The Great Zero Challenge Remains Unaccepted

An anonymous reader writes "Not even data recovery companies will accept The Great Zero Challenge and only four months remain! We've all heard how easily data can be recovered from hard drives. We're told to make multiple overwrites with random data, to degauss drives and even physically destroy them just to be extra safe. Let's get the word out. The challenge is almost over! It's put up or shut up time. Can you recover the data?"

Comments

Do many companies really do EFM recovery?

[DigitAl56K]

Based on nothing more than personal suspicion, I think many professional recovery firms may be in the business of simply running expensive tools that scan through the partition and file table area and perhaps even the entire disk to locate data that has either been marked erased or had references removed (for a full disk scan) and then restoring it. Perhaps they'll also move the spindle from a dead drive into a new case to complete the operation, but I doubt there are many companies that will actually do electron force microscopy for you and even fewer that will do it at anything other than an astronomical fee. Powerful recovery tools can be purchased for a few hundred dollars now anyway. My opinion is that the recovery business is a focus around confidence that a professional will be doing the recovery and that you or your employees won't worsen the situation. In the event that a drive with critical data fails and you don't have a backup, who wants to be the person responsible for damaging the disk during recovery?

Anyway, IMHO this whole debate should be moot by now. If you want to secure your drive use full disk encryption (now freely available in TrueCrypt) and when it comes to destroying the data just overwrite the header area a thousand times with random garbage. It will take only a second or two, and the whole drive will be useless to anyone.

Of course it would also be nice if more manufacturers were producing encrypted disks as standard with verified schemes (there have been some lemons purporting to be secure that really aren't) so that we wouldn't have to do encryption in software.

Re:Do many companies really do EFM recovery?

[anagama]

Although the drive has to be in a living system and not on the shelf, it's worth noting the cold boot attack: http://citp.princeton.edu/memory/

Q. What encryption software is vulnerable to these attacks?

A. We have demonstrated practical attacks against several popular disk encryption systems: BitLocker (a feature of Windows Vista), FileVault (a feature of Mac OS X), dm-crypt (a feature of Linux), and TrueCrypt (a third-party application for Windows, Linux, and Mac OS X). Since these problems result from common design limitations of these systems rather than specific bugs, most similar disk encryption applications, including many running on servers, are probably also vulnerable.

Re:Do many companies really do EFM recovery?

[Justus]

If you want to secure your drive use full disk encryption (now freely available in TrueCrypt) and when it comes to destroying the data just overwrite the header area a thousand times with random garbage. It will take only a second or two, and the whole drive will be useless to anyone.

Except, of course, that the point of the challenge is that instead of encrypting and whatnot (which can be a good idea for other reasons, but I digress), you could just overwrite the drive with 0's once and dispose of the drive safely. This is most likely substantially faster than what many people propose, like overwriting many times or physically destroying the disk.

However, I think their methodology is pretty flawed. The reward for completing the challenge is $40 and the drive itself (which is worth $40-60). You also have to pay shipping, which will run maybe $10-15. I know that it's really not worth it for me to spend any time trying to recover the data from the drive—probably a fairly lengthy process—just for $85.

Re:Do many companies really do EFM recovery?

[DigitAl56K]

Although the drive has to be in a living system and not on the shelf, it's worth noting the cold boot attack

Not in this context because we're talking about how intentionally wipe the data from a drive, e.g. when you want to erase the data and dispose of the disk. The cold boot attack, although interesting, has nothing to do with recovering data from a drive after someone has attempted to destroy it, unless your implication is that someone would try to overwrite the header a split second before someone like the FBI breaks the door down. Even then, simply unmounting the volume will wipe the key from memory. If you have time to attempt an erasure you have time to unmount the disk. If you are in a situation where you have enough time to write zeros all over the drive, as in this challenge, you are certainly not at risk from the cold boot attack.

Re:Do many companies really do EFM recovery?

[mikael]

I had an old drive which failed - one of those laptop Travelstar's that were known as 'deathstars' for the number of times they had died from overheating. Data recovery companies gave me a quote for anywhere between 300 pounds and 800 pounds, depending upon whether they would have to remove the spindle/platters from the drive and place them into a new one.

Fortunately, I managed to recover all the data from this drive for free, by putting it in external USB enclosure, place this in a freezer to cool it down, then give the enclosure a quick twist once the enclosure was plugged into an USB port. That was enough to recover the data.

You can recover the partition data of a drive erased using 'fdisk' by running the 'testdisk' utility.
(written by Christophe Grenier of http://www.cgsecurity.org/">CG Security

Re:Do many companies really do EFM recovery?

[arth1]

The conditions are also made to trick ignorant journalists. Anyone knowing a bit about file systems know that being able to restore some data from a drive is a heck of a lot easier than being able to restore file names, which they demand. Not only do you have to be able to restore the sectors that contain the file name metadata, but you need knowledge of the file system in question, and how exactly it stores its file names. If it's stored in byte swabbed format, you won't even recognize it as a file name.
Try to do a dd to a file of a working partition and then extract the file names from it. Unless it's a DOS partition or other ancient format, it's not easy, and that's with no zeroing.

Yes, the "contest" is a farce, and any company that enters into it will lose credibility just by entering.

Re:Do many companies really do EFM recovery?

[fbjon]

The cold boot attack is possible if the FBI cuts the power before breaking down the door, then you won't be able to overwrite the memory. Unless you have a UPS, in which case you could have it auto-unmount all encrypted drives after a few seconds warning.

Re:Do many companies really do EFM recovery?

[cduffy]

Everything that 'might' happen is a security risk. If you think I'm being an alarmist, then stop thinking about security. It's necessary to talk in such absolutes. Using a random garbage writer is, well, random. With random, there's almost no chance of it happening. On the other hand, using straight zeroes, it's not possible to recover data from a disk full of zeroes at all. No multiple obsessive compulsive garbage writing necessary. Simple, elegant, and true.

You're absolutely right that we're talking big brother paranoid level security -- but if you write straight zeros, and writing a zero makes 1->0.05 and 0->0, it may be possible to tell the two states apart. As binary as the data may be, it's still getting written to a physical medium -- and the Real World lives in analogs. Even were this true, however, writing multiple passes of garbage would prevent an entity able to distinguish 0.00 and 0.01 from being able to determine the media's prior state -- and that's the whole point of this operation. Claiming that writing multiple passes of random garbage (or, better, patterns selected to-purpose -- see the Gutmann method) is somehow worse security than a single pass of zeros is complete bunk; the likely case is that it simply doesn't buy anything worthwhile at all, at a cost of time and electricity.

That said -- absolutely, this isn't a likely attack; if there were a cheap way to make equipment which could read data with that level of precision off of magnetic platters, we'd be using it to make higher-density magnetic platters... and tolerances for how the data is written to those platters is much, much lower today than it was twenty years ago. (Against a twenty-year-old hard drive, I'd expect the chances of someone with a STM and a lot of time to actually be quite good).

Re:Do many companies really do EFM recovery?

[Tassach]

Data destruction can be trivially achieved with just dd and /dev/null

You ALMOST got it. Data destruction can be trivially achieved AGAINST TRIVIAL ATTACKS with just dd and /dev/zero. There are quite a few published papers on how to recover data from a zeroed hard drive -- attacks that are a LOT more sophisticated than plugging the drive in to a working system and running a piece of software. These attacks aren't easy and do require special equipment and actual knowledge of ELECTRONICS ENGINEERING, not just general computer geekery.

As a side point, it's /dev/zero, not /dev/null. cat /dev/zero (or /dev/random) spