shown any interest in participating.

Full quote from the site: Should someone win, they get to keep the drive. They also will receive $40.00 USD and the title "King (or Queen) of Data Recovery".

Re:Jeez

[7 digits]

> Interestingly, the most important thing is missing from the summary

Not only that, but also the fabulous restriction:

"You may not [...] disassemble the drive"

This is ridiculous. A drive overwritten with zero data will, by definition, returns 0s through ATA commands. The reason why some people overwrite sensible data several time is to guard against a possible scanning transmission electron microscopy, which, of course would need the disk to be disassembled to be performed.

How can this ends on slashdot ? Don't know...

Re:Jeez

[Drantin]

They do allow data recovery companies to disassemble the drive...

Re:Jeez

[Anonymous Coward]

Full quote from the site: Should someone win, they get to keep the drive. They also will receive $40.00 USD and the title "King (or Queen) of Data Recovery".

Better than becoming the "King of Limbo".

Re:Jeez

[Warbothong]

Interestingly, the most important thing is missing from the summary -- the prize. So, what the prize is you ask?

An incredible, unbelievable, astonishing and amazing amount of... wtf... fourty (40) US Dollars? Yes, you heard that right! No wonder nobody has shown any interest in participating.

Full quote from the site: Should someone win, they get to keep the drive. They also will receive $40.00 USD and the title "King (or Queen) of Data Recovery".

That's not fair. They also get to keep whatever broken pile of scrap remains of the drive after they've managed to scrap the file/folder names off it :)

This prize is so valuable that it is actually a kingdom.

Re:Jeez

[Anonymous Coward]

Yes, but once the Nation of Data Recovery rises, that prize will seem a lot better.

Re:Jeez

[Darkness404]

Yes, but why would they? They can charge $300 for a business to get important data back, why bother with $40 and a HD?

Re:Jeez

[TheSHAD0W]

You don't need to do a STEM, but you do need to get an analog read off the data head, which of course requires you to disassemble the drive to connect to the wires. This is why reconstruction costs big bucks, and why no one is going to take this challenge to win $40.

Re:Jeez

[Jesus_666]

I have a great idea for a challenge: You get three days to crack AES. If you win you get five bucks (to be received in person at my home in Germany) and the title "Ruler of Cryptography" while I get exclusive access and all rights to your findings.

Re:Jeez

[arth1]

$300? That's for running what's pretty much an "undelete" like any shareware program can do.
$3,000, and you might get what amounts to a sector dump.
$30,000 and damaged platters/heads might be replaced, and attempts at hardware recovery done.
$300,000, and the electron microscopes might see use.

Re:Jeez

[Anonymous Coward]

I think the advertising of the story front-paging on /. and every other tech site would definitely be worth the cost they'd normally earn.

Re:Jeez

[Mascot]

$30,000 and damaged platters/heads might be replaced, and attempts at hardware recovery done.

Right. The recovery firm in my area does that for less than $2000. That is, removing platters from a damaged drive and attempting recovery.

$300,000, and the electron microscopes might see use.

I haven't been able to find a quote on this one, but you were off by a factor of more than ten on your last guess. I wouldn't be surprised if that were true here as well.

Re:Jeez

[Anonymous Coward]

LOL

Re:Jeez

[Anonymous Coward]

If you know the drive manufacturer and specs, you might be able to upload your own firmware that is better able to pickup on noise and filter it into old data. But it would be easier to just take it apart and scan it. Also most of the data the recovery firms are asked to retrieve was on the hard drive for more then a couple hours. Think months to years. This should cause the data to be more etched into the drive, Thus the need for multiple over writes. Also the drive may move slightly out of align might with longer use, not enough to effect reading old data only over riding it. Think of it this way. If the a zero was a blue square and we wanted to over write it with a red square (one) and we were not pefectly over the old blue square there would be a strip of blue left.

Re:Jeez

[Anonymous Coward]

Yeah, $40 is not enough prize money for me to continue reading the posts about it on Slashdot even.

Re:Jeez

[craagz]

Maybe it makes sense to restrict the disassembling of the drive only to established companies/Agencies as only they will have the expensive equipment to do what it requires to be done after diassembling the drive.

Where are the challengers?

[phantomfive]

Ugly unprofessional website, a prize purse of $40USD (plus the hard drive), restrictions that the drive can't be disassembled.....I can't imagine why they're having trouble getting interest. Raise the purse to $10,000 and you might have something.

In addition, according to Wikipedia, what he proposes is actually impossible, at the very least an electron microscope would be needed.

Can't say I'm entirely disappointed by this story, though. At least I learned something that I was ignorant of before.

Re:Where are the challengers?

[Bill, Shooter of Bul]

Well, its not impossible, but it would require the disassemble of the drive and the use of some expensive machinery or possibly knowledge of the harddrive's circuitry. . If I were in college, it might be a neat research project, but they explicitly say that you cannot disassemble it unless you are a for profit company or governmental agency. But yeah, for the "prize" its just plain stupid.

I'd like to try that myself with my own disk. I have some sophisticated software that I've used in the past to recover lost items. When a hard drive is damaged and the magnetism of a bit can be close to the value needed for a 1, but not quite. So with several different scans it might show different values. I'm thinking if the zero was correctly written to the disk, it probably wouldn't be able to read it as a 1 with repeated tries. Maybe with the right magnetic field, externally applied you could bump the former one bits back to one without quite knocking up the original zeros to that level. So if the 1 bit was actually knocked down by dd to 0.5 (interpreted as 0) an increase of all the disk by .5 would bump it up to 1, but the old zeros would be at 0.5.

Give me tenure and three grad students (at least two Chinese) and I'll do it.

Re:Where are the challengers?

[fishbowl]

>Raise the purse to $10,000 and you might have something.

Make the data on the drive be a key to an independently verifiable escrow account.
First person to arrive with the key, takes all. It's really very simple to create a challenge of this kind.

The prize can be "seen", and the independent party that releases the prize to the first comer, has specific conditions that must be met. Put a disinterested party in charge of this part of the contest.

Re:Where are the challengers?

[John Hasler]

> First person to arrive with the key...

How do all the competitors work on the same drive at the same time?

Utter stupidity

[Reality Master 101]

First of all, do data recovery firms ever *claim* they can recover from a zeroed drive? No, they don't. The claim is that government-level forensic analysis *might* be able to recover data with only a single overwrite, with very sensitive expensive equipment. Not terribly surprising the FBI wouldn't take them up on this challenge.

Second of all, someone is supposed to waste a lot of time and money for just a cheap drive and a piece of paper from some entity no one has ever heard of?

And they're doing this to "prove" that this type of data recovery can't be done?

This has to be the lamest challenge that's ever been issued.

Re:Utter stupidity

[Anonymous Coward]

Even somebody with sensitive equipment can't win. They stipulate that you cannot disassemble the drive. Modern hard drives have built-in micro-controllers with their own firmware. You'd have to disassemble just to bypass the software--which is convinced it's only reading zeroes.

If I wasn't afraid of some FBI "specialist" mistaking some random cached Japanese banner ad for child porn, I'd be content overwriting once with zeroes. But the government spends billions on equipment and man hours "saving the children". I'm not taking my chances knowing that said specialist will probably go up a pay grade for uncovering something - anything.

Re:Utter stupidity

[Henneshoe]

Sorry to be offtopic, but I love you sig...It is a sad day, isn't it.

Re:Utter stupidity

[wkitchen]

I don't think you read far enough down the page. The no disassembly requirement applies to any Joe Random who wants to take a stab at it. Actual professional data recovery companies don't have that limitation, and have 30 days instead of 3.

But I don't see why they don't just disallow Joe Random outright. There's no point taking the challenge with that limitation. And no point in offering it either.

Re:Utter stupidity

[Anonymous Coward]

This has to be the lamest challenge that's ever been issued.

I challenge you to prove that statement. If you succeed? Mod points.

Re:Utter stupidity

[Mike1024]

someone is supposed to waste a lot of time and money for just a cheap drive and a piece of paper from some entity no one has ever heard of?

I know the dollar has declined in value a lot in recent years, but it's hyperbole to call $40 "a piece of paper from some entity no one has ever heard of"

Re:Utter stupidity

[10101001 10101001]

The claim is that government-level forensic analysis *might* be able to recover data with only a single overwrite, with very sensitive expensive equipment. Not terribly surprising the FBI wouldn't take them up on this challenge.

Really? It'd seem the FBI would have directly or indirectly revealed the existance of such technology by now. It falls into the same argument of how breakable AES is, I guess. The only way I could accept that to be true is if every criminal for which they could have busted with magic-AES-decrypter or magic-post-formatter-disk-reader, the loss from criminals/spies/terrorists/etc having access to that knowledge is greater. At least with criminals, that's a self-defeating mindset, since it argues that you can never prosecute the very criminals you set out to nab from their use of weak security system. So, how valuable are spies/terrorists/etc?

Re:Utter stupidity

[craagz]

I agree, it is a lame challenge. But i suppose they are trying to find a cheaper way than electron microscopy or government-level forensic analysis. They've even raised the prize now.

Electron microscope

[Anonymous Coward]

By using multiple overwrites, your are future-proofing versus new technologies that, if I understand it, would be able to duplicate what a team could currently achieve with an electron microscope and a lot of boring work.

All this challenge does is show that no one is willing to recover data for a free drive and forty bucks. Since the assumed ways to recover data that has been overwritten all cost way more than this, it's as if I issued a challenge to anyone who could demonstrate digging into the ground and finding oil, and the reward is a hundred dollars. Pretty good odds no one would "disprove" that either, just because it's not worth a hundred dollars to an oil company to parse, digest, and follow the instructions to obtain a hundred bucks.

I think you got it at the beginning.

[khasim]

It's about money.

Since the "reward" offered seems to be less than the regular fee that a company would charge for such, why would any recovery company waste resources on it?

Re:I think you got it at the beginning.

[gEvil (beta)]

That was my thought, too. Reading through the challenge page, all I could think was "a whole 40 bucks?!?" I mean, even if I could do it, I'm not sure I'd waste my time for 40 bucks and the title of "recovery king".

Re:I think you got it at the beginning.

[MrPerfekt]

Advertising.

Re:I think you got it at the beginning.

[dotgain]

If my interpretation is correct, you're still $20 behind (unless you actually value an 80GB drive), since if you win you get to keep the drive, but apparently aren't refunded your $60 deposit. This was exactly why I read the article - and when I found out what's at stake I thought it pretty obvious why even ten-year-old johnny with his hex editor haven't entered - this is the most pathetic competetition I have read of in all my time.

Re:I think you got it at the beginning.

[adisakp]

Yup... data recovery fees are in the hundreds of $$$ per drive... not a measely $40. Typically data recovery places do one of two things.... 1) run software tools on the drive if the electronics work. 2) if the drive electronics are broken, substitute a board from a similar drive and run the same tools. #2 will cost you much more than #1.

Also, if you want to get data off a drive that is written to with zeros (i.e. if the US gov't had a drive with sensitive data from terrorists), they could do it if they had the appropriate millions of dollars of equipment including using a clean room lab, disassembling the drive, removing the platters, and scanning the platters with a microscopic tipped probe that could measure and map the magnetic fields at various depths on the drive.

Now do you think you're gonna get hundreds (or thousands) of dollars of recovery service from already busy firms using multi-million dollar equipment for a $40 prize -- probably not. If you offer a $1,000,000 X-Prize for data recovery, I bet you get some seriuous takers.

Re:I think you got it at the beginning.

[gEvil (beta)]

Generally with deposits you get your money back when you return the item. I'd assume that's how this one works, but I would double-check with them before I gave them my money. Not that I'd give them my money in the first place....

Re:I think you got it at the beginning.

[Anonymous Coward]

Not to mention the place doesn't precisely offer a lot of accreditation.

A co-worker recently reviewed the techniques and technology behind several recovery firms. By review, I mean he traveled to their offices and had indepth explanation and examination of everything.

There were several different practices used and from the description it doesn't seem like it something they couldn't recover. (Well, not cheaply anyway)

Shops simply running vanilla recovery software might be at a disadvantage, but the pricier ones claimed much higher grades of distortion would be necessary.

It really depends on how much you are willing to spend to recover the data.

Re:I think you got it at the beginning.

[Smallpond]

The place I talked to has two methods:

1) The drive works but you erased some files - they can find the undamaged file data and restore the deleted directory entries. They send you back the working drive.

2) The drive doesn't work - they take off the electronics and replace it with the equivalent from a new drive. Then they read off the data and burn it to DVDs or copy it to a new drive.

Neither one of these approaches will recover data that has been deliberately erased.

Re:I think you got it at the beginning.

[dosun88888]

They should have made the prize 40k instead of $40. You could fit an e-book in there!

Re:I think you got it at the beginning.

[magisterx]

Agreed, this won't prove anything since the reward for winning is too small the cover realistic expenses much less motivate them to go beyond their normal operations.

Re:I think you got it at the beginning.

[Anonymous Coward]

How about all of the free advertising and street cred as reward?

Re:I think you got it at the beginning.

[TheSpoom]

This is exactly what I was thinking.

Any company that would have the ability to do this would be losing an astronomical amount in terms of labour and profit by taking the challenge (which would usually cost in at least the four or five digits).

And any "government agency" such as the NSA wouldn't want to reveal any such advanced recovery technology, especially since the challenge says you have to make your methods public.

Epic fail.

Re:I think you got it at the beginning.

[Anonymous Coward]

Can we just rig up an auto ban feature right into the post submission to ban anyone using those last two words in your post?

Re:I think you got it at the beginning.

[Anonymous Coward]

...could have sworn it was $500.

Re:I think you got it at the beginning.

[Anonymous Coward]

Precisely the problem, now you offer $50,000.00 you *might* have a chance.

Data recovery in this circumstance involves many hours work after disassembling the drive and dropping the platters onto a device which is generally used for testing platters during HDD production (the name of which temporarily escapes me).

J Random data recovery company is unlikely to be equipped with the necessary equipment for such a recovery (the furthest most data recovery companies will go is doing platter swaps (i.e. swapping platters out of the target drive into another identical chassis) and in the main they won't even go that far.) nor if they did would they be willing to spend the time for $500.

Case in point, Forensic Data here in .AU charges $199 for ASSESSMENT, that's before they even start the recovery.

They might like to try giving it to the academic community, they might actually be interested in the challenge.

Re:I think you got it at the beginning.

[Anonymous Coward]

Towards the bottom:

They also will receive $500.00 USD and the title "King (or Queen) of Data Recovery".

Re:I think you got it at the beginning.

[NotBornYesterday]

How do there things start? Methinks I know.

geek#1 "Dude, what the fsck did you just do? Did you just wipe my whole drive?"

geek#2 "Sorry, dude, I was just messing around. Was there anything on there?"

geek#1 "Yeah, dude, I had a tarfile and a zipfile with pron in 'em. I wanna get that stuff back."

geek#2 "Dude, just download some more. The internet is like, full of it."

geek#1 "No, dude, that stuff was your mom nekkid. I'll never be able to replace it. (gets punched by 2nd guy) Seriously, though. I want it back."

(Both think for a minute, take another bong hit.)

geek#2 "Dude, I've got it! There's all these recovery services companies, and they get deleted data back all the time for companies and the CIA and stuff."

geek#1 "Yeah, dude, but those are, like, expensive. How are we gonna pay for it?"

(Again, both think for a minute, take another bong hit.)

geek#2 "Dude, I've got it! What if we told them it was like, a contest, and whoever could recover the data would be like, the king of data recovery!"

geek#1 "Ya, dude, that would totally work!" (they high-five)

Re:I think you got it at the beginning.

[TheSpoom]

No. I like my free speech, thanks.

Re:I think you got it at the beginning.

[Corwn of Amber]

Assessment for US$ 160?

Yeah, it must cost around that just to put the drive in a computer and assess what's wrong... which would take me from 30 sec to 5 mins, depending on what is actually wrong with the drive.

Re:I think you got it at the beginning.

[DavidTC]

The contest is stupid, but the argument is sound: There is absolute no evidence, despite what everyone asserts, that data overwritten from a drive can be recovered.

The theory is that overwriting data isn't total. But, even in the ideal universe, which is a drive that starts out totally zero, gets some data written on it, and then zerod again, no one has demonstrated you can read 'the leaks' of the data, the non-overwritten portions, and recover anything.

For drives that have been in use for a while, where, presumably, all locations have had 'data leaks' on them, no one has even come up with a plausible method to distinguish the 'last' leak from the dozens or more of overwrites, or link one bit with another bit.

All that it would seem to be possible to say is that 'This bit has been, at various times, a one and a zero, and the same with this bit, and this one, and this one has apparently never been a one, but this one was both, etc.', which is not 'data recovery' and is easily foiled by overwriting the entire drive with 10101010 and 01010101 before starting to use it.

And, because of the way drives store data, even if a '1' was never written to a specific bit, you don't know that bit was one. A '0' on a disk means not to flip the output stream, and a '1' means to flip it. So 11010110 does not mean 11010110, it means flip flip stay flip stay flip flip stay, or, starting with 0, it means 10011011. So all you know, if a bit was never '1', that it was always the same as the previous bit, which is rather useless if you don't know what that bit was.

That's complicated, but the end result is that you have to recover bytes from one end. You can learn the first 3 bits, or the first 7, but you can't learn the last 7. Which means a probability analysis of each bit is spectacularly useless.

Re:I think you got it at the beginning.

[bahamat]

If you can crack this safe we'll reward you with a shiny new George Washington Golden* Dollar!

* Golden Dollar is not made of real gold.

Re:I think you got it at the beginning.

[craagz]

They've raised the prize!

as of September 6th, 2008, we are raising the prize to $500.00 USD

Here

The prize sucks

[tukang]

Should someone win, they get to keep the drive. They also will receive $40.00 USD and the title "King (or Queen) of Data Recovery".

Maybe they should offer a better prize to get more people to participate

Did they ask Steve Gibson?

[Anonymous Coward]

He did SpinRite and is a real hard drive Guru. Someone should send him a email.

www.grc.com

0s are best

[Anonymous Coward]

BTW,it is a good idea to wipe unused space with zeros. because, after de-fragmenting your drive would be full of duplicate chunks of data. and if you wipe free space with 0, it would be more 'clean' so that in case of disaster, its easier to recover individual files.

Re:0s are best

[hobbit]

Um, no; if you don't wipe unused space with zeros, you're much more likely to recover individual files.

Non-challenge

[Anonymous Coward]

I would guess that lack of measurable incentive to do the recovery is what they are seeing. why the hell would a professional bother doing this for $40? I know I wouldn't. Put up some real money and your data will be recovered in no time.

bad terms & conditions

[Arthur B.]

The only way one could recover data here would be play on small change in alignment of the head to see what was before the 0, however, the instruction specifically prevent disassembling the hard drive... why do they even ship it then ?

Re:bad terms & conditions

[pegr]

Agreed. They should save the expense of shipping the drive and just email a drive image instead. Being all zeros, it should compress well...

Re:bad terms & conditions

[Creepy Crawler]

I used to crash BBSes doing exactly that.

Use Zmodem, upload a 1GB 0-file. Takes seconds, if that. When auto-decompressed, fills drive of machine and crashes it.

Rather effective. I'd assume that this same attack works on POSTing http gunk with gzip compression on. I havent tried..

Re:bad terms & conditions

[Anonymous Coward]

Yes, this works rather well if unchecked. Script kiddies and net pranksters do that with compressed images. Just make a nice 1KB gif that's actualy 100000x100000 pixels, post it to some big website and laugh like a madman.

Re:bad terms & conditions

[Creepy Crawler]

I was also 11 when I did that stunt on BBS.

I only conjecture about it now because I'd never do it these days.

why would anyone do this?

[mrvan]

Okay, here are my 3 reasons why a company would not accept this challenge:

(1) economical:

- I am asked to mail 60 USD to a random address, who claim they will return it to me if I send the harddisk back. This is a risk (how do I know it is not a scam?)
- In any case, I lose shipping charges both ways
- Maximum gain is 40$, plus an obscure web site calls me King of data recovery.
- Risk + Cost >> Gain

(2) International

I am asked to ship a US Postal money. A WHAT? Hello, creditcard? Paypal? Normal internaional cheque?

(3) Disassembly

All reasons I've heard for doing something more than dd is that there might be residual magnetic charge on the platter that is ignored by the filesystem. According to the rules of engagement, only some weird collection of institutions ("established data recovery business located in the United States of America" or "National government law enforcement or intelligence agency (NSA, CIA, FBI)") may disassemble the drive. How am I going to detect residual charge if I cannot disassemble it?

The last arguments compounds the first two, as only US Companies can disasseble, and disassembly voids the deposit, meaning I am certainly out 60$.

Next time that they want to be "noble and just to dispel myths, falsehoods and untruths", they should make a challenge that is actually interesting to any party to pick up.

Re:why would anyone do this?

[hurfy]

Forgot a biggie

(0) You also must publicly disclose in a reproducible manner the method(s) used to win the challenge.

You think the 3 letter agencies are going to tell us their secrets for $40 ?!?!? You think the professional recovery companies will either?

Since the consensus is that you will to disassemble it to some extent that pretty much wraps it up. The possible 'fame' is the only reason left and noone seems to know these people so that 'fame' doe not seem valuable enough.

Perhaps if Google sponsored it and you get your name on the home page for a few days and a nifty Google logo name thingie....

Still won't answer if the alphabet soup guys can do it tho. Maybe $10k some else might try and prove it possible that they could.

Re:why would anyone do this?

[nategoose]

In addition to the no disassembly rule, 3 days seems pretty short for this kind of operation. It probably could be done, but it'd have to be the contestant's top priority and even still it seems short. Another thing is that one of the data recovery firms that they contacted did agree to give it a try, but it sounded like they didn't know that it was a competition and Mr Contest-Holder took their lack of optimism as "we can't do it". Also, $40 bucks is at least 100 times too low to pay someone for any advanced data recovery.

Re:why would anyone do this?

[EkriirkE]

The 3 day rule isn't a hindrance. Just practice on your own drive to get the procedure down, then enter the contest and do it in (however long it took you with the working knowledge) time

Re:why would anyone do this?

[jonadab]

> I am asked to ship a US Postal money. A WHAT?

A money order. In the western world (or at least in North America) they're the most common method of paying by mail when the recipient won't take a check. (Second most common is to wrap cash in something opaque. A lot of people are afraid to do this on the grounds that the cash would be stolen out of the mail, but people do it all the time and I have never heard of an instance where the money was stolen. I suspect that the chances of having your check cashed and the merchandise never sent are just as high; I've had that happen to me twice.)

However, any challenge of this nature that asks the participants to send in money up front is inherently suspicious, unless the outfit running the challenge is very well-known in the industry (e.g., Sandisk, Samsung, the NSA, Phil Zimmerman, Bruce Schneier, ... you know, someone the participants would already associate with hard drives and/or computer security before the challenge is announced). If the outfit running it is totally unheard-of, it's even more dubious. As far as I know some clown just registered the domain 16systems.com for the express purpose of announcing this challenge and collecting as many instances of $60 as possible. Okay, so that's pretty unlikely with the prize being only $40. If the whole thing were totally imaginary, they'd make the prize at least a few hundred dollars to entice more entries and thus collect more deposits. Unless, of course, what they're really doing (call me a cynic if you must) is researching what risks people will take for the prospect of small gains...

Meh, maybe the real goal of the challenge is to get their domain linked from slashdot at least once, and maybe twice if somebody actually accepts the challenge.

Re:why would anyone do this?

[Creepy Crawler]

I really think it could be done.

If one was to test using different models (and one of that model), we could create expected cases.

We already have a system that uses only ram and CD: Knoppix. All we need now are hackable IDE drivers, which are a plenty in Linux. The key here is we need to know how to get past the auto-correction in the drives firmware. We need access to the uncorrected information. SpinWrite claims to do exactly this, so I believe it is possible.

After we do that, we need to record to a recording disk (go 1TB, for testing). We record say 1000 sectors and then slowly put the head out of alignment using the firmware codes. We record misaligned data along with that. After say, 1000 passes, we can then calculate statistical information of what WAS recorded.

The key here about finding out was WAS recorded is that we recorded it before 0'ing or 1'ing it. We know what was there, and we know what IS there now. We know the variables, and therefore can calculate it.

Once we know the variations in theory, we can apply that by reading the ??? drive and calculating the percentage of each bit and attempt to recreate the drive.

But that would be a damned nice masters thesis to actually prove mathematically that this attack could be done, and successfully prove it. It would be a decent 1000 fold factor to do so.

Re:why would anyone do this?

[d_jedi]

Nevermind that, but anyone who actually could do it would not do so (for any reward value) because of this condition:
You also must publicly disclose in a reproducible manner the method(s) used to win the challenge.

Umm.. if anyone can actually do this, the IP involved is probably quite valuable (either financially or for national security). So.. yeah. Not going to happen..

Re:why would anyone do this?

[Anonymous Coward]

Actually, you might be losing $20. They don't say you get your $60 deposit back. Only that you get $40 and the hard drive.

Re:why would anyone do this?

[dword]

And here's something which nobody has mentioned before:

(4) Has anyone ever heard of this "Great Zero Challenge" before?

Everyone claims that "established data recovery businesses won't do it" but that may also be because this is posted on a weird unprofessional website and it hasn't really been made public up until now. So they make a website with a stupid challenge without notifying anyone, they wait until it expires and then publicly brag that the challenge was so "great" that nobody ever dared to try it.

Re:why would anyone do this?

[craagz]

What are you talking about!! Being called "King of data recovery" by 16Systems is worth a gazillion dollars..







NOT!!

That is not a proof

[zebslash]

From the FAQ: Because many people believe that in order to permanently delete data from a modern hard drive that multiple overwrites with random data, mechanical grinding, degaussing and incinerating must be used. They tell others this. Like chaos, it perpetuates itself until everyone believes it. Lots of good, usable hard drives are ruined in the process

Well, that might be right, private recovery companies may not be able to recover data in that case, but this does not mean this is not possible for government agencies.

Re:That is not a proof

[jopsen]

If it was possible for an intelligence agency they probably wouldn't want to tell anybody about it... :)

However, I think the Challenge is okay... Since it proves that it's not possible to do it for anybody who wants to sue you...

From The Experts

[randomc0de]

Given my general level of paranoia, I recommend overwriting zeros, and five times with a cryptographically secure pseudo-random sequence. Recent developments at the National Institute of Standards and Technology with electron-tunneling microscopes suggest even that might not be enough. Honestly, if your data is sufficiently valuable, assume that it is impossible to erase data complete off magnetic media. Bur or shred the media; it's cheaper to buy media new than to lose your secrets.

Because all data recovery companies have electron-tunneling microscopes on hand for recovery and aren't just running a Linux distro with a modified ext3fs to ignore "deleted" inodes. The longest AES key I've cracked is 28 bits (in Python, no less!). Yet we still use a minimum of 128, more likely 256. It's not the guys running recover I'm worried about. It's the spooks with electron f'ing microscopes and a direct connection to AT&T.

Re:From The Experts

[jmauro]

Umm.. by definition the smallest AES key is 128-bits.

Re:From The Experts

[42forty-two42]

However, you can pad out the start with zeroes.

Re:From The Experts

[randomc0de]

However, you can pad out the start with zeroes.

Precisely. In my case, I could brute-force keys with 1-28 "real" bits... presumably 29 would have taken twice as long, around 4 hours. I didn't have to heart to put my laptop's little fan through that. Also, keep in mind that a Feistel-type cipher lends itself to variable key sizes, and Rijndael could probably be modified for lower keys sizes. The reason AES specifies Rijndael with a minimum 128 bit key is exactly the same reason you overwrite a disk multiple times. Technically 56 bits is enough, but 128 is only a constant slower, and several orders of magnitude harder to attack.

Re:From The Experts

[im_not_jose]

If I recall correctly, recover does not work with ext3 partitions.

Re:From The Experts

[randomc0de]

Ext3 is ext2 + journaling. Journaling doesn't change inode layout or add metadata (at least, not at the inode), so on-disk they look relatively the same. You can, as a rule, just "lie" to a program and tell it a FS is ext2, it won't be able to tell the difference.

Re:From The Experts

[rjb]

Not exactly true. Look here.

Re:From The Experts

[spinkham]

For $10,000 in hardware you can crack 56 bit keys in less then a week. Soon it will be 3 days for equivalent money.
56 bit crypto is dead, dead, dead.
See http://www.copacobana.org/ for one such project.

Resources required to perform such a feat..

[mr_stinky_britches]

I would expect that the resources that would be required (for the equipment and the expertise) to make a serious attempt at this are out of reach for most. I'm sure the likes of organizations such as the NSA have already attempted this, but as to whether or not they had any success..well I'm sure that information is classified.

--
  WI-FIzzle Blaahhggg.. I just post useful code snippets and linux information here

An urban legend

[Ancient_Hacker]

It's an urban legend. You can't recover erased bits. If you could it would imply that you can store at least two bits in the space of one. Disk companies have a pretty good idea what their heads and surfaces can do. Do you think they'd be passing up big $$$ by under-utilizing their disk's capacity?

There is that one Usenix conference "paper" foating around out there, but if you read it carefully it does not give a single example of one recovered bit.

If you've ever looked at the waveform coming off a disk head, you'd wonder with all the x/y noise and jitter how they can get even ONE bit out of that hairball. The answer is, they can, just barely, by applying all the sync, gating, PLL, and deglitching tricks, just barely reliably recover bits at the maximum recording density possible.

And all those pictures they show of bit patterns lingering under large erased areas are actually counter-examples. They prove that you can detect periodic bit patterns under large erased areas. Duh. In the real world the underlying data is not periodic, and the erasure isn't smooth or periodic either. If you overwrite real typical data with random data, you can't recover the original data. Shannon and company, you know.
 

Re:An urban legend

[russotto]

It's an urban legend. You can't recover erased bits. If you could it would imply that you can store at least two bits in the space of one. Disk companies have a pretty good idea what their heads and surfaces can do.

The idea is you wouldn't use standard heads.

Re:An urban legend

[Jeffrey Baker]

At the end of a disk's life, it is usually 3-5 years old, during which time the sensitivity of the pickup and the magic of the DSP have doubled more than once. So your attacker takes your discarded disk and installs the platters in a modern mechanism, enabling him to read, with his much more sensitive equipment, magnetic fields that the original mechanism was unable to detect.

Re:An urban legend

[fluffykitty1234]

I believe that you might be able to determine that if the current value is a 0, that at some point in the history it was a 1. And vice versa. The problem as I see it is that you wouldn't be able to determine how far in the past. Image if the disk were written:

1, 0, 0

You would probably still have some residual history of the '1'.

If you had a disk that was written exactly 1 time, and then overwritten with 0's, then I would believe you could recover some of the data. But how likely is that?

Re:An urban legend

[hobbit]

Disk companies have a pretty good idea what their heads and surfaces can do. Do you think they'd be passing up big $$$ by under-utilizing their disk's capacity?

Well, given that all modern drives have some sort of internal error correction mechanism which would be rather difficult without minor redundancy, then yes, I rather think they would.

Re:An urban legend

[Kjella]

It's an urban legend. You can't recover erased bits. If you could it would imply that you can store at least two bits in the space of one. Disk companies have a pretty good idea what their heads and surfaces can do. Do you think they'd be passing up big $$$ by under-utilizing their disk's capacity?

1. Economics: What a $100,000 recovery can do may not be suitable for a $100 consumer drive
2. Lack of symmetry: If you can only write 100GB, you don't need a read head with resolution over 100GB but it might easily be possible to do so. Think like writing on paper with a huge magic marker, it's the marker limiting the information not your vision.
3. Historic improvement: The same has been said about say 100GB disks. What would you get if you took the read heads of a TB disk and applied those? Likewise, what would happen if you took the read heads from a future 10TB drive?

Re:An urban legend

[Anonymous Coward]

Why wouldn't you be able to determine how far in the past? One simple harddisk bit model would be a continous physical quantity x (initially random, or set to 0 or 1 or 0.5, let's say it's set to 0.5), the effect of writing a new_bit being:

new_x = old_x * 0.1 + new_bit * 0.9.

Bits are read from the disk with the rounding rule "x > 0.5 ? 1 : 0".

You can verify that the rounding rule always returns the last bit written. Some examples:

Write 1, get x=0.95, return 1.
Write 0, get x=0.05, return 0.
Write 1,0 get x = 0.095, return 0.
Write 1,0,0 get x = 0.0095, return 0.

So the hard disk works. Now possibly with forensic tools you can measure x to very good precision. If so you can learn something about the history of the bit. For example in this model, you can precisely know the last overwritten bit as follows:

If 0 < x < 0.05 or 0.9 < x < 0.95 then overwritten bit was 0.
If 0.05 < x < 0.1 or 0.95 < x < 1 then overwritten bit was 1.

Re:An urban legend

[Anonymous Coward]

Mod parent up, those are exactly the points I would have made. In addition, recovery read heads can afford to read at a slower speed if that helps.

Re:An urban legend

[Culture20]

Disk companies have a pretty good idea what their heads and surfaces can do. Do you think they'd be passing up big $$$ by under-utilizing their disk's capacity?

Considering that they purposefully make big $$$ by under-utilizing their disk's capacity, I'd say yes. Different firmware with the same platters (full RAW size of 1TB), and suddenly you have several sizes of drives for different price points while spending only the cost for manufacturing one type of drive. Of course, that might be an urban legend too.

Re:An urban legend

[Anonymous Coward]

Very good, except you're missing the picture. Through the ATA interface, the HD can only report a 0 or 1. There's no in between. In the real world, there's no such thing. It's all a measure of how much current is induced as the head passes over. So in reality they're not talking about recovering data. They are talking about re-interpreting data.

Hence the talk of overwriting bits potentially can still be recovered. I'm not sure exactly, but the argument appears to be that using an STM, it might be possible to get a much finer resolution on the magnetic orientation of the "bit", and thereby be able to detect a finer shift one way or the other towards interpreting it a 0 or a 1.

Obviously, this is not reliable, since you trying to interpolate & filter data at an accuracy to which it wasn't even written to in the first place.

On a side note, something tells me that reading of an HD is nowhere near as unreliable as you make it appear. It's not trivial, but it's certainly not a miracle, or you would hear of corruption as a major computer problem (i.e. probability of an important system file becoming corrupt would be quite high).

Re:An urban legend

[Anonymous Coward]

Right, because obviously the piece of consumer electronics reading contiguous swaths of data at many thousands of RPMs is comparable to the state-of-the-art electron microscope probing one bit at a time off a stationary platter.

Re:An urban legend

[Anonymous Coward]

Actually, the story as I've heard it goes like this:

Every time you store data on a hard drive, there's a slight magnetic shadow from the data that was previously there. This shadow can be detected using an electron microscope, and in fact government agencies are capable of using this technique (although it's very expensive).

If you would like to wipe your hard drive so that it cannot be read *even by the NSA* all you have to do is make sure you've overwritten all positions on the drive at least three times. This blurs things so much they can't figure out what was on it originally, even WITH their fancy tools.

Doing this is as easy as issuing the command "mke2fs -c -c /dev/hda1"

(given that hda1 is a partition covering the whole disk). What this is, basically, is formatting the disk while destructively checking for bad blocks (by writing and reading every byte on the disk).

It takes a long time though.

Re:An urban legend

[Anonymous Coward]

> It's an urban legend.

Let's ask MythBusters

Re:An urban legend

[Anonymous Coward]

Um, I am thinking that fitting a fucking high magnification electron micro scope into a hard drive is a little over the drive makers ablities, even if they could the cost would be too high to market. If you know how to do it please send me one. I would love to have access to a cheap and small Electron Micro scope.

However you are correct in that the head on all modern harddrives are near their theoretical limits.

Re:An urban legend

[Anonymous Coward]

man you're on crack

Re:An urban legend

[nester]

You're assuming that nothing is more sensitive and accurate than the drive's own heads.

But what about the .jpg?

[Anonymous Coward]

Uh-oh. I think they forgot to overwrite the region of the .jpg containing the filenames multiple times with random colours!

Re:But what about the .jpg?

[CableModemSniper]

Well you can see approximately how long the name of the first item in the dir listing is, as the top border of the selection indicator is still visible.

Its possible.....

[3seas]

.... to recover all the zero's

LOL

[Anonymous Coward]

The fact that you only allow 3 days upon receipt of the drive plainly shows your ignorance of how hard drives work.

It takes a long time to take magnetic force microscope (MFM) images of the drive. Researchers at Georgia Tech could do your challenge, but not in 3 days and not for your lame 'prize.'

Bullshit "contest"

[Anonymous Coward]

So, you can't disassemble the drive, and you have to get data off a tiny fraction of the drive.

Data recovery companies are in the business of repairing physical damage and a few "oh shit" cases. They're not going to use an STM to look at a drive. However, the Mossad or CIA is quite willing to spend any amount of money to spy on you if you're a target. If you're got HIPPA stuff on it, destroy the drive. If you've got old logs on it, /dev/zero is fine.

No takers

[deblau]

Their offer if you win: a whopping $40 (plus you get to keep the drive!). No way in hell you can recover data after dd for $40. My time alone is worth more than that. Offer me $40,000 and I'll consider it.

It's about time.

[Jane Q. Public]

"Forensic data recovery" may have worked on overwritten drive space before, back when mechanical tolerances and drive heads were sloppy. Modern drives are a much different story. There is little to no room for "magnetic slop" surrounding a written bit. If there were, the drives would simply not work well!

Re:It's about time.

[moofrank]

I've always heard that it was possible due to mechanical tolerances. Everyone has always heard that...

But...have you ever read a first party account of someone actually recovering usable data? Or done it yourself?

That's the idea that this chap is proposing. What he is offering is ludicrous.

There *IS* a need to work this thing out, however. I, myself had a problem with an end user who overwrote a filesystem. (Not an fsck, but a full rewrite. Very similar to this test.)

I tried a couple of data recovery companies who claimed the data was lost. Then followed a day's worth of meetings explaining that the data was lost. ...because everyone knows that if you pay a data recovery specialist, they can get the data off an erased HD...

damn straight!

[larry bagina]

Last month, I challenged every female olympic gymnast to prove she was over 16 by having sex with me. (The age of consent is 16 in my state). To date, every gymnast has ignored me, with the exception of 1 whose boyfriend threatened to kill me. Therefore, we now have proof that all the female olympic gymnasts are under 16 and should be disqualified.

Re:damn straight!

[Anonymous Coward]

You have the same problem the Great 0 Challenge has, your prize is too small!

Re:damn straight!

[hobbit]

Best. Comment. Ever!

Re:damn straight!

[Anonymous Coward]

(The age of consent is 16 in my state)

Ahh, I see your problem -- you should have conducted the contest in AK or TN where the age of consent is, what, ten? Except for close relatives, which will, in most cases, comprise about 85% of the state's population.

Not so.

[Jane Q. Public]

If you were a data recovery company, you would gain an ENORMOUS reputation if you were to complete the challenge. And the cost? Shipping.

That is the cheapest publicity they would ever receive... and what publicity they would receive!

Re:Not so.

[DigitAl56K]

That is the cheapest publicity they would ever receive... and what publicity they would receive!

Yes, what publicity they would receive? :) I've never heard of 16systems.com before, their site is barebones with almost no articles. I dare say they caught a lucky break with this Slashdot article. Maybe I'm wrong, but it seems that there is no obvious publicity to be had (before now). And should recovery firms respond to everyone with a small website who issues a challenge?

Re:Not so.

[Henneshoe]

I hope that was sarcasm, because really who hasn't heard of 16systems.com and their (not so) great challenge. The publicity from winning this is next to nothing.

Re:Not so.

[maxume]

Some guy says that he created the files on the disk and then deleted/overwrote them. Maybe he did. Maybe he didn't.

If you are a busy data recovery company, this guy doesn't have enough of a reputation for the publicity to be worth the risk that he didn't.

Re:Not so.

[Anonymous Coward]

Exactly the opposite of what you said -- and if they don't crack it on the challenger's limited timetable, they get known as a company that can't recover data.

Lots of downside on this one for an established company.

Re:Not so.

[Anonymous Coward]

Given that I've never heard of this challenge and it doesn't have a budget of more than $100, I think this would be a horrible source of publicity. Better to post customer stories from real people who used your product.

Re:Not so.

[Isotopian]

Read the article. He says that anyone who is an actual recovery company, not just some random dude, can take the drive apart and keep it for 30 days.

Re:Not so.

[jonadab]

> If you were a data recovery company, you would gain an ENORMOUS reputation if you were to complete the challenge.

Only if the challenge, and the outfit offering it, has achieved significantly more notoriety than the existing reputation of the data recovery company. If you're a startup running out of your parents' garage, that might be the case... but for any serious data recovery corporation, it's not worth laughing at.

Re:Not so.

[adisakp]

If you were a data recovery company, you would gain an ENORMOUS reputation if you were to complete the challenge. And the cost? Shipping.

And if you take the challenge and fail and the challenge holders print that your company was unable to recover data from such a simple change to the drive, you could lose all your business and ruin your reputation.

Re:Not so.

[Mascot]

Yes.. ENORMOUS. It's the famous 16 Systems after all. The are world renowned for their services. Such as amazing software that is capable of scanning your local files looking for sequences that might be SSNs, and two more "give me Python and five minutes" type applications.

They are clearly very security minded. Half the links on their webpage produce

Secure Connection Failed

16systems.com uses an invalid security certificate.

I can't even imagine the new business I would see if I participated in their challenge. And the recognition!

[/sarcasm]
These are either idiots, well meaning kids, or scammers. Either way, only the ./ editors are ever going to take that "challenge" seriously.

Re:Not so.

[hobbit]

But why? Why can't a random dude do that, and simply lose his deposit?

Re:Not so.

[StarsAreAlsoFire]

yeah they would, because the task is impossible. If it WERE possible, your poor computer would crash ALL THE FREAKING TIME.

The read-heads on the drive are never going to be sensitive enough to read THROUGH the data that was written by the drive. NEVER. That is the POINT. If a drive could somehow magically triple the read sensitivity and edit the hardware-level drivers then you'd have a chance ( though still tiny )... but why would a manufacturer design that into their system? They wouldn't. The write is just powerful enough to write data that can be correctly read 99.99999% of the time. The read is just sensitive enough to read data that was written... you get the idea.

Now, if you take the platters out of the drive ( forbidden by the 'contest' rules ) you can easily ( in the "we're with the CIA and we're here to help" sense ) use a device that is hundreds of times more sensitive than the standard read head to view the magnetic alignment of the hundreds or thousands of molecules that make up each bit. Using statistics you can make some pretty good guesses as to what was written there before.

If a bit was only ever written twice ( once by the creation of a file, once by the zero-overwrite ) then I'd guess that the data recovery would be 100% effective. But it would only be done in the case of a high profile drug case, government spying or some such.

Re:Not so.

[Anonymous Coward]

Mod parent up.

The rules of this "challenge" are so retarded it's astonishing.

Simply put: The reason for multiple overwrites is to defeat electron microscopes and similar methods of reconstruction. These require you to open the drive up.
You can not prove the DD is good enough if you forbid opening the drive.

Re:Not so.

[ibbey]

Now, if you take the platters out of the drive ( forbidden by the 'contest' rules )

Go reread the contest rules... In particular, pay attention to the underlined part. It specifically says that professional data-recovery businesses and government agencies can disassemble the drive if needed.

Re:Not so.

[StarsAreAlsoFire]

The page has been modified since I last looked at it. Perhaps that was there before, but there was more content on the last look.

What if...(conspiracy)

[PottedMeat]

They're all in bed with each other! :O

Maybe they *can* actually recover the data BUT they DON'T so that all the criminals believe the hype and go merrily on with their criminal ways believing dd will keep them safe. :O!
PM

So soon they've proved

[Anonymous Coward]

nobody will restore your once written over hdd for 100 bucks.

Whereas technically it's an interesting thing, it obviously isn't economically.

Why Can't They?

[Ian Alexander]

From the link, what one data recovery company said after being told that the drive had been zero'd out with dd:

According to our Unix team, there is less than a zero percent chance of data recovery after that dd command. The drive itself has been overwritten in a very fundamental manner.

Can anyone tell me what's so fundamental about the "dd" command that there's not even no chance the data could be recovered?

Re:Why Can't They?

[zippthorne]

Read the source.

If you feed it a long string of zeros and don't give it any stopping conditions, it activates the drive's vacuum pump and removes all of the air. This step eliminates the cushion keeping the heads off of the disk, so while "writing" zeros, they're also shaving a layer of magnetic material.

This is more than sufficient to wipe your drive and prepare for a fresh install, unless your drive uses vertical bits. Keep in mind, though, that hard drives are like wood floors. You can only plane them two, three times, tops, before they have to be replaced.

Re:Why Can't They?

[Anonymous Coward]

It'll be interesting to see if you get modded 'informative' or 'funny'.

Re:Why Can't They?

[GXTi]

Most recovery services are just "undeleting" files - e.g. locating the fragments of files that have been marked as unused and assembling them, then charging exorbitant rates for their work. dd writes directly to the device by bypassing the filesystem, so everything is, as far as the hard drive's firmware is concerned, gone. In order to get any bits back after zeroing like that, you'll need to open drive and peer at it through really expensive equipment, because the drive wrote those zeroes and it would be broken if it read back anything but zeroes.

The whole article is full of comedy gold

[Joce640k]

eg. Asking the special Unix team if it was possible after a "dd" - as if Unix writes to the disk in some special way that Windows doesn't.

I agree with the challenge though. It can't be done.

Re:The whole article is full of comedy gold

[TrekkieGod]

eg. Asking the special Unix team if it was possible after a "dd" - as if Unix writes to the disk in some special way that Windows doesn't.

It's not because Unix writes to the disk in some special way, it's because nobody outside their unix team would know wtf the "dd" command does, so it had to escalate to them once they explained what they did to the drive.

I agree with the challenge though. It can't be done.

Not for a $40 reward, that's for goddamn sure. I'm not willing to spend time searching for a file that isn't deleted, and they just forgot where they saved it. Yes, I would charge over $40 to use the "find" command.

Re:The whole article is full of comedy gold

[cduffy]

"It can't be done" is a little strong: On older (early-1980s) hard drives it probably could be done. Modern drives, less likely. No-disassembly rule, no chance whatsoever.

That said, "industry best practices" is what it is. When I'm wearing my data security hat for a company managing people's medical records, I'm going to advise that we follow whatever accepted standards are for wiping drives; if FIPS says to degauss the drives, we're damned well degaussing the drives. "Nobody ever got fired for choosing IBM" may be a lousy rule for procurement, but "nobody ever got fired for insisting on industry-accepted security practices" is right on the money.

Re:The whole article is full of comedy gold

[HiThere]

Drives are cheap.

My "Best Practices" calls for first using fdisk to make the drive a single partition, then filling that partition with /dev/random, then taking the drive apart and giving the platters to different kids playing in different sand-piles.

OTOH, I've only once had to deal with data that I considered worth that degree of effort.

IF the data were MORE important, then I'd have manually run sand-paper lubricated with jeweler's rouge over each platter before distributing them.

Theory is one thing, practice is another. I'd need to see it proven that this security was insufficient. If it were, then heating the platters on a burner should suffice.

The thing is, drives are cheap. If you REALLY want to ensure that data is non-recoverable, you destroy the drive. How thoroughly depends on how secure you want to be, but dissolving in acid is probably overkill no matter WHAT your data is. (Still, it would be effective. And my current "Best Practice" is overkill for the data that I was dealing with. But drives are cheap.)

Re:The whole article is full of comedy gold

[Bazman]

"No disassembly" doesn't mean you can't tap onto the drive's external circuit board, where you *might* just be able to get the voltages before they go digital, unless the ADC circuitry is inside the housing...

Re:The whole article is full of comedy gold

[darqchild]

Actually, since the voltages are so tiny, the ADC is usually mounted on the arm right next to the heads. You can see it if you open the drive.

It is NOT an "urban legend"...

[Jane Q. Public]

... it is merely old tech that is no longer relevant. In the old days of sloppy mechanical tolerances (and read-write heads), it was possible to leave traces that were misaligned with the main bits of the current data. With good custom drivers and software, it was often possible to recover some of this data.

This is of course no longer true what with much tighter tolerances, smaller and vertical magnetic domains, and so on. I think that is the point of this challenge.

This must be Room 12A

[Anonymous Coward]

"Argument is an intellectual process. Contradiction is just the automatic gainsaying of any statement the other person makes."
"No it isn't."
"It is."
"Not at all."
"Now look."
(Rings bell) "Good Morning."

Is it a myth?

[Pedrito]

From the site: Legitimate data recovery firms know this. They will not take the challenge. Neither will a national government agency.

Okay, well first of all, it wouldn't be in the interest of any government law enforcement to accept this challenge. Why would they? To show us what they can and can't do? I think it's in their best interest to keep that to themselves and keep us wondering.

I don't know if the overwriting thing is a myth or not. I don't know enough about the physics of it to even approach an answer. On the other hand, I've had conversations with people who build gadgets for spooks and they have stuff that a lot of people here would probably consider impossible. The government hires some of the brightest minds for this kind of stuff.

I've learned to forgo the word "impossible" when it comes to this kind of stuff. You just never know. On the other hand, I don't really care one way or the other. I don't keep anything on my hard drives that I'd worry about the government finding.

Re:Is it a myth?

[Oktober Sunset]

It would be in the best interest of the government to accept the challenge then pretend to fail miserably at it.

Then people stop doing all these elaborate data recovery things and the governments come and nabs them all.

You are arguing against yourself.

[Jane Q. Public]

Because you are giving the very concept print space (and your own time) right here on slashdot! Who cares about the website? Others would be blogging about it all over the place.

Re:You are arguing against yourself.

[xenocide2]

There's nothing in it for data recovery companies to participate. Their customers are law enforcement, so why should a company doing strong data recovery bother proving that criminals need to use a secure delete mechanism?

Re:You are arguing against yourself.

[Firehed]

Interesting point... the last thing they want to do is make their jobs harder by inadvertently telling the criminals to use a more secure drive destruction method. Now I don't believe for a minute that those molten drives that saw the wrong end of an arc welder are going to have recoverable data, but I'd consider it at least vaguely plausible that zeroed-out data can be recovered (I don't see it happening on the 7- or 35-pass wipes, but would be intrigued to see someone prove me wrong)

It is recoverable, but at a price.

[viking80]

It is likely that there is a hysteresis in the platter causing a "0" written on top of a "1" to be slightly "weaker" than a "0" written on top of a "0".

On old tape, this hysteresis was about 10%, and was actually visible with a magnetic loupe, so depending on s/n ratio, you could recover quite a bit, no pun intended.

The problem with a HDD is that the signal from the heads go through a lot of signal processing including Extended PRML or EPRML. There is also an algorithm like RZ to not have a long series of the same bit written physically. If you take the electrical output from the read head, you will have a big task reconstructing the data, even if there only good data.

The only places today that can analyze well what is read physically is at HDD manufacturers research lab, and probably using custom HW to read the platter that collects all the errors and offsets. For a recovery company to do this, they probably would have to invest millions of $$$, so they will not.

So bottom line is that you could send the drive in to Western Digital, and they could probably recover the raw data with about 90% accuracy. If that is enough for the error recovery to chew on, I am not sure, but here and there, long strings would be recovered. They can for sure give the exact probability for the recovery of a bit.

WD however does not have any incentives to demonstrate that wiping their drives with "0" is not sufficient. aux contrare, they may consider this an undesirable property. Therefore, the only ones that can recover this is unwilling.

So the challenge remains unaccepted.

Re:It is recoverable, but at a price.

[glwtta]

So bottom line is that you could send the drive in to Western Digital, and they could probably recover the raw data with about 90% accuracy.

That's a pretty impressive number, to just pull out of your ass.

Re:It is recoverable, but at a price.

[qubezz]

Don't you know that 85% of all statistics ARE pulled out of someone's ass??

Re:It is recoverable, but at a price.

[viking80]

Where did you pull out that comment? We actually did recovery on magnetic tape, so that is where 90% comes from.

the drive must be in a living system???

[niiler]

See, here I was thinking a Cylon. Number 6 specifically.

I've

[Anonymous Coward]

I've got an opinion on this issue. And I have a challenge for mister Great Zero Challenge.

If you can determine my opinion, you win.
The prize: A brand new american one dollar bill.

Just send me $20 for shipping and handling.

And you can be king of guessing my opinion.

The reward is shit

[thetoadwarrior]

It's not a competition run by a large website so there won't be any publicity and the reward is smaller than what you pay out. Even if I was 100% sure I could do it I wouldn't bother.

Microscope for magnetic recovery?

[exscape]

Hmm. Could someone explain exactly how the electron-tunneling microscope could help recover data? And, could it really be used to recover more than a couple of bits?

Re:Microscope for magnetic recovery?

[Cillian]

The general idea is, a 0 or 1 on the actual platter isn't quite that straight forward. Think of it as an analog value. If there was previously a 1 on the disk, the new 0 might actually be a 0.1 rather than a 0.0. By using some sort of system to see the actual analog value for each part of the disk, it could be possible to recover data this way. Though I have no idea what an ETM actually does, or what device would do this for you.

Unacceptable terms

[Anonymous Coward]

If anyone were able to do this, the terms say they have to disclose their methodology. No company in their right mind would give away their trade secrets for the paltry sum of $40.

Forty dollars?? Why would anybody enter this?

[Geoffrey.landis]

Let's see, you pay shipping both ways, you're not allowed to disassemble the drive, you're "allowed" to do three days of work (suppose eight hours per day, a hundred dollars an hour, about twenty-four hundred dollars worth of labor)... and if you win, you get forty dollars. And you get to keep the drive.

Why would anybody enter this "contest"?

I would certainly believe, for what it's worth, that you can't recover the data from an overwritten drive without disassembling it. That's a "well, duh" statement. You have to get at the physical media. And it's certainly going to cost you more than the forty dollars, minus the amount you paid for round-trip shipping, that you could win.

Flaw in the challenge?

[Onyma]

Is the challenge not fundamentally flawed? The rules require that the drive be returned after 3 days in the same condition it was sent in. This immediately precludes invasive methods of data recovery and requires the firm to use only the drive's on board electronics to access it. The drive's on-boards are not going to pick up any residual magnetism in the platters as they over-wrote the data. They are only sensitive enough to read the residual field they applied in the first place. (obvious by design) If the default heads picked up residual traces of previous data all our hard drives would be pretty useless, wouldn't they?

By adding this requirement you handicap the recovery firms to an extent that obviously they won't try it. The proper way to do this would be to have a series of drives available that can be put through proper invasive data recovery processes.

it is PR

[someone1234]

1. if you don't accept this simple the challenge, you definitely scam your customers. Some will take notice, and you lose more.

2. if you accept the challenge and WIN, then you get free advertising. (If you accept but lose, you still get some bad PR, but at least you can say the drive was fake).

Re:it is PR

[arth1]

And the drive being fake is a distinct possibility here. The guy has an agenda, that's pretty clear. And where's the accountability? Why should we believe him when he says what has been done to the drive? Any more than we believe British barristers representing the late Mr. Ongopongo of Nigeria in their claims that they have some millions of dollars they want to give you?
Because we want to believe him, because his claim is very plausible? Sorry, that doesn't increase the accountability or invalidity of this "challenge".

Unless acceptable witnesses can observe (a) the original status of the drive, (b) what was being done to it, and (c) the drive being kept secure from interference from (a) onwards, it must be treated as suspect. No matter how honorable the intent is. Intent is worth shit, and any company or researcher that would be foolish enough to enter this "challenge" would be tainted with same.

Re:it is PR

[Liquidrage]

From time to time we (meaning "where I work") have had companies recover data from disks.

I assure you, the PR from the contest means nothing. You either need their services or you don't. It's not like a new pair of sneakers that you might want but not need.

Also, this contest has no bearing on whether they are scams or not. If they (meaning "companies that charged us for data recovery") recover data, which they have for us in the past, and we're satisfied with the result and cost, this contest won't change that.

Re:it is PR

[ShieldW0lf]

This is bullshit. The terms of the challenge indicate that you cannot disassemble the drive. Real life does not operate under such arbitrary rules, therefore, a failure to meet this challenge does not in any way establish that you cannot recover data from a drive that was treated in this fashion. All it establishes is that 3 random data recovery services are not confident in their ability to use the electronics integrated in the drive to recover the data off the platters. Or, they're not interested in participating in some contest because they've got paying clients to service. Can the data be recovered in a clean room with highly sensitive specialized tools? Who knows?

Re:it is PR

[Isotopian]

That's why he released an encrypted version of the image showing the actual filenames he's asking for as proof. You can download it yourself, and then he's going to release a key to the public if someone completes the challenge, allowing you to view the results. Simple. No fakery involved.

Re:it is PR

[KillerBob]

Bingo. It's also worth pointing out that the $40 prize offered isn't even close to the normal fees that such companies charge to do data recovery. The cheapest fee I've *ever* seen quoted for a post-format recovery was $1700, and that was a special offer being made to our customer care because of a tech. support fuckup. (they didn't tell the customer that reinstalling the OS would delete all their pictures, and the customer raised a stink).

Such a "title" as the one offered by this so-called "challenge" is hardly worth the effort expended. Especially considering that this article is the first I've heard of it... How is this Slashdot-worthy?

Re:it is PR

[Chaos Incarnate]

There's absolutely no evidence that the drive he ships out is the drive shown in the screenshot after exactly one iteration of dd and no other operations of any kind.

Re:it is PR

[arth1]

Encrypted by whom? Oh, that's right, by him.
Sorry, encryption doesn't lend any kind of credibility to the claim at all. That only makes it harder to change the list from now on, but doesn't validate that the list was correct in the first place. What would be stopping him from zeroing one drive and provide the list from another drive (or make one up), and then encrypt the wrong list? There's no verification process in place, which causes the addition of this encryption step to smell of snake oil, making it slightly less believable than if it had been all in the open.

I'm sorry, but you're taking his word on faith. Which is a very wrong thing to do, even if he is right. It's not the amount of money in question that's the big problem here, but the lack of accountability.

Re:it is PR

[temcat]

The terms of the challenge indicate that you cannot disassemble the drive.

Have you actually read the terms?

"If the challenger is an established data recovery business located in the United States of America (We would need to see Articles of Incorporation, a current business license and one other form of business identification in order to determine that they are indeed a professional, for-profit, established data recovery business) or a National government law enforcement or intelligence agency (NSA, CIA, FBI), then we will allow these type of organizations to disassemble the drive and to keep the drive for thirty (30) consecutive days. "

Re:it is PR

[someone1234]

You mean, you had your drive 'accidentally' overwritten by zeros using the dd utility?
Or what?
Obviously the issue here isn't about recovering data from a hd failure or accident.
Also, reputed data recovery firms (who got a cleanroom, for example) were allowed to do all their high tech woodoo, so it isn't an excuse either.
The only valid argument is that this contest doesn't worth the hassle (not because of the meager price), but because of the meager publicity.
Otherwise it is fine.

Re:it is PR

[Kent Recal]

The other "excuse" would be that this guy offers zero proof that they has ever been any data on the drive whatsoever. He could be handing you a drive that never contained any data and then point fingers at you, calling you "fake recovery company".

Seriously, how is this news? Nobody will ever take this serious.

Re:it is PR

[hobbit]

What concern is it of theirs whether or not you're incorporated or a government agency or whatever? If you're prepared to lose your deposit, why can't you open the drive? Seems like a completely arbitrary condition to me.

Re:it is PR

[FLEB]

Well, if a firm thinks they can recover files after a one-round zeroing, they can replicate the challenge themselves, document the entire process to the proper degree, then try the actual challenge to see whether it works the same. If it isn't, it's merely a matter of producing the evidence of their own in-house success and questioning the discrepancy.

Re:it is PR

[ComaVN]

The way I read it, he's not trying to prove recovery companies are fake, he's trying to prove it's not possible to recover the data in the first place, and people shouldn't destroy perfectly ok drives with grinders, thermite, etc.

None of those 3 companies claims to be able to recover the data. Are there even companies who do claim to be able to do this with any kind of success rate?

Re:it is PR

[Predius]

By telling data recovery companies they can't disassemble the drive, he locks out all the tools that would be able to recover the overwritten data. They don't perform that recovery by relying on the drive's electronics and read/write hardware, they use their own to mount and read the platters. This is rigged.

Re:it is PR

[igny]

Why they did not accept the awesome prizse of $40 is beyond me.

Re:it is PR

[toddestan]

That wouldn't prove that the drive isn't a fake, if his goal is to have an unwinnable challenge in the sense that it's a completely empty drive that never had anything on it. He would never have to release the key then for the encrypted image.

Re:it is PR

[cjanota]

He said that individuals could not take apart the drive. He did say that data recovery firms and gov't agencies could take apart the drive and have it for 30 days.

Re:it is PR

[Anonymous Coward]

How could you miss the bold and underline font which states that if you are a company or gov org you can disassemble the drive and keep it for 30 days??

here it is again since you obviously missed it the first time:

If the challenger is an established data recovery business located in the United States of America (We would need to see Articles of Incorporation, a current business license and one other form of business identification in order to determine that they are indeed a professional, for-profit, established data recovery business) or a National government law enforcement or intelligence agency (NSA, CIA, FBI), then we will allow these type of organizations to disassemble the drive and to keep the drive for thirty (30) consecutive days.

Re:it is PR

[Rockoon]

3. Accept the challenge and lose, thereby destroying your niche market business.

Challenges such as this are not accepted by commercial enterprises because there isnt much to gain, but a lot to lose.

Re:it is PR

[William-Ely]

Actually we open the drive and replace the heads directly if that's what's required. Removing the platter stack is a very high risk move. This is especially true if the drive has multiple platters. The only reason I can think of to do that is if the motor fails.

The only way I can think of to complete their challenge is to hack the firmware of the drive so the head/track alignment is just a little off so maybe the heads can pick up a residual trace of the data. Even then I think it's too much effort to bother with.

Re:it is PR

[1u3hr]

it. The terms of the challenge indicate that you cannot disassemble the drive.

No, they do not. I suspect he has changed the terms since the original posting, as it is certainly no the case if you RTFA now.

Re:it is PR

[amorsen]

The only way I can think of to complete their challenge is to hack the firmware of the drive so the head/track alignment is just a little off so maybe the heads can pick up a residual trace of the data.

Not so long ago you could do it (very slowly) with a good microscope, but these days you would need a resolution around 100nm. A magnetic force microscope could possibly do it, if you had thousands of years for the project.

Re:it is PR

[qubezz]

The 'challenger' should at least spend $5 bucks and swear to a notary public that the drive is as represented to alleviate the above concerns...

I think one other oddity with the challenge is that the challenger wants the file name recovered, not the data in the file. rm filename or del filename by itself will make the file name unrecoverable if the first character is unguessable ('filename' will be renamed '?ilename' in the FAT when the file is deleted.)

If recovering just the filename is this challenge, I have a much more trivial drive preparation, not so confusing, that will still take deep recovery:

1. buy sealed drive (0's from factory).
2. Write a single byte to be recovered to the '0' position of the drive.
3. Write 0x00 to that byte
4. Now, there are 256 possible values of the byte but you only get one guess.

Recovering a single wipe drive would involve at the minimum tapping into the analog output of the drive head and recording the output with a very precise ADC as the drive reads each byte multiple times, or having a custom board specific to that drive that can do the same. Not going to be done for the now $500 prize. Then there is the physical question that the challenge really asks: if the near-quantum level sub-microscopic magentic domains on a modern perpendicular hard drive can even store more information than a single bit.

Re:it is PR

[SoopahMan]

I disagree on free advertising. Consider these 2 headlines:

A) Data Recovery Company Recovers Data

B) Data Recovery Companies Fail Basic Data Recovery Challenge

The first one will never get written. That's like publishing an exciting article about Google successfully returning a search page. It isn't news. But the second one is negative AND notable. So a Data Recovery company has absolutely nothing to gain by this poorly conceived contest.

I think whoever's put this contest together is trying to put a contest together on the cheap, and - big surprise - it isn't working. Slashdot has listed a lot of contests suffering from this condition, like NASA's ultra cheap prizes for things that would cost massive amounts of money to accomplish. They'll always fail.

Re:it is PR

[DavidTC]

No one saying they're scams, you tool. Plenty of people successfully use them every day. Some are people who don't know how to image a drive and search for data on it, but, hey, not everyone is a computer expert and piecing together files does take time and tools. And some people who had a drive physically fail, and even geeks will admit that's a very valuable service to be able to swap out drive motors and controllers.

Granted, most computer geeks think they're overpriced, but most computer geeks think all computer services are overpriced. (This is because geeks forget about profit and overhead and location costs and advertising and liability and all sorts of junk.)

No, this guy is saying that the idea they can recover overwritten data is just wrong. That no one can, in fact, recover data that was overwritten just once.

He is not alone in this theory. There are a lot of security experts who believe it, and the guy whose original paper started that idea that drives should be overwritten 35 times has explicitly stated he was, as the paper said, talking about old MFM drives, not modern drives.

Not so crazy

[poptones]

Duh. And data recovery companies probably get a good bit of business from law enforcement - who would be very upstet at such a security breach. So, duh, they win 40 dollars and some lame title and lose millions in business.

But it doesn't matter anyway. My friend's house got broken into while his mother was in bed. They were right in her bedroom and stole her purse which had 3000.00 in it. They got prints off a GLASS tabletop and sent them off, apparently to the cornfield. It's been nine months and no one has replied.

It seems very unlikely the police are going ot be interested in you unless they strongly suspect you have been very, very bad. Perhaps if its a very high profile case or you have enough money they actually stand to recover their investment in the investigation they might actually do some of this high end stuff. Most people simply aren't worth more than "high end" script kiddie efforts at data recovery, so it's all moot anyway.

Ill make a guess.

[Creepy Crawler]

File "8890 KB" name is alpgen_w1jet_pt20_r07_245.tar

Am I right?

This story comes 48 hours too late.

[txoof]

I've just spent the last two days with a POS gateway, Knopix and many, many hard drives dangling out of the case while I write randomized cruft to the 600 some gigs of old drives.

I guess I have to take the author's word for it that the recovery companies refused to work on the drive and disregard the "conventional wisdom". I'm really tempted to format one of the drives, dump some data, dd it and see if I can pull anything worth while off of it. Has anyone tried this themselves with any of the forensics tools out there?

Well, I'm almost done with all the old drives; I might as well finish up the project.

Re:This story comes 48 hours too late.

[42forty-two42]

Writing data to the drive once is always going to be enough that you can't just 'dd' it back out. As far as the drive is concerned, all that randomized cruft, or indeed a long string of zeros, is perfectly valid data that it must preserve, so it's not about to return other data instead (unless it's malfunctioning in an interesting way, in which case you have other problems). The question is if you can do better with specialized equipment... but the prize isn't enough for it to be worth it.

Re:This story comes 48 hours too late.

[John Hasler]

Use your head. The drive elcetronics, by design, can only read back what they themselves wrote most recently. How else could the drive be of any use?

Are any of your secrets worth the cost of disassembling the drives and analyzing the disk surface with special equipment? If so, destroy the drives. If not, zero them with dd and be happy.

Re:This story comes 48 hours too late.

[Cillian]

No chance, presuming by "forensics tools" you mean software. Unless the drive firmware has some way of telling you the analog value of the individual bits, which I doubt it does, it simply isn't possible without at least opening up the case, and a lot more very difficult work.

Re:This story comes 48 hours too late.

[EkriirkE]

They just might - ever watch the screens in SpinRite? Supposedly the graph screen shows an analog "strength" of the flux
http://www.grc.com/srrecovery.htm

Re:This story comes 48 hours too late.

[Anonymous Coward]

But everyone knows that Gibson is The Last Living Human who knows teh Machine Code (echo echo echo). So whatever he says must be true.

(No actually, what I think spinrite does is slightly different- it uses the fact that getting ones and zeros off the drive is inherently fuzzy. So it starts reading chunks of data in. If it encounters a chunk that somehow seems suspect, it reads it a million times and hopes to get the actual information once in a million.

The "maintenance" mode of it just reads and rewrites the data to keep the bits "fresh". Everyone has had a drive that one day quit booting. That's because the MBR was written once, a long time ago, and has started to "fade". Rewrite it and it's good for another few years.

Prize

[FooGoo]

Hmmm, you get to keep the drive if you win which also means you get to keep any data recovered. If it's filled with pirated music that could add up to a lot of money at $750 per track.

Is this a scam, or do they just think we're idiots

[Geoffrey.landis]

God god, you'd have to be an idiot to take that challenge. You pay them sixty dollars for the "privilege" of entering the contest... plus paying round trip shipping... and that gives you a chance to win... forty dollars!

(plus an obsolete hard disk, list cost sixty dollars, resale value about five dollars)

Once in a lifetime marketing opportunity

[Anonymous Coward]

The company which demonstrates this ability would be internet legend. It would be named in every discussion about recovery and safe deletion schemes. Too bad it can't be done.

Re:Once in a lifetime marketing opportunity

[bluelip]

The folks that can do this aren't closely interested in what few comments a bunch of /. folks can make about them.

Get a clue. If an organization does this type of work, 1st they're not going to advertise it. 2nd they'll have so much work, they don't need to advertise.

Wake the hell up and get out of VB and java land.

Re:Once in a lifetime marketing opportunity

[bigstrat2003]

If an organization does this type of work, 1st they're not going to advertise it. 2nd they'll have so much work, they don't need to advertise.

And how will they have achieved the ability to get so many customers without advertising first, oh great and wise master?

Re:Once in a lifetime marketing opportunity

[bigstrat2003]

I can safely say that you're an idiot at this point.

First: I don't think an endorsement from /. is going to help them, and never did. Second: at no point did I say something to insinuate that /. is full of great minds (indeed, watch any Apple topic here, and you can see proof to the contrary).

And you still are persisting in this astounding contradiction: these places will have tons of business, but will have that without advertising. How, exactly, do you propose that their customers hear about them? Remember, word of mouth advertising is still advertising. I'll save you a step: they can't get customers unless they advertise in some form or other. Every new business needs to advertise.

Re:Once in a lifetime marketing opportunity

[hobbit]

You're an idiot.

Here's a thought experiment for you: imagine there is more than one data recovery company in the world, and you need to decide to which of them to entrust opening your drive (which if they get it wrong will zero your chances of ever getting your data back). How do you decide which company gets your business?

Of course, the "do not open" (unless, arbitrarily, you're a US corporation or government agency) rule is one of the main things wrong with this "competition"...

Re:Once in a lifetime marketing opportunity

[Anonymous Coward]

What if you don't need "business" because you're in-house, say at a government agency? That's the ultimate cop-out: "The spooks can do it and they aren't talking." Lots of people fall for it when you substitute "enemy" for "spooks". It's a money maker for defense contractors all over the world.

Re:Once in a lifetime marketing opportunity

[hobbit]

What if you don't need "business" because you're in-house, say at a government agency?

That's not what bluelip is talking about.

This proves nothing...

[m6ack]

Forensic companies typically charge much, much more for their services than $40.00 -- THE REWARD IS A JOKE IN AND OF ITSELF. It is also not in their interest to prove that they can do this... as it could result in really bad PR for the company -- or business entanglements and liability that they may not be willing to enter into.

They should offer this challenge up to hackers.

Imagine a reference design of a freely available data recovery tool up on "http://freshmeat.net".

Contributed by AC

[PotatoSan]

I wonder what the chances are that the anonymous contributor of this "news item" is 16systems themselves? What an excellent way to raise publicity for their "contest" with a terrible prize that would net them some valuable information!

Send me your drive now

[Anonymous Coward]

I will check that you have deleted all personal and private data and tell you anything which could be potentially used by others (not me)

This will sound totally paranoid, but

[bill_kress]

The few people who MIGHT have the capability to look beyond what is written on the drive and see patterns remaining from previous data are most likely the ones who would prefer that the concept remain vague and unproven.

Sounds like the Conservapedia Challenge

[gardyloo]

And it will likely be ignored for many of the same reasons. http://www.conservapedia.com/Conservapedia_challenge

Eh

[OverlordQ]

A graduate of Virginia Tech (Phi Beta Kappa 2000), Brad has experience in systems administration, systems programming and IT management. Today, he primarily works on IT security reviews and writes programs such as Find_SSNs. Brad also assists with incident response, computer forensics, departmental database design and management, and works with students in the IT Security Lab as needed. He holds the SANS GCFA (computer forensics certification) and the GIAC STAR Payment Card Industry certificate.

I think somebody needs their money back from their forensics certification.

Advertisement

[Anonymous Coward]

This whole submission sounds like an ad for '16Systems.' None of the data recovery agencies have accepted the challenge! Only four months remain! Can YOU recover the data?!

Please.

Prize Management 101

[meekg]

Contests have entry fees.

For $100, the entry fee will pay for the cost of the drive and shipping, so drive disassembly should not be an issue.

Nobody plays a game like this for the prize cash, but for the bragging rights.

The disk should have had on it instructions on how to retreive the money. Like bank account information and access code.

So.

[Anonymous Coward]

Sorry, that's completely false. If Microsoft or Google or NSA or CIA put this out, then people would be scrambling to do it for free. The unfortunate reality is that you're not big or famous enough for people to care.

One way to gain attention other than being big and famous is to throw a lot of money at it. $40 is not a lot of money despite how many pizzas it would buy.

Re:So.

[KDR_11k]

Fame also gives people a sense that the challenge was conducted properly, if an intelligence agency or military group runs such a contest you can be sure they're using situations you actually encounter on the field... except those groups only create contests for things that can't be done yet in order to make people find a way.

Re:So.

[ion.simon.c]

Mmm.
That's four pizzas... if they're cheap.

That's not a lot of pizzas.

Real price is $700

[SuperKendall]

$300? That's for running what's pretty much an "undelete" like any shareware program can do.
$3,000, and you might get what amounts to a sector dump.

Not at all true. I priced this out for a friend that had removed data beyond what the simple undelete commands you mentiioned can do. The real cost is more along the lines of $700, and you get real data files back.

$3000 is more along the lines of, the actual physical disk inside the case has been disturbed and you are talking about recovering whatever data you can. That starts to get real pricey, really quickly.

Real Problem...

[Anonymous Coward]

If it is possible and as difficult as said, why would someone give up their secret?

"You also must publicly disclose in a reproducible manner the method(s) used to win the challenge."

Re:Real Problem...

[Raseri]

It's because he fucked up another drive that actually had important data on it, and he wants to use the methodology to recover the data from that drive without paying thousands of dollars for a professional data recovery service. That would be my (admittedly cynical) guess.

Smells like a scam...

[Anonymous Coward]

1. Buy a $50 hard drive.
2. Sell it for $60 in some competition with impossible terms.
3. ???
4. Profit.

Relocated sectors

[Anonymous Coward]

Many drives logically relocate bad sectors when media errors occurs. Note that after this - no DD command will be able to override the previous physical location of the said sector. Potentially, someone can perform physical scrutiny in order to retreive the data from those sectors.

 

Where in the hell...

[John Hasler]

...did these guys get the idea that anyone who knew what they were talking about claimed that it was possible to recover data from an overwritten drive without taking it apart?

Re:Where in the hell...

[ToasterMonkey]

These guys also think it's just a myth passed around by word of mouth. The US DoD still today requires multiple overwrites or destruction, and that sure as shit isn't just for the fun of it.
That probably means that other governments (most likely us as well) have the capability to recover some of this data if it were important enough.

We can guess all we want who can do what how quickly, but there's a whole lot of information outside of the DoD that might be wanted by the organizations with the capability of recovering it.

16 Systems a FRAUD??

[sciop101]

Anybody find an archive of the "The Great Zero Challenge"?

16 Systems website looks like is a web-page assignment from an 1980's HTML tutorial.

The services listed are BASIC/Javascript end-of-chapter exercises.

Re:16 Systems a FRAUD??

[innocent_white_lamb]

He doesn't even seem to realize that naming his initial webpage file index.html would be more professional than redirecting to main.html
 
It's a pretty poor excuse for a web page and, as you said, it's a pretty poor excuse for "services", too.

Re:16 Systems a FRAUD??

[jonadab]

> website looks like is a web-page assignment from an 1980's HTML tutorial.

That would be a neat trick, considering that HTML was first put forward in the early nineties (1992, IIRC, though most people, even most people with internet access, were not aware of it until more like 1994).

NSA

[Nom du Keyboard]

You mean the NSA's entry hasn't arrived yet?

I suggest that the drive to be tested be the one with all the Chinese gymnasts original birth certificates on it.

voting

[cbr2702]

Coming back to slashdot after reading reddit for a while, it is a very weird feeling not to be able to vote on posts.

I just threw out a hard drive

[PingXao]

A 2.5" 30GB laptop unit. It had Firefox stored passwords on it and other things I would consider "personally classified". I got what I needed off of it and used dd to zero it out. Took quite a while to run. When it was done I tossed it in the dumpster. Am I worried? Not one bit - and I didn't need this article or the original TFA to tell me that.

IMO every "security" solution for sale in the computing sector has some degree of snake oil and hype attached to it. That goes for anti-virus software and software firewalls as well. The best products are the ones that get almost no attention because they're free, like GPG.

Re:I just threw out a hard drive

[jonadab]

> It had Firefox stored passwords on it and other things I would consider "personally classified".

Yeah, but while it would be inconvenient for you if someone got those things, it's not worth a huge amount of money to anyone to do it. Your personal passwords just aren't worth the kind of effort (and money) that would be needed to do extreme forensics. That doesn't mean there isn't such a thing as data that would be worth that kind of effort and expense to someone.

If I had to dispose of a drive containing, say, the full design schematics for a new and highly classified model of covert surveillance satellite that my company was planning to sell to the military for several billion dollars a pop, I'd wipe the drive a few times with random data, then take it to a metal shop and grind it to the consistency of talcum powder, just on the off chance that there *might* be some highly-funded company or agency capable of recovering any of the data from a drive that's merely wiped. Then maybe I'd blow the dust through a fan from a few thousand feet over a large body of water, on the grounds that it changes the odds of recovery from mere total physical impossibility to something more like absolute unimaginability. I mean, in a situation like that you just want to be more than a little bit certain.

But yeah, if it's records of my personal finances (which come to five digits), email from friends, some passwords for a few web services and things, and maybe a couple of credit card numbers, I'd probably just reformat the drive with a different kind of filesystem and let it go at that. (I'd probably format it NTFS, since that's the most common filesystem that I never use myself. Though I might format it FAT32 if it was previously something else.)

Your level of paranoia may vary, depending on the value of your data.

Dear sir,

[mypalmike]

Kindly sir, I am a Nigerian Prince trying to transfer some data from a zero-ed out hard drive to my cousin in the U.S.A. If you would kindly deposit $60 into my bank account, I will send you the hard drive. Upon your transmission of the data to my cousin, I will promptly return your $60, plus $40 for your effort. You may also keep the hard drive.

Your friend,
Prince Njeme Nawabi, P.O.S.

Why negative?

[Anonymous Coward]

Agenda? Unless he is able to make money out of this 'scam', what other motivation is there? And going by what he has described, I do not think he is making money here.

On a more general level, I see a worrying trend here - most of us here are taking a negative position very early whenever something like this comes up. Sure, there is always a possibility, but why start on negative? This is not a story on Creationists, for example.

Re:Why negative?

[Goaway]

"Agenda" does not mean "profit motive".

Re:Why negative?

[Anonymous Coward]

I understand that, and that's why I asked "what other motivation".

Re:Why negative?

[arth1]

Agenda? Unless he is able to make money out of this 'scam', what other motivation is there?

His 15 minutes of fame. And quite possibly the psychological bootstrap effect of feeling superior by demeaning others.
There's nothing in it for him if he's proven wrong.

As for "being negative", it's usually the responsibility of those making claims to prove them. Yes, we should be skeptical of any claim. Whether it's a claim that we like or not.
Perhaps especially if we're inclined to believe the claim.

Re:Why negative?

[ultranova]

Yes, we should be skeptical of any claim.

Prove it.

The Great Hammer Challenge

[lophophore]

I generally decommission hard drives with a sledgehammer and an anvil. I feel safe that my data cannot be recovered by anybody, including 16-Systems, all the data recovery companies, and agencies of the US Government.

However, if you would like to prove me wrong, send me $60 (which I will refund when you return the remains of the drive). If you can read my browser history (saying "you looked at Slashdot" is not going to do it) I will provide you with a tasty BBQ sandwich, the likes of which you have never had before. And you get to keep the baggie of crushed hard drive parts.

Seriously, the data recovery people are in business to recover **accidentally** deleted or damaged data. Deliberately deleted is another story all together.

Re:The Great Hammer Challenge

[Anti-Trend]

Seriously, the data recovery people are in business to recover **accidentally** deleted or damaged data. Deliberately deleted is another story all together.

Disclaimer: I'm not intending to create a flame war here, merely proposing something to think about.

There are plenty of scenarios where one could accidentally zero their HDD's. It is indeed destructive, but there are much worse things to do to one's data (theoretically of course). I routinely zero drives which I know have been present in software RAID arrays before re-adding them to different arrays. This is to be absolutely certain that the disc will only have the superblocks its supposed to have and not leftover ones from memberships in old arrays. With this in mind, if after a 3:00am firefighter session somebody accidentally dd'd a healthy disc instead, things could get ugly. At that point, calling a data recovery company to recover data from a zero'd disc might be warranted.

Obvious rule change needed

[istartedi]

They should allow disassembly of the drive. Presumeably, if it's possible to recover the data, you need to use something other than that stock read/write head. Somebody else mentioned electron microscopes. Not sure what you'd see with that. Can you see magnetic domains with an electron microscope? Maybe that's how the real spooks do it.

Submitted by an AC?

[pz]

This story was submitted by an AC.

Why would you submit a story as an AC? To hide something.

What on earth is there to hide in this story? Either the very posting of it (say your employer doesn't condone spending time on Slashdot), or the authorship of the story.

As the story itself reads suspiciously like advertising copy, it is tempting to conclude that it came from 16systems.com, the sponsor of the contest.

Nothing to see here, except the Slashdot editors falling asleep at the wheel again.

So pointless...

[Vrallis]

If you're just talking about recovering a bunch of social security numbers or your husbands porn stash, fine, this is a perfectly good challenge.

If you're talking about protecting the latest nuclear warhead plans or the names of every spy your country has in operation "nuke it from orbit, it's the only way to be sure." Data recovery companies are not your threat. Your threat is a government agency that can dismantle the drive and use customized read heads to read the magnetic variations across the area of a single bit.

And, of course, a government agency is sure as hell NOT going to volunteer for this experiment, thus alerting the world to the fact that "dd is not enough."

And, of course again, if your data really is that sensitive, you're almost certainly already under the "nuke it from orbit" set of directives, because you know better.

Something smells funny

[93 Escort Wagon]

This doesn't pass the smell test. It seems analogous to the crackpot who runs around screaming "Every PhD geologist is scared to debate me! They know I'm onto their dirty littlc secret - the center of the earth is made of chewy caramel!"

The point is that "fear of losing" isn't the only possible reason for this "challenge" not being taken up. It's equally likely that commercial data recovery entities see this as a completely pointless waste of their time. Is this "16 Systems" an actual known entity, or is this just yet another Slashdot submission where someone is trying to shill their unknown company?

Huh?

[Quiet_Desperation]

According to our Unix team, there is less than a zero percent chance of data recovery after that dd command.

What does a *LESS* than zero chance mean? Is it some quantum thing? It's so well erased that it's gone beyond mere zeros and into a realm of strange probabilities and potentialities of data that never was or possibly could have been? Could all the results of the alternate decisions in my life be revealed by erasing my drive having someone try to recover it?

Re:Huh?

[amorsen]

The kind of service which involves taking the platters out and connecting better electronics is that expensive. I am not sure any of the recovery companies offer that anymore, and the price would probably be at least 5-digit.

Re:Huh?

[Mascot]

Granted, it was a two year old article, but one of the companies around where I live would remove platters and attempt recovery for less than $2000 at that time.

That's no money at all to a company, and managable for a private citizen if the content was really important to them.

Re:Huh?

[amorsen]

Granted, it was a two year old article, but one of the companies around where I live would remove platters and attempt recovery for less than $2000 at that time.

Would they do anything beyond putting the platters in a new drive with the same model electronics? For the challenge, you need to do better than what the regular electronics can do.

Re:Huh?

[Mascot]

I can't answer that I'm afraid. I just don't know. I do know they have the technology and knowhow, but not whether that price quote included using the expensive machinery.

you may not..

[Anonymous Coward]

disassemble the drive???
WTF, how are they expecting to get recovery.. this sucks, its unfair.

Wrong interpretation

[Poingggg]

If my interpretation is correct, you're still $20 behind [....] since if you win you get to keep the drive, but apparently aren't refunded your $60 deposit.

Wrong interpretation! From TFA:

If you damage the drive, then your deposit will not be returned.

So, (if MY interpretation is correct) you will always get your deposit back if you return the drive in good order or win.

But I have to agree that it's not quite the amount of money I'd do it for, even if I were able to.

Re:Wrong interpretation

[d_jedi]

You also have to pay for shipping back and forth, though.

Re:Wrong interpretation

[dotgain]

Mine is an interpretation, yours is an assumption. Situations resulting in you not getting your deposit back are almost certainly not limited to damage of it. What about taking longer than 3 days? What about simply refusing to return it?

However the condition specified for receiving the deposit is return of the drive - which you won't be doing if you win it.

Hell, for the pathetic amount of money, I'm considering paying the depost, receiving the drive and simply keeping it, just for shits and giggles.

$40? Are you kidding me?

[cmay]

Who is going to enter this "challenge" from some random website for the chance to win 40 bucks? Even if I had a program that I knew 100% would work, I wouldn't be worth my time to plug in the drive and run the program for 40 bucks. Stu...pid.

Data can be recovered ...

[Skapare]

... if using older recording technology that has gaps between tracks and records zeros in raw form. Today's recording involves multi-level coding and scrambling, where even all-zeros will have a big mash-up of flux values, and overlaps the gaps to some degree.

If that 80 GB drive that had been zeroed-out with dd had recorded Osama bin Laden's exact location, you can be sure the data recovery experts at certain nameless US government agencies would scramble to get hold of that drive, regardless. And it would not surprise me if they can recover some data from it. They would not be worried about getting their $60 deposit back, and the drive will likely be destroyed as a hard drive as we know it. The tab for such recovery could be in the millions of dollars, but for that kind of data, it would be worth it.

Is the data on your computer with that to someone?

Prize?

[Vertana]

The prize has nothing to do with this. It's simply a proof of concept trial showing that data recovery is mostly FUD (especially in the case of a seized computer).

NSA claims to have this

[tjstork]

My mom attended a litigation support conference where NSA actually claimed to be able to read a drive's contents after SEVENTEEN zero overwrites. Who are they though... just another multibillion dollar spy agency affiliated with the very guys that actually invented computers...

Re:NSA claims to have this

[cduffy]

My mom attended a litigation support conference where NSA actually claimed to be able to read a drive's contents after SEVENTEEN zero overwrites.

Along those lines, I once knew a professor who claimed that the NSA was doing automated keyword scanning on the national phone system in the late seventies. There's quite a lot of uncertainty about just what their capabilities are and aren't... and presumably they like it that way.

Re:NSA claims to have this

[Firehed]

"Claimed" being the operative word here. Did she see the data that they claimed to recover? If so, does she have a way of knowing for sure that they didn't just make up this data to incriminate someone and claim it was recovered from somewhere? If not, then for all anyone knows they were just spewing buzzwords from their multi-billion dollar anus and hoping that was sufficient to make people believe they weren't just flat-out making shit up.

I have no idea what they are and are not capable of doing in terms of data recovery, but I know they ARE very capable of lying and incompetence, so I'm not alone in taking anything the NSA claims as truth with a grain of salt.

Re:NSA claims to have this

[Anonymous Coward]

I have no idea what they are and are not capable of doing in terms of data recovery, but I know they ARE very capable of lying and incompetence, so I'm not alone in taking anything the NSA claims as truth with a grain of salt

Abso-freaking-lutely. Indulge me a brief anecdote...

I was recently speaking to a military buddy who is involved in IT security for his branch. He claimed that the NSA had recently briefed him and a bunch of his peers about new technology which allows them to hack a computer through the port lines, even if the network cable is unplugged. Of course, this is complete and utter horseshit. You're lucky if a lot of the cheaper power supplies even supply wattage, let alone some phantom networking capability. Total misinformation.

Re:NSA claims to have this

[colmore]

They're also partnered with a lot of private interests that have a big $$$ stake in being able to make those kinds of claims to the people who pay the bills (presidents and congress). That particular claim COULD be true, but the military and intelligence community overstate their capabilities and fudge tests all the time. It's one of the major downsides of the privitization of security.

find the weakest spot

[Anonymous Coward]

Maybe - just maybe - they used a weak passphrase for the encrypted answer? *grin*

Last time I checked...

[denzacar]

Files and folders WERE copyable.

Like... to a more than one hard drive. Each of which could be zeroed. And mailed.

10000

[denzacar]

Well... it IS over 10000 - yen.
If you account the value of the drive too.

Nonsense.

[Jane Q. Public]

The reputation of the challenger has NOTHING to do with the legitimacy of the challenge, which stands for itself. If you were a data recovery company, you would be completely foolish to ignore this.

Re:Nonsense.

[NormalVisual]

If you were a data recovery company, you would be completely foolish to ignore this.

The fact that no data recovery company has taken them up on the offer would tend to argue against that, unless you want to try to assert that *every* successful data recovery firm (an industry that requires a fair bit of both technical and business sense, mind you) is run by fools.

Re:Nonsense.

[jonadab]

> The reputation of the challenger has NOTHING to do with the
> legitimacy of the challenge, which stands for itself.

On what basis? A double dog dare?

Sorry, that might work in sixth grade, but out here in the adult world I think most of the data recovery companies are run by... adults. A challenge issued by nobody in particular just doesn't provide any inherent incentive. Put something at stake that matters, like a well-known reputation, or some substantial money, and it'll get noticed.

Isn't that the POINT??

[Jane Q. Public]

Nobody will take it because they are not confident that they can do it. Q.E.D.

Re:Isn't that the POINT??

[Blakey Rat]

For $40?

I don't do anything IT-related for $40. I'd charge $120 to lean down and press your power button.

Re:Isn't that the POINT??

[Loibisch]

Whow, most people bend over for a lot less...

It doesn't matter!

[Jane Q. Public]

Why are you concentrating on the "reputation" and competence of the challenger? Those have nothing to do with the challenge at hand: a disk drive was overwritten ONCE with zeros with the Unix dd command. Can somebody recover the data? It doesn't take a genius or a big budget to make this challenge. But the fact that NOBODY so far has picked it up DOES say something.

Less than zero

[General Wesc]

According to our Unix team, there is less than a zero percent chance of data recovery after that dd command

According to my math team, probabilities don't go below zero percent.

If you could would you?

[petermgreen]

I would think if you were running an intelligence agency or similar and had the ability to retrive erased data from modern hard drives you would make sure that information about that ability (both the fact you could do it and how you did it) was classified.

The wires come up to the PCB

[Joce640k]

You can tap into what comes off the read head without disassembling the drive.

As for electron microscopy, would that really get any useful data back? I doubt it. The surface of the drive will be a complete mess and there's an awful lot of atoms there.

These companies don't even know what an

[LM741N]

Electron Scanning Dildo is, let alone an ESM. (Hey don't knock it till you tried it- its that HV tickle that really gets you.

Re:Cost

[Anonymous Coward]

You're forgetting the cost of their resources and what they could be earning doing a real job instead...a little more than shipping!

Get real.

[Jane Q. Public]

The X prize was NOT about the money! Do you honestly think that Mojave and Scaled Composites actually even made their money back by winning the X prize??? If so, you need to sit down with a calculator and re-think a few things. (Answer: no)

It isn't about the money! It is about what is possible and what isn't, and the reputations of those who show what the truth is. Virgin, Rutan, et al. will make a fortune. But they sure as HELL did not enter the contest for the prize money. To do so would have been stupid.

So, why did they do it? The answer is obvious, and I won't even bother to put it here.

Re:Get real.

[mollymoo]

Why did nobody do it before there was $10m on offer then? As soon as there was, people were queuing up. It may not be about the money, but you need the money so that if you win you are at least guaranteed not to have made a loss. You need the money so people take you seriously.

Says who?

[Joce640k]

There's not one shred of evidence that anybody ever has recovered a single bit from an erased drive.

As for "only governments, blah blah" ... governments don't really have equipment or expertise that top universities don't have.

Re:Says who?

[dlgeek]

Governments typically give a lot of money in research grants to top universities and have lots of influence over them...

Critical line in the Challenge:

[Morosoph]

You may not write any data to the drive or disassemble the drive.

So you're not allowed to (for example) exploit redundancy or error checking on the drive itself? If dd wrote zeros, that's what'll be read unles you can get "lower" than normal drive access.

This challenge has nothing to do with the security of your wipe. Rather, it has everything to do with dd successfully writing zeros given normal access.

Re:Critical line in the Challenge:

[Molochi]

Yeah, when I saw that you weren't allowed to disassemble the drive, I knew they weren't challenging anything more than script kiddies and their corporate equivalents.

This "what do I need to do before I chuck a hdd" conversation has come up before. I'll ask, "How many dollars do you want somebody to spend to get the data?" They, almost invariably respond "I don't want them to be able to get any data." My response usually involves renting a shotgun/smg and some rangetime.

Re:Critical line in the Challenge:

[anilg]

RTFA, they specifically allow disassembling by data recovery organisations and the 3 letter ones to.

Re:Critical line in the Challenge:

[1u3hr]

You may not write any data to the drive or disassemble the drive.

RTFA. (How does someone get modded "insightful" when they haven't?)

That's not in the challenge NOW. It was some months ago, as he didn't want to supply a unlimited number of drives for people to trash, but now the drive does not have to be returned, you can do what you like.

Re:Critical line in the Challenge:

[Anonymous Coward]

They are pretty sloppy, they should have used the internal drive command "enhanced security erase" instead as specified by T13 commitee:
"When Enhanced Erase mode is specified, the device shall write
vendor specific data patterns from LBA 0 to the Maximum LBA reported in DEVICE CONFIGURATION
IDENTIFY data words 3-6. In Enhanced Erase mode, all previously written user data shall be overwritten,
including sectors that are no longer in use due to reallocation."

Source, section 7.43 SECURITY ERASE UNIT:
http://www.t13.org/Documents/UploadedDocuments/docs2008/D1699r6-ATA8-ACS.pdf

Few tools are able to trigger that command, and from what I've heard it's even locked down in some bioses. It's also way faster for the drive to do it internally than manually writing over the drive with external software. For those interested: Secure Erase can trigger the command:
http://cmrr.ucsd.edu/people/Hughes/SecureErase.shtml

How to win challenge without opening drive solved

[Anonymous Coward]

They have provided the simple and easy way to win this challenge and you do not even need to open the drive or even have it in your possession.

They have posted a PGP encrypted file with the answers. Just crack the encryption on that file and find the answer they are looking for.

It's a scam alright

[Joebert]

Only a fool would demonstrate how they could do this and ruin any chances of people becomming comfortable with zeroing drives for a mere $60 hard drive and $40 cash.

Are these guys smoking crack ?

Re:It's a scam alright

[Culture20]

Hard drive physical shredding companies might. Cheaper than some ads.

Re:It's a scam alright

[Joebert]

Something like that actually exists ?
What kind of idiot would hire a "hard drive shredding company" ?

I'd find a reason to fire anyone who did that, that's just a waste of money when you consider how simple it is to destroy a drive.

Re:It's a scam alright

[Culture20]

How simple is it to destroy 300 HDDs at once? Small companies and individuals are not their clients.

Re:It's a scam alright

[Joebert]

Let's assume a 3.5 inch (4 in x 1 in x 5.75 in) form factor, times 300 drives.

So if we stand them on their end side-by-side in a square we would have an area roughly 3 feet by 4 feet to over-estimate.

There's got to be a ton of ways to crush a 3ft x 4ft x 0.5 ft block of harddrives enough to shatter the disks. I'm sure it would be more effective to send someone out with a bunch of drives & some cash to the local recycling plant, or junk yard, or even a store with a garbage crusher and destroy the drives.

Doing it that way also removes the risk of specialists getting their hands on drives and a rogue expert saving any data before actually destroying the drives.

Re:It's a scam alright

[Culture20]

Some shredders come to you with portable industrial shredders and let you watch.

It sure does

[Mascot]

Ok, yes, I agree it says something. Namely, that companies in this field have no interest in a no-name site's seriously flawed challenge.

Remember, they are in the business of recovering data erased or damaged by accident. They have plenty of high profile references showing they are capable of that. You might have a point if this challenge was directed at the creators of disk erasing software, but come on... This challenge is about as serious and professional as me posting "send money pls" in a blog. That is very much relevant to whether a company would take it seriously or not.

I am a bit surprised nobody's come up with a link to a privacy organization's article about something like this though. I have a hard time imagining no organization or newspaper has ever done something similar, then sent the disk in for recovery and reporting the result. For an actually corporation, the money we're talking about isn't worth mentioning.

Never Say Anything

[Detritus]

The people most likely to have this capability are also the least likely to want to publicize that fact. There is also the issue that you don't use the resources of such a facility without a good reason and the funding to pay for it.

Unfounded assumptions

[Jane Q. Public]

Once again, the site is irrelevant. The relevant thing is the challenge. I wonder why you focus on the presenter of the challenge so much when that is not at all important to the subject at hand.

In any case, no. Data recovery services are in the business of data recovery, however it got erased. "Safe-wipe" software is very common these days and some people use it in place of their trash can on a daily basis. It is built into Mac OS X. The ability to recover data that has been overwritten with 0s would be very much a service in demand today.

And you completely missed the point about reputation. A company that proved it could do this would be a company that people would go to. They would gain MUCH more than just prize money; they would gain lots of business.

Re:Unfounded assumptions

[raynet]

Not many people, or even companies, can afford this kind of service, so the reputation gain and business from it would be marginal at best. And those people who have data worth the cost of recovery often have staff who know, or know someone who know, where to send the disk for recovery. And there aren't that many companies doing this level of recover so not much competition there either. Better just buy an article from some computer magazine read by admins and be done with it.

Re:Unfounded assumptions

[Mascot]

Once again, the site is irrelevant.

No, it really really isn't. Not every pimple faced teen's "challenge" published on the Internet will be taken even remotely seriously. As this one is not. If it were a serious publication doing research in a professional manner, it would be different. Even _if_ this site was one that could be taken seriously, the challenge itself has too many holes in it (others have pointed out details on that).

The ability to recover data that has been overwritten with 0s would be very much a service in demand today.

Perhaps. Although I would imagine someone that employs methods of safely erasing has a tendency to make sure before they hit the button.

And you completely missed the point about reputation. A company that proved it could do this would be a company that people would go to.

No, I didn't. A company that quoted that site as a source would have its reputation damaged, not improved.

They would gain MUCH more than just prize money; they would gain lots of business.

That's assuming there are lots of people out there safely erasing something they shouldn't have. I don't work in the business so I don't have any figures, but I would be very surprised if that would be even a measurable amount of their business. Also, it could very well be that it just can't be done, of course. In that case they have even less incentive - if that is possible - to waste time on that challenge.

30 days is nothing

[r00t]

6 months is about the bare minimum.
2 years would be better.

There is a clean-room effort. There is the actual reading of the platters, which is damn slow when you can't use the original head. (since oversampling is needed, this could be weeks or months!) There is the reverse engineering of the insanely complicated encoding. There is the writing of software to fly a virtual head over a virtual disk.

Yes, it can be done. No, it isn't affordable unless the drive belonged to Osama. The effort would require dozens of engineers who already have experience doing the job. You're looking at a price tag of 5 to 50 million dollars.

Re:30 days is nothing

[kesuki]

actually, rather than reverse engineering the whole HDD the easiest thing to do, would be to remove the read/write heads and put an interface up to an read/write head emulator, and give the data back based on the pattern that you believe is the 'original, pre dd' state.

and of course, be ready to tweak that data, repeatedly, preferably automatically until all the file checksums match for all the known files and then play around with the remaining data until you achieve the goal of finding out the name of the file or folder.

but again, the price for doing this is a lot more than the cost of a HDD ($60, although new 80 gig HDDs are now only $25) plus $40 in pocket cash doesn't even come close to the real world cost of trying to recover data from a hdd that has been dded. it's pretty clear the software/hardware on the drive itself is unable to read such data, or else some one would have done it.

also, fully dissecting the contents of a formatted HDD might require peeling off the magnetic material in layers, to get the full pattern, the rules of the contest clearly make that against the rules. because the hd must be working afterwards... peeling the magnetic layers to get the most accurate precise reading of how the metal has been magnetized in the past might be required to get data off a dded hdd.

if someone wants to have a serious contest, offer half a million as a reward for reading the dded data. then someone will try to claim it. $40 is not worth it.

Re:30 days is nothing

[Firehed]

But could they do it successfully? That's all this contest is looking to prove. Now granted I'll give you that it's worth a metric shitton more than the $40 prize, but absolutely needing it to happen doesn't ensure that it will.

The question is then, I suppose, whether if I dropped off some drive from Osama at FBI HQ that had been zeroed out with dd they could recover the data. If so, then obviously dd isn't safe for data that warrants that level of recovery; if not, then I'll toss my copy of DBAN and just grab one of the dozen Ubuntu live CDs and kill data that way.

Of course if it takes two years and $50m, I'd consider it more than safe enough. I'm pretty sure Osama only has a $25m price on his head, and in any case the damage has probably already been done during that recovery period. This kind of thing is really to try and lock someone up for kiddie porn or stealing corporate secrets or whatever.

Re:30 days is nothing

[William-Ely]

I'd mod you insightful if I had the points.

I would connect the original heads to a data logging device and manually control the servo motor. I would also buy an identical drive and recreate their experiment (as closely as possible) up to the point before they run dd. I would use a hex editor to locate the sectors that the data reside in and use that as a guide for where to look on their drive. That might rule out a lot of surface area to scan through.

Anyway, like you said the contest just isn't worth it. Ontrack is a huge data recovery company and I would believe they have put at least a little effort into researching this. If a data recovery company came up with a reliable way to recover a zero filled drive I'm sure it would make the evening news.

Re:30 days is nothing

[r00t]

You have to reverse engineer the **encoding** of the data. The data isn't sitting there in any normal way; it is scrambled and checksummed in multiple undocumented ways.

Obviously you must remove the heads. You'd use a magnetic force microscope. This can give 10 nm resolution. It's terribly horribly awful slow.

Clarification

[Jane Q. Public]

When I wrote "you would be completely foolish to ignore this", by this I meant the fact that they would gain reputation if they succeeded. I did not mean that they would be foolish not to accept the challenge. They are in fact NOT foolish to refuse the challenge, since they can't do it anyway.

Re:Clarification

[Wooky_linuxer]

Heck, you don't get it. First, there is no motivation. I see they upped the prize to U$500, but even then, it is too low. Too low to attract the attention of anyone outside /., too low to pay the wages of the technicians doing the job, too low for anything. 16systems is virtually unknown so there is no "reputation" to be gained.

Secondly, no one can know if these guys are being honest or not. There is no way to be sure that there were actually data on the disk at some point, and that they only dd'ed it once. So why bother?

That said, I'd like to know if it can be done. But we aren't going to know this with a challenge such as this one. That no one has taken it up just proves that the challenge itself is uninteresting.

I agree this is total FUD

[fluffykitty1234]

I love that people are saying things like "well some secret government agency might be able to do it, but they will never tell"...

Ya right. How many man years of R&D go into disk drives every year. How many different types, manufacturers are there?

Every drive I'm sure is similar in operation, but they are all different. So this mysterious government agency would have to become experts in every detail of every device from every manufacturer. Give me a break, the return on investment is way too low. If you have the person that erased the drive, just toss them in gitmo, waterboard them till they talk. Much faster and more economical!

Assuming it's possible to retrieve overwritten data on a disk (which I seriously doubt), the only people capable of doing it are the engineers that designed and created the drive device.

Well, this does exclude Area 52, they have Alien technology that can extract all data ever written to the device!~ They can also extract all of your memories from your brain cells, put on your tin foil hats!

platters can wound kids

[r00t]

Glass platters look just like metal ones.
That have a mirror-like metal coating on them.

When a glass platter breaks, it isn't like
breaking normal glass. You don't get a few
big chunks and a few chips. You get zillions
of needle-like shards. They fly everywhere.

Re:platters can wound kids

[HiThere]

OK. I'll bear that in mind for the future. These were metal platters.

Guess that it's jeweler's rouge with fine sandpaper, and then into the trash, then. Possibly a ball-peen hammer...but if it's lots of glass slivers...well, I'm reluctant to expose myself to that. Possibly put between two cutting sheets (plastic) inside a plastic bag and bend. Guess I'll need more research if I ever get into that situation again. Perhaps pressure cooking would suffice. There'll be *some* simple physical answer.

If they're glass, they might not dissolve sufficiently in acid, but there'll be some easy answer. If nothing else, throw them into a cement mixer with some gravel, let it run for awhile, then add sand, cement, and water.

Re:platters can wound kids

[andy_t_roo]

the most simple way of _guaranteeing_ that the infomation is not recoveralbe is to heat over 1000'c - at that temperature iron stops having a magnetic memory, so the magnetic state it is in when it cools again is unrelated to before.

http://hypertextbook.com/facts/2002/FeliciaLau.shtml

Dumb challenge.

[Anonymous Coward]

So the theory is that when you wrote the original data, the drive head didn't follow precisely the same path across the magnetic media than it did when you wrote zeroes. So maybe 90% of the width of the track was wiped out - but there could be 10% of the original data that's still there.

You can't recover it using the original drive heads because it's a digital system and a signal that's 90% zero and 10% data will read as a solid zero.

But if you open the drive and use a special head and some sensitive analog techniques, you can maybe read the narrow edges of the track and recover the "erased" data.

Writing the data many times probably works because the head takes a slightly different track each time and eventually will overwrite 99.999% of the original data and it can't be recovered.

What makes that challenge UTTERLY STUPID is that they don't allow the data recovery company to open up the drive. That means they can't selectively read the edges of the tracks and they can't recover the data. That make it an impossible challenge - which proves nothing because a determined competitor who wants to see your CEO's spreadsheets can open the goddamn drive!!

So - keep erasing your datas lots of times. Ignore the meaningless challenge results. I wouldn't smash up or even discard your hard drives though - simply overwriting it many times is fine.

Says me

[viking80]

Did you bother to read GP? We recovered data from magnetic storage. An no, not government nor universities.

A much better contest

[davidwr]

A much better contest:

Working with the manufacturer, we have disabled hardware encryption and error-correction - one magnetic domain corresponds to one logical bit. The drive was factory-formatted with a standard pattern which is in the contest materials. Participants willing to sign an NDA will be given additional engineering data for the drive to help them find the tracks with the erased data on them.

We wrote zeros to this drives 10 times, then wrote random data to four complete cylinders spaced evenly on the drive, then wrote zeros to the entire drive. Contest materials include the exact cylinder numbers that have erased data.

Prize #1 - 50% recover in a sector-sized area

Prize awarded to the first team that recovers more than half of the bits in any consecutive 4096-bit area of any track on the disk. 4096-bits correspond to one sector but the prize will be awarded even if the recovered data crosses sector boundaries.

Prize: Up to $100,000 based on the amount of data recovered: $50,000 for recovering half the data in any one 4096-bit area, $100,000 for recovering half of the data in all of the erased areas, and a pro-rated amount based on the number of distinct 4096-bit areas that are at least 50% recovered. The winning team will have 7 days from submitting the first recovered data to submit any additional recovered data for an enhanced prize.

Prize #2 - complete sector recovery

Up to $100,000 in additional prize money can be earned if all data is successfully recovered: $50,000 for recovering all data in a logical sector, up to $100,000 on a pro-rated basis for recovering all data in additional logical sectors. The winning team will have 7 days from submitting the first recovered data to submit any additional recovered data for an enhanced prize.

If prize #2 is claimed before prize #1, the winner will be declared the winner of prize #1, and any additional complete sectors submitted on time will count toward both prizes."

Now that would be a useful contest.

Adjust prize money as needed to spur interest. Don't have an expiration date but do replace the drives with contemporary drives every few years. Offer a similar prize for "usb-memory-stick" devices that have wear-leveling and other tweaks that would invalidate the contest turned off.

Japanese banner ads

[Anonymous Coward]

If I wasn't afraid of some FBI "specialist" mistaking some random cached Japanese banner ad for child porn,

You mean they aren't one and the same?!?

Why this will be of only a small help

[davidwr]

Your proposal isn't totally useless, it may raise the number of recorded bits slightly above random chance, but it's nowhere near a complete solution. Even so, you wouldn't know which bits you think you recovered were recovered correctly.

Here's why:

*The key here is we need to know how to get past the auto-correction in the drives firmware
- This may not be possible on all drives.

Even when it is possible, there is no guarentee that your test drive will behave the same as the recovery drive. There is also no guarentee that the behavior will be the same under slightly different heat conditions, under slightly different magnetic conditions including the state of surrounding bits or partially erased bits, etc.

Exactly reproducing the conditions of an analog device is damn near impossible. The best you can do is get within X of where you are aiming for Y percent of the time. In some cases, that's good enough. In this case, it isn't.

bad rule precludes challenges

[artifex2004]

The idea with recovering from a drive that's been overwritten once with zeros is that you disassemble the drive and deal with the platters directly, using a microscope or some other means. But they have a rule saying you can't disassemble the drive.

They Requested Suggestions

[loren]

They requested suggestions... so I'm sending them this...

I recently became aware of your challenge, and I think it's a great idea. I applaud your initiative to dispell disinformation. I have to admit that, as it stands, I don't think your challenge will have any takers for three reasons:

        1) Money... While I understand that many people make great contributions to our society for little or no compensation I think, in light of what your asking, your proposed reward is much to meager; and I say that not simply in deference to greed. I realize this is a competition you are financing out of your own pocket, and you have limited ability to fund it, but the feat you are asking may take hundreds of hours of research, understanding and custom analog circuit design, specific to at least that particular model of hard drive, if not the specific revision, or even that PARTICULAR individual item (compensating for the timing and balance characteristics of that particular unit). If this feat *WAS* accomplished it's important to realize that it would have almost no marketable value to owners of other drives. Hundreds of hours of engineering is hardly compensated for by $40, a used hard drive, and a little ego-boo...
There may be some that say that if this can't be done for $100, it's not worth doing. but if the data on the drives was millions of sensitive credit card records, or resellable sensitive medical records of either celebrities (to the paparazzi) or of more mundane consumers (to medical insurance companies), or sensitive goverment secrets, the recovery of data off a single hard drive could easily be worth millions, or in some cases peoples lives.

        2) Specialization... Like I said, as I understand data recovery of OVERWRITTEN data, it's an analog matter of figuring the old values as some percentage of the current data values. This is a very specialized process probably best accomplished by the engineers who created the original drives... furthermore, it's not in THIER employers' best interest to see this myth debunked, as it prevents the market being flooded with cheap retired enterprise-quality hard drives.

        3) Limitations... I am quite convinced that this challenge cannot be accomplished without at least replacing the HD's logic board, as the process requires direct access to the raw analog induction data comming directly off the disk. Also more than 3 days may be required to determine the specific physical characteristics of balance, timing and geometry of the specific unit you are providing. While you waive this stipulation for professional recovery houses, for the common hobbyist you are essentially tying their hands and removing any chance for them to compete. I realize that the internals of a hard drive are very sensitive, I think all participants should be at least allowed to replace the drive's logic board and have a few week shot at the device.

I personally have very little vested interest in this competion. While knowing if this feat can be accomplished, and having the particulars more readily availible, might be beneficial, at least professionally. I have very little circut design experience and can barely immagine designing something myself, much more complex than a toaster. I hope my suggestions will help this challenge become more valuable simply than determining that nobody felt willing to tackel this type of challenge for a C-note and a little noteriety.

I applaud your efforts,

-Loren Osborn
  Software Engineer

16systems.com is AWESOME

[Anonymous Coward]

The main site boasts such useful tools as:

1. Test potential U.S. social security numbers and credit card numbers (!)
2. Recreate a credit card number that is missing one digit (!)

I must immediately pull out my wallet and "test" my SSN and bank card numbers; I can't wait to see if their software works! I'm reminded of the corny magic shows aired on prime time television in the 90s (cue Lance Burton) that could magically "guess" what number a viewer was thinking of after slapping 5 numbers on the screen and manipulating their decision in a series of simple logic that would confuse you only if you were a bowl of egg salad.

This post is seriously on Slashdot? Really?

Huh?

[Jane Q. Public]

This kind of service is not THAT expensive, if you shop around. Heck, some years ago Symantec would do your whole drive for $500.

The problem is it isn't that simple

[Sycraft-fu]

Long gone are the days when drives stored things in a simple modulation format. That's what MFM hardrives were (MFM means Modified Frequency Modulation). Now harddrives store an analogue wave, and analyze it to determine the maximumly likely result for a given waveform. It's called EPRML, Extended Partial Response, Maximum Likelihood. You can Google for the specifics of how it works, but the general idea is there isn't a certain threshold beyond which something is 1 or 0. Rather it is an analogue wave of varying intensity and by looking at how it changes, the drive's processor can pick out the binary stream it is most likely to represent. Sounds like voodoo, but works really well and is extremely reliable.

Well, that means that data recovery of overwritten data just became a hell of a lot harder. It isn't a matter of saying "Well the current data is a 0, however it is on the high end of 0 so it was probably a 1 before." No now you have to be able to tell what the wave looked like beforehand, and interpret that.

Now maybe there's a way that it is possible, but I'm rather doubtful. There is, of course, also the time factor. Supposing you can do this, how long does it take you to read one byte? A second? A minute? Ok, how long are you willing to spend scouring a drive that has five hundred billion of those bytes? So not only do you need to be able to do this, but you need to be able to do it quite quickly if you are to have any hope of scanning a modern drive in a timescale that is useful.

Re:The problem is it isn't that simple

[audunr]

Here's an article on recovery of overwritten data. Ibas' "recovery expert" Henrik Andersen states that if the data has been overwritten, it's gone.

Ibas is a Nordic data reconstruction company. They're not a super-secret intelligence agency, but I would assume they know what they're talking about.

http://www.version2.dk/artikel/3521

Sadly, the article has been overwritten by Danish, so it's extremely time-consuming to recover any information from it unless you can read the language already.

you have to love it...

[timmarhy]

.... when people throw down challenges no one gives a shit about, and proceed to proclaim victory by default.

Weak Ink and Paper analogy

[Blancmange]

Hard discs certainly do store multiple bits worth of information in the space one bit takes when read normally. Hard disc drives are intended to be reliable at reading the last-written data at high speed and without much care for track alignment.

To use a visual analogy (without considering clocking and encoding), imagine a hard disc writing data optically by spraying bit patterns (or printed letters) with small jets of black pigment at 70% opacity and whitewash also at 70% opacity. On reading the disc, the drive the controller treats anything with an an albedo than 50% as a "ink" and anything lighter as "paper."

It's not worth trying to make the pigments more opaque since that would just widen the radius of the portion of the spray that could cause a bit (or a part of a letter) to cross the 50% threshold.

Forensic analysis of the platter involves taking a full grey-scale picture of the platter. Even in the case where the bits line up exactly, it's possible to subtract the last written data in order to reveal the second-to-last written data. This process can be repeated for the write that occurred before that.

When the overlaid bits have differing alignments, either along the track or perpendicular to it, it's possible to clearly resolve more generations of writes than one could with perfectly overlaid writes.

Re:Weak Ink and Paper analogy

[Ancient_Hacker]

Ah, no. You can't subtract the latest data and have anything useful revealed, as you don't know the exact waveshape (analog) or x or y location of the latest data bit. Disk heads have about 15% variable and unpredictable write current, another 20% unpredictable head height, plus there is disk speed jitter in the x direction and track positioning error and vibration in the y transverse direction. You cannot reproduce the writing conditions so the subtraction is going to be at least 25% off in amplitude and phase. The residual signal is a bit smaller than that. So you have a very lousy signal to noise ratio. You can't reconstruct data from a signal that is half noise.

Re:Weak Ink and Paper analogy

[Blancmange]

Those errors are only applied to the disc as a whole. At the scale of a sector, the head motion is smoothly varying. It doesn't matter if the contribution to the signal from head jitter is greater in amplitude than that of the intended signal.

As said before. Transverse jitter makes reconstruction of the data easier. It's tire tracks from multiple vehicles that don't overlay exactly. The bits at the edges dominated by one track aid the correct weighting of the bits in the middle.

The lousy signal to noise ratio of the previous writes is only from the point of view of the hard disc controller reading the signal in a simple manner. Usable hard discs are not built right to the threshold of reading random noise.

I've seen micrographs of hard disc platters. The previously written bits are as clear as day.

Re:Weak Ink and Paper analogy

[Ancient_Hacker]

>I've seen micrographs of hard disc platters. The previously written bits are as clear as day.

We've all seen those pics. The pics are misleading.
the typical picture is of an erased area shaped into the letters "MIT" or "IBM". You can still see traces of bits under there, yeah. Useless. A real disk head never writes a string of zeros, that violates the basic principles of group code recording and DC balance. A real head would be writing new data with uncorrelated 1's and 0's, unsynced on the bit and amplitude levels of the previous data. Try reading the old bits THEN.

 

Well known

[gweihir]

The German computer magazine c't did try to get a disk that was overweritten once with zeros recoverd two years ago or so. All data recovery companies they contacted (all the major ones) said they could not do it and that it was likely impossible. So this is not newa at all. Even Gutman had an addendum that says tomething close for modern disks.

The source of all these stories is that it used to be possible, when disc coatings were more advanced than r/w head and electronics. That is not the case anymore. It is very likely that you cannot put much more data on the disk than a moder HDD does. That also means that a single overwrite is an unrecoverable deletion. Keep in mind, that due to the particulars of the modulation, an all zero overwrite does not take up less of the surfaces data storage cabaliluty as a fully random overwrite.

Basically the pople that claim recovery is possible are one or so decades behind the times. Nothing new.

Re:Well known

[Anonymous Coward]

Basically the people that claim recovery is possible are one or so decades behind the times. .. or want you to believe they are. Just imagine this scenario:

1 - put out a challenge that doesn't cost too much
2 - give it publicity
3 - privately warn recovery companies it would be unwise to participate
4 - challenge goes unanswered
5 - lots of criminals decide a one-off zero is enough
6 - police & government have a field day in recovery

I am not convinced, because those that ought to know haven't changed their ways in the slightest. Now I know they need to defend the expensive kit they bought, but I don't think things are as simple as they appear here.

(yes, I'm paranoid - if you aren't you haven't been paying attention)

Re:Well known

[Anonymous Coward]

6 - police & government have a field day in recovery

I suppose they might have one or two such "field days", but then the cat's out of the bag. It wouldn't take long before everyone else returns to the (relatively cheap) practice of multiple overwrites with random data.

And very nearly none of us have anything on our HDs worth the expense of electron microscopes (or whatever else). In fact, very nearly none of us have data which is even worth the much less expensive no-knock warrant. This is all just so much techno-wanking.

- T

actually the prize is now $500

[Anonymous Coward]

"Because of recent suggestions, as of September 6th, 2008, we are raising the prize to $500.00 USD (if the challenge is won) and only allowing professional, established data recovery companies to take the challenge. The deposit fee has been waived. The drive does not have to be returned. Since there is only one hard drive, only one company may take the challenge. We encourage others (perhaps more well-known and more reputable than us) to offer more drives in similar challenges. Help us carry on "The Great Zero Challenge" and put an end to random multiple-overwrite nonsense!"

Looks like somebody read the slashdot article..

Better zero is one you can actually use...

[harrie_o]

... too lazy to RTFA but a simple:

dd if=/dev/zero of=/dev/hda3 bs=512

... from a "linux rescue" prompt after booting and recent Linux CD or DVD will clear that pesky drive D: followed by a reboot to Windows and reformat to NTFS does just fine.

Make sure you create a dummy partition between your boot C: drive and what later becomes D: because Linux and Windows are notorious for arguing over where that partition boundary is, hence "hda3" gets the third partition and its "sda3" if its a scsi hard drive.

And... don't save that pr0n forever. Whatareya a pre-vert?

what?

[Anonymous Coward]

"According to our Unix team, there is less than a zero percent chance of data recovery after that dd command."

Less than zero? So what happens? Your other data gets erased?

Re: Commercial Takers

[Anonymous Coward]

I'd get the Advertising Department to budget this. Either it's possible to do and costs less than a full page NY Times ad, or it's not as the authors want to imply.

the cause & about chalances.

[leuk_he]

First: The cause of this parania about multiple overwrtes is also caused by the spam of Evidence erasor (Note free and better software is available,e.g. google for washer). However these kind of program might fail when paired with advanced FS like NTFS & flash media.

Second:
A challange proves nothing. Bruce Schneider wrote about this 10 years ago.

And last: where does any data recovery company say that they can recover data from a whiped disk? Especially a establised company? Anyway, No way I am going to put some hours from a "High-Resolution Scanning Magnetic Microscope" to recover 500$. Beside that, any recovery company will quickly spend more than 500$ for any recovery.

Um, actually, its plausible

[tjstork]

Of course, this is complete and utter horseshit.

Actually its very plausible. Read about TEMPEST and TEMPEST certification. The computer is essentially a giant radio transmitter. The port lines might give you a better signal.

That's not the kind they are aiming at!

[Jane Q. Public]

Give me a break. Go back and read the OP, and the challenge. Sheesh.

And yes, they exist, but no, the price is not usually 5 digits. At least do some frigging research before arguing, okay?

Have you been reading?

[Jane Q. Public]

Actually, I can answer my own question. No, you have not.

First, as has been mentioned in this thread several times, the reputation would not come FROM 16systems. Nobody cares who they are. The acclaim would come from bloggers doing what they are doing RIGHT NOW: discussing the damned thing on the internet. You have been part of this, so don't claim it doesn't exist.

Second, they don't have to prove to anybody that they are being honest. They have ALREADY PUBLISHED an encrypted TIFF file with the results. All they have to do is release the PGP encryption key, and their challenge is proven. Or... maybe you don't understand how that works?

Third, *I* am not the one who is not getting it here. A company that could recover files that have been overwritten by 0s (Mac "secure erase" for example) would be much in demand. They could make a LOT of money recovering files for people. THAT is the real motivation.

The Ansari X prize was not won by people who wanted the prize money. (It is a pretty safe bet that the $10M did not pay their expenses.) They wanted to prove it could be done, then they WANTED THE BUSINESS of the people who want them to do it. And they are getting it, and they are going to make a shitload of bucks. But it wasn't the prize money, which again, did not even pay their expenses.

The reason they are not doing it is that they CAN'T do it. That is the only real reason. If they could, they could make lots of money doing it, so they would want everybody to know that they could... and they would take the challenge.

Re:Have you been reading?

[JavaRob]

This "challenge" would have to use a completely different methodology for there to be any takers. Maybe you know this, and are basically trolling; maybe you don't. I can explain.

Let's invent some numbers for the sake of argument: say that recovering the data from a drive that's been zeroed out once is possible 50% of the time, using a process that costs about $2000 in employee time, resources, etc.. The "50%" number is irrelevant -- it would probably have to be over 95% for anyone to want to take the challenge... but either way, there are no takers. Why's that?

Data recovery company #1 finds out about the challenge, and decides to take it. They expend the $2000 and (flip a coin) fail to recover the data. It costs them $2000, plus an unknown quantity of lost business. If 16 systems manages to stir up enough trouble (not terribly likely, but possible... they have a target to vilify!), it could hurt them significantly. It ALSO spreads the idea to whoever will listen that running dd once is sufficiently secure, even though the "research" was invalid (is one data point statistically significant?).

Data recovery company #2 is similar, but (flip that coin) manages to recover the data. They spend $2000, "win" $580, and their business is basically unchanged. People *already* believe that often some data is recoverable from a damaged drive or accidentally overwritten drive (and only a tiny percentage of their business would actually come from recovering drives that were zeroed out...), so in sum they've spent $1420 just to keep the status quo.

Data recovery company #3 doesn't hear about the challenge, or considers the risks and doesn't try it. They pay nothing, and lose nothing -- STILL their business from people with damaged and partly-overwritten drives will keep coming. People who google them won't come up with any details on this failed challenge (unlike poor company #1!!!). In theory, they might lose a customer or two who somehow actively zero out their drive, then decide they want to recover it, but stumble across the unanswered challenge and say "oh, damn, guess that's toast after all"... but how many people are in that situation?

#3 is the winner.

You can change the numbers -- even if they could recover the data %90 percent of the time, is it worth that 10% risk of looking foolish and damaging their Google reputation? Probably not.

A final thought on reputation -- of COURSE the reputation of 16 systems matters. Is this challenge being covered in any actual industry press, online or off? Anything that "decision-makers" would read? Or is the slashdot article "the big win"? If 16 systems had a rep, they would have much more leverage. The greater the coverage, the more damage they could conceivably do to data recovery companies who didn't respond... well, assuming that the people using data recovery companies were largely dealing with dd-zeroed drives, I guess. ALSO if 16 systems had a rep, the POSITIVE coverage they could drive would be significant, so a company who accepted the challenge and won it would have a real gain. As it is, if some company illogically takes the risk and extracts the data... they have nothing real to win. Would they get enough business out of, say, another slashdot article to make it worth the cost and risk?

I'm no data recovery expert. I have no idea how hard it would be to recover data from that drive, assuming 16 systems is playing fair (which they cannot prove, and they have no rep to lose... again, see how it matters?).

But this challenge does absolutely nothing to give me any more information. Hence, it's a stunt.

Re:Have you been reading?

[Wooky_linuxer]

I am starting to think you actually belong to 16systems. How does an encripted TIFF file prove anything? There is no way to tell if the files depicted there actually came from the HDD they claim. And no, you don't really get it. If you had read some of the posts here in /. or some papers on data recovery you would know that the procedure is somewhat costly and time consuming - either involving reading raw-data from the HDD, using custom controllers or hacked firmware, or even resorting to scanning the plate with an electron microscope. Would you do that just to prove a bunch of nerds that it can be done? Or maybe for the oh so grand prize of $40/$500? This is the real world baby. When you throw money at things, people listen. You, me, and the bunch of /. readers interested in this won't make a "reputation".

Get off it.

[Jane Q. Public]

You would do it once for less than $40 if you thought it would make you $400,000 over the next year in new business brought in because you proved you could do it. You would do it at your own expense. You would pay $1,000 to prove you could do it!

THAT is the whole point, in a nutshell. Anybody who could do this would have people lining up at their doors, wanting to lay down money for the service. Failing to even try to prove that they can do it demonstrates only one thing: they can't. The $40 thing is nothing but a red herring. Any company that could, would.

Re:Get off it.

[Blakey Rat]

To quote myself:

http://slashdot.org/comments.pl?sid=955869&cid=24905381

Well, the "challenge" is obviously designed to fail, so in a few months when it expires they can sell their brilliant new drive formatting software (or whatever the hell this is trying to promote) with the marketing phrase: "this software made the drive un-recoverable, even when a cash prize was offered for recovery!" They just have to be careful not to mention that zero companies took the "Zero Challenge" and that the prize was trivial.

Re:Get off it.

[Anonymous Coward]

Even if you're a data recovery expert that knows you can do this, you have to trust that these guys are actually giving you the drive that had those overwritten files on it. They could be giving you any drive (their encrypted screenshot proves nothing, since they are not using any verifiable method to prove that the screenshot was of the drive they are going to ship you).

Add to that the fact, which others have pointed out, that they are specifically asking to recover the filenames, as opposed to the file contents, which is much harder, and things start to look quite fishy.

Given that you (the data recovery expert) have no reason to trust these guys, and that you stand to lose all your business when you fail at this non-winnable contest (the negative PR would probably kill you, despite your protestations that there is no proof that the drive you were handed ever contained anything), the risk of losing far outweighs the gain from winning the coveted King (or Queen) of Data Recovery title from an unheard of website.

Prize money up

[kwikrick]

Seems the challanger has been reading Slashdot. From their web-site:

"Because of recent suggestions, as of September 6th, 2008, we are raising the prize to $500.00 USD (if the challenge is won) and only allowing professional, established data recovery companies to take the challenge. The deposit fee has been waived. The drive does not have to be returned. Since there is only one hard drive, only one company may take the challenge. We encourage others (perhaps more well-known and more reputable than us) to offer more drives in similar challenges. Help us carry on "The Great Zero Challenge" and put an end to random multiple-overwrite nonsense!"

Just call them

[comment()]

If you don't believe him, why don't you just call the companies and tell them the same story? This is really easy to verify, you know.

Re:Just call them

[arth1]

If you don't believe him, why don't you just call the companies and tell them the same story?

Why? The companies already won't touch this with a ten foot pole, for good reasons. Being seen associated with a "challenge" like this can only hurt their reputation and waste resources.

This is really easy to verify, you know.

No, it's not. How can you verify past actions that have only been "documented" by a single person?
It relies on trusting the guy, and I would most certainly not take my business to a company gullible enough to do so.

Shannon and company

[Anonymous Coward]

I mostly agree with you, but you missed one point. Shannon's theorem (the third, if my memory serves) states that if you use the channel under its capacity, you can get a zero error transmission. But you can still use it over its capacity, it's just that you will get plenty of errors, of course. If you are lucky enough, you can still get gigabytes of information. Unfortunately, it will be valid bits interleaved with wrong ones, but with heuristic methods you can recover some valid files, or at least some data from them.

Still I can't imagine how to do it without without opening the disk, which you can't do if you are not a big company in the US (wtf?) or a national agency. That's why this contest is a serious shame.

Poor challenge setup - dolts

[gooneybird]

This contest was poorly (either intentionally, or not) constructed. It is yielding the results expected: no takers. Whoever designed this challenged knows absolutely nothing about business. If someone is in business they are not idiots. Why would a business attempt to win a challenge when for a measely $500 dollars they would have to publicly disclose how they did it? This is suicide, give away their business secrets (their advantage) for $500 - That would be the end of their business. That's like offering to buy their business for $500. It would need to be something like $1,000,000 and maybe that wouldn't be enough... Whoever designed this challenge are idiots.. I am not sure it should have even made slashdot.

This isn't going to work

[Fuzzums]

I have a challenge too. It's a 300GB harddisk on which i performed the same dd command.

There is no catch. The disk was full of porn. There is no money to be won, but you get to keep the porn if you restore it.

There is only one problem. I can't supply you all with a harddrive, so i made an image of the dd-ed harddisk.

Use the next command to create your own version of my dd-ed harddisk and start restoring the data.

dd if=/dev/zero of=myharddisk.img bs=1000 count=0 seek=$[1000*1000*300]

$40 will not disspell a myth

[sillybilly]

Why is this even called "The Great Zero Challenge". How about "Last chance at $40 for reading folders from a dd'd harddrive." Is it possible? The answer is maybe, so you should overwrite the same areas a few times. Reading residual magnetization left over after a rewrite probably takes special equipment with sensitivity and positioning beyond the regular head included in the disk. You're basically talking differences between zeros - one of the zeros is not the same as another zero: this zero used to be a zero, that zero used to be a one. You'd need access to the signal levels coming from the head before the analog to digital conversion takes place in the harddrive. Does this conversion take place in one shot, from volts or amps to 0 and 1, or is there an intermediate digitization, say getting a voltage level value between 0 to 255, and then later a calibration in the factory sets the levels of 0 to say 0 to 40, and 1 being 200 to 255, 40 to 200 indeterminate or read error, these values being freely tunable for each different disk? Then if you could get access to that pre-zero-or-one 0 to 255 digitized signal, then you could say that zeros that are reading 10 used to be zeros, and zeros that are reading 30, used to be 1, and subsequent overwrites would get the surface closer to 10 and 19, then 10 and 15, and 10 and 11, until the two different values would be so close, 10 and 10, that you'd need a separate equipment to sense and digitize differences between 10.0000 and 10.0002, and even then the signal to noise ratio might be so small that it'd be impossible no matter how good your equipment is. Is the data still available to somebody with 40 bux? Nope. Is the data still theoretically available after a single dd with 0? For a US or Chinese spy agency willing to spend a few million bucks on the question, the answer is: most likely. But 10000 dd's would most likely make it unavailable to them too. What's the actual number of overwrites needed? That needs real data, at least from someone with a semi-cleanroom hobby shop, with a superprecise oscilloscope reading squarewaves off a surface. Otherwise we're just guessing. One dd might be enough, or 10 might be, or even 10000 may not be enough. So how secure does your data erasing have to be, as long as we're guessing?

Re:$40 will not disspell a myth

[sillybilly]

If you're overwriting many times, overwriting with random data, instead of 0's, would make even the most sensitive electronic detection moot, unless they can predict what random values were used. Now that's something that's really impossible. Deciphering hieroglyphs was difficult enough, let alone a 10000x overwrite with a random pattern. Not only would they have to measure minute differences in signal levels, but they'd have to correctly predict how many 0's and 1's were used for each spot, and in what sequence, in that random pattern. Still, there is nothing like heating your harddisk to a temperature over the Curie temperature, where random thermal motion takes care of the demagnetization for you.

Might have been true at one time

[jridley]

I wonder if recovery after one overwrite might have been possible once, back when data densities were very low (like in the days of 20 megabyte hard drives) or even floppy drives.
These days hard drive manufacturers are busy using every last square micron of space on a platter. To do this they're keeping the data track narrow and well defined, and one of the ways they do that is to increase the coercivity threshold of the media, so the field needed to change the bits are stronger. The odds of there being enough oversplash off the sides, or residual magnetism in the track, to read the previous data has to be almost zilch by now, but it could have been possible at one time.

The Money Establishes the Challenge

[Software Geek]

I challenge you to send an elephant to the moon and safely return it to the earth within this decade!

As you can see, any idiot can issue a challenge. Many challenges, even. The purpose of the reward is typically not to provide economic incentive for the person taking up the challenge. It is to let the public know that the challenge is worth taking seriously. The challenger is saying: not only do I think this can be done and should be done, it is important enough to deserve a substantial reward.

Of course, this exactly the opposite of the challenge under consideration, in which the challenger is saying: I don't think you can do this, but you can have a lollipop if you do.

This is an overrated attack

[Anonymous Coward]

Who cares about the cold boot attack? How likely is it that the bad guy (or your boss) is going to leap into your office to cold-boot attack your encrypted partition immediately after you shut down your machine?

I would bet they are right

[Sycraft-fu]

What people also have to remember is that unless you ARE talking about data with national security type implications, commercial companies are all you are going to be facing anyhow. Sure, it is possible that the NSA or SIS or the like have some secret technique for recovering data from overwritten drives. Guess what? If they do, they aren't telling anyone, and that includes law enforcement, your company, etc. They wouldn't want anyone to know, lest a way be found around it.

Now, as for law enforcement agencies, well they don't have big secret research divisions. They buy products and services from regular commercial companies. Have a look at the weapons police use, for example. While they are sometimes variants that are not available to the general public due to various weapons laws, they are made by firearms providers you've heard of" Glock, Smith and Wesson, Sig Sauer, etc.

Same deal for forensic tools. By and large the most used tool for disk analysis, in fact the only one I've ever seen, is EnCase. It basically images an entire drive (including all empty space) and then allows you to look through it in various useful ways. However, this means that it is only looking at data currently on the drive. Anything overwritten even once isn't visible to it, since it is just pulling data through the drive's normal interface.

As a practical matter, the tools law enforcement uses need to be known because they are going to be scrutinized in court. In pretty much any court in any free nation when the question "What method was used to find this data?" is asked, an answer of "We can't tell you," isn't going to cut it. You discover that forensic methods of all sorts are subject to scrutiny. The way that DNA matches are done, the method for comparing paint chips, etc, all are open to be looked at. The investigators can't just say "Ummm ya, the DNA matches. We can't tell you how we know, we just do." Same deal for digital forensics.

So while there's certainly nothing wrong with running a good wipe as a CYA sort of measure, this paranoia of "OMG they can read your data no matter what!" needs to stop. For example we do DOD 5220.22 wipes at work because it is a good way to have ourselves covered if anyone asks. After all, it's an official DOD standard, if it's good enough for them it's good enough for us. However I've no illusions that it is necessary over a simple zeroing of the disk. Maybe if I was worried about the NSA reading our disks, but I'm not.

Yes intelligence agencies go to some extreme lengths (like wiping a disk, grinding it up and melting it down) but that's not because they think that is all needed, but because they don't want to find out they are wrong. When you are protecting national secrets, you don't take chances. However if you aren't, and people here aren't, then this paranoia is rather silly.

Updated Prize?

[jjk3]

I just RTFA and it states:

Should someone win, they get to keep the drive. They also will receive $500.00 USD and the title "King (or Queen) of Data Recovery".

Maybe it was updated after the story was pasted to Slashdot?

Interestingly, $500 doesn't show much confidence

[JavaRob]

If 16 systems is so sure they're right, why not make the reward $50 grand or so? They won't have to pay it, after all... right?

And make it part of the contract that challenge takers who *fail* won't be publicized (remove that obvious & large discouragement), and see if the response changes.

It might not -- as the average data recovery company's customer is NOT coming to them with a dd-wiped drive -- but hey, it'll make it more likely that someone will give it a shot.

As-is, it's all a bit silly.

You are confusing crypto

[Sycraft-fu]

The reason for longer crypto keys is long term data security. The idea with crypto is to keep the data secure, even if someone manages to intercept it, so long as they don't also get the key. However, what that means is that they have the encrypted data for as long as they like, and they can play with it as they like. So you use a big key for two reasons:

1) To make the amount of time an attack will take too long. All key-based crypto like AES can be brute forced, simple nature of the game. You can, in theory, just try every single key to find the right one. Well to prevent against that, you just need a large keyspace. Since it isn't that computationally expensive to use really large keys, you do it. Make it 10^50th years to test all the keys.

2) To guard against future improvements in the attacks against the crypto. Say that computers become a million times as fast. Also say that an attack is discovered that eliminates 99% of the keyspace. If you were not conservative with key sizes, well then maybe now you are screwed. However in the case of large key spaces like AES, still not a problem. Suppose a supercomputer now could test a trillion AES keys per second (not likely, but suppose). Now suppose both of those attacks become a reality, a computer a million times faster and 99% of the keyspace rendered invalid. You are still talking an attack time on the order of 50 BILLION years to get a 128-bit AES key.

Now, neither of these has anything to do with reading data from a harddrive. You don't "brute force" it. You are either able to read it, or you aren't. It isn't as though by just reading it over and over you get anything more. You either develop something that can figure out what was there before the current data, or you are screwed.

Using long encryption keys isn't the same as data deletion.

Re:You are confusing crypto

[randomc0de]

You are either able to read it, or you aren't.

Untrue. Read my quote... it's from Bruce Schneier fyi. There are levels of sophistication in an attack. One of these is an electron tunneling microscope. Advanced attackers may have access to this attack vector. Data recovery companies probably won't, certainly not within the near future.

Using long encryption keys isn't the same as data deletion.

FALSE! It is exactly the same thing. In 10-20 years, maybe electron tunneling microscope data-recovery technology will be $20 like a FPGA is today. At that point, building a machine to attack once-written hard drives becomes possible for small organizations. Just like building a custom FPGA array to attack DES keys has been done by many people. You overwrite multiple times for the same reason you use keys much longer than necessary - to "future proof" things, in Schneier's own words.

Nothing proves nothing like nothing at all

[grikdog]

Silence is not assent to the truth of a proposition, Sir Thomas More's point of law to the contrary. Only the harmless substitute logic for thumbscrews and rubber hoses, but "Zero Challenge" is so recherche it deserves its own Isaac Asimov Three Laws of Cluelessness Award for 2008.

Get the data by other means

[Anonymous Coward]

As is usually the case, recovering the data from the storage medium is not the easiest way to do this.

Far simpler would be to bruteforce the GPG key encrypting the answer file, which is publically available on the challenge site. Faster still would be to threaten the person who knows the key.

Prize has been increased

[Anonymous Coward]

They now offer a prize of $500 and have removed the deposit fee.

"We encourage others (perhaps more well-known and more reputable than us) to offer more drives in similar challenges."

You haven't demonstrated anything.

[Jane Q. Public]

First off, if the data recovery techniques only recovered data 50% of the time or less (as in your example), then the challenge's point is proven already. They can't reliably do it.

Second, probably the VAST MAJORITY of new business they would be getting would be 0ed files... due to common "secure erase" programs that typically write 0s to the disk. Like Mac OS X "secure erase" and Norton "wipe disk" in default mode. Nobody would be making money on overwritten files anymore because it would have been proven impractical! (If 0ed areas of the disk can't be reliably recovered, then more-or-less "random" overwriting would render the data unrecoverable, in a practical sense.)

I completely disagree that the reputation of 16systems matters, even a little. Did YOU know who the Ansari family were when they helped to establish the X prize? Did you care? And was it about the money (as you seem to keep insisting)? The X prize did not even meet the expenses of the winners. Gee, I wonder why they did it then? According to your argument, they would not have any motivation, because they wouldn't be making any money! But in fact, even though the prize did not give them a profit, they are going to be profiting anyway! Due to the reputation THEY made in winning the contest! Imagine that.

But all that aside, the whole contest is getting PLENTY of press right now, despite the relatively unknown sponsors... and YOU are contributing to it!

Re:You haven't demonstrated anything.

[JavaRob]

First off, if the data recovery techniques only recovered data 50% of the time or less (as in your example), then the challenge's point is proven already. They can't reliably do it.

This fallacy is "shifting the goalposts". No, the contest site contends that it's impossible. Are you saying a disk-wipe method that worked 50% of the time would be remotely sufficient for anyone's purposes? Huh.

Second, probably the VAST MAJORITY of new business they would be getting would be 0ed files... due to common "secure erase" programs that typically write 0s to the disk.

As I said in my post above, this isn't the main source of business for data recovery firms, and would continue not to be even if someone recovered the drive. The general understanding is that if you've actively overwritten all of your data, either it's toast or it'll cost an awful lot to get anything back. It's *still* not going to be common for folks to have extremely valuable enterprise data (worth the cash to try a recovery) that's not backed up anywhere, actively overwritten with 0's.

(If 0ed areas of the disk can't be reliably recovered, then more-or-less "random" overwriting would render the data unrecoverable, in a practical sense.)

If you don't even prove the first part, you can't assume a shaky extension. "Can't be reliably recovered" is not enough even for wiping even normal personal info. But that's what this challenge is demanding, "reliable recovery". What's the point? The data on a drive that's been dropped down the stairs cannot be "reliably recovered" -- it depends on the damage. But often it can be recovered, so that's NOT a practical method of wiping a disk.

If you want to actually show that dd'ing 0's to a disk once makes it impossible to recover without possibly an electron microscope or some crazy-impractical method like that, then design some way to prove that. This contest does not -- as I said (and you agreed) it's not worth it for companies to enter if it's even 50% possible to recover. "Not reliably recoverable" is not useful information for someone wiping a drive, or even for someone who accidentally wipes a drive and thinks about sending it in someplace to try recovery.

I completely disagree that the reputation of 16systems matters, even a little. Did YOU know who the Ansari family were when they helped to establish the X prize? Did you care?

Million of dollars = mucho credibility. I still don't care who they are -- they put the money on the table, and it got people moving; first the hobbyists who really wanted the cash (and launched a few chairs testing engines!), then some folks with deep pockets of their own (which was really required...) got caught up in the excitement. If the prize had been $500, they would have gotten no real coverage, no takers whatsoever, and no snowball effect. Do you disagree with that?

And was it about the money (as you seem to keep insisting)? The X prize did not even meet the expenses of the winners. Gee, I wonder why they did it then? According to your argument, they would not have any motivation, because they wouldn't be making any money!

They had no reputation to lose if they failed, either. These were not established businesses taking people into space already, being challenged to do some difficult variation on that.

But in fact, even though the prize did not give them a profit, they are going to be profiting anyway! Due to the reputation THEY made in winning the contest! Imagine that.

That still remains to be seen, but again, the analogy is not apt (and I suspect you know this and are trolling by now... but I'll bite this last time). They had no reputation or existing business model to lose; instead, they got a significant monetary & publicity boost in opening a brand new and very risky market that required a ton of money to

prize too small

[Khashishi]

The data recovery companies probably charge considerably more than $500 for most recoveries. I don't see why they would waste their time on this contest. Sure, they get some bragging rights, but I don't think too many people heard about this contest.

Prize...

[MobileC]

The prize is $500 as from Sept 6th.

This is how it works.

[Jane Q. Public]

First, I am not the one who is still not getting it... if YOU had been reading the rest of the thread, you would have seen MY comments about that very thing. Yes this is the real world. So get real! If you were a data recovery service, you would NOT be doing most of your business with an electron microscope. The very notion is ludicrous. Very seldom would anyone want or need to go to that kind of expense. The vast majority of your business would be solving simpler problems... that is, if you could. And isn't that the point here?

What about PRACTICAL data recovery? If it takes an electron microscope to recover the data, I think the challenge's main point is already sufficiently demonstrated.

The encrypted picture containing the filenames has already been published, using PGP public-key encryption. When the contest is over, all they have to do is publish the public key, and any member of the public can decrypt the file and determine FOR THEMSELVES whether the names matched. There is no possibility of cheating this way. Unless -- as you seem to suggest -- they are "in on" some kind of publicity scheme? If so, they would (and would be able to) put more money into it than this! Also -- sorry to break the news to you -- but you are arguing against yourself! How could this be some kind of publicity stunt if, as you claim, this would not get sufficient publicity to make any money? You can't have that both ways!

But as for "prize money", THERE is where you miss the point. I have been using the analogy of the X prize. Did the winners make money by claiming the prize? Arguably no (their expenses were almost certainly bigger than the prize money). So why did they do it? Altruism? Hardly. They are going to be making loads of money because THEY earned the reputation of people who can Get It Done! And this not not dependent on the reputations of the sponsors. Who are the Ansari family anyway? Who were the other sponsors of the prize? Do you know? Do you care? Does it have anything to do with Space Ship One?

NO! Branson, Mojave, and Scaled Composites (Rutan et al.) got nearly all the publicity, not the sponsors. And they are going to be raking in the dough.

Re:This is how it works.

[JavaRob]

So, do you belong to 16 systems?

What about PRACTICAL data recovery? If it takes an electron microscope to recover the data, I think the challenge's main point is already sufficiently demonstrated.

Nope -- the data could be accurately recoverable 90% of the time, but it's still not worth it for a data recovery company to risk their reputation on this being one of those 10% cases, failing, and having their name dragged through the mud.

I'm not saying that's the case -- but that's all this challenge is proving: there's no data recovery company willing to risk their reputation trying it. There's not much to gain, so all we learn is that it's not guaranteed to recover the *filenames* as required to win the challenge.

The encrypted picture containing the filenames has already been published, using PGP public-key encryption. When the contest is over, all they have to do is publish the public key, and any member of the public can decrypt the file and determine FOR THEMSELVES whether the names matched. There is no possibility of cheating this way.

Huh? It's trivial to cheat:
* Drive A has files "one" and "two". Take a screenshot of the files, encrypt it, etc.
* Drive B is new & blank. Write it with 0's.
* Send out drive B.
* ALTERNATE: Overwrite drive A with 13 passes of random data, then with 0's. Send out drive A.

Encrypting the filenames beforehand, etc. doesn't protect anything... the trick is guaranteeing what was done with the hardware itself.

Unless -- as you seem to suggest -- they are "in on" some kind of publicity scheme? If so, they would (and would be able to) put more money into it than this! Also -- sorry to break the news to you -- but you are arguing against yourself! How could this be some kind of publicity stunt if, as you claim, this would not get sufficient publicity to make any money? You can't have that both ways!

Er.. it could be a poorly-conceived publicity scheme. Personally, I think they're actually trying to make a point, but didn't think this through.

But as for "prize money", THERE is where you miss the point. I have been using the analogy of the X prize. [...]

I've addressed this elsewhere, but in short -- it's not a valid analogy. The X Prize garnered a ton of publicity (because of the large prize and first hobbyist forays), and the money & publicity helped lower the risk for a very high-risk investment (but with a possibly enormous payoff), creating an entire new market.

Something more comparable -- the James Randi prize offers $1 million to anyone who can demonstrate scientifically valid paranormal abilities. Obviously, they *want* to prove it's impossible, as much as possible -- more like the 16 servers contest. In spite of the danger of loss of reputation and business, the prize is big enough that lots of people try to win it... so that contest does a much better job of proving that something may well be impossible.

Not entirely.

[Jane Q. Public]

Did the people who failed to win the X prize "have their names dragged through the mud"??

No.

You have a point about the drive condition, though. Frankly I hadn't thought of that but I should have.

I still think the X is a valid analogy, though. The circumstances are not exactly the same, granted. But a winner would still have lots of good publicity, and the failure of anyone to take up the challenge is undermining credibility in their industry! To a serious degree? I don't know. But my faith in their abilities is near zero already, so I don't thing a showing by somebody would really hurt them very much.

In any case, I still think that the X prize is a more fitting analogy than the Randi prize. Anyone who could actually demonstrate their success would bring in lots of business!

I still say that lack of participation is good evidence of their lack of faith in their own methods.

You think "hobbyists" had any real chance?

[Jane Q. Public]

Get real. The "hobbyists" never had the budget to actually make it work, and were tilting at windmills but were too stupid to realize it. The SERIOUS contenders for the Ansari X prize were people who had already sat down with their calculators, and KNEW that they would not be making a profit simply by winning the prize. Anybody else who continued to try anyway would have had to be idiots. But some of the non-idiots who were serious contenders are still working on achieving essentially the same goal! Hmmm... there isn't any prize money left, however. Do you think their motivation is imaginary?

So: the contenders had no existing reputation? That might be true of some, but my no means all (or even most). Check it out: http://en.wikipedia.org/wiki/Ansari_X_Prize

That argument carries no weight at all.

Lastly, I am not, and have not been, "rabid". I am just trying to point out to people where I feel their logic is flawed or spurious. Do you consider that a pointless exercise? I am willing to back down if someone can actually show me that I am wrong. So far I have not seen that demonstrated.

Look: I am not trying to say that this is the best-designed contest ever put out there, okay? I am simply trying to say that if I were a data-recovery company, and had a reasonable chance of doing this, I would snap it up. And I seriously believe that the reason it has not been, is that they simply can't do it reliably. There are lots of arguments on both sides, but none of those arguments actually prove anything. So: you know my opinion, I know yours. We are not likely to go much further than that, with the data we have.

He has a point, even if poorly communicated

[maxbash]

As someone experienced in data recovery, I side with him that doing more than a zero write is unnecessary for 99.999% of the population. And if you needed more security, you would physically destroy the drive. There is the possibility of having relocated sectors with data that drive firmware hacking could allow you to access. In theory a drive written over once could have remnant magnetic fields that could be recovered with a electron microscope. That would require a clean room with multimillon dollar microscope and possibly months of expert labor. If an organization can do this they are not talking about it. Maybe a intelligence agency would do it if was important enough and they exhausted many other means to get the intel first.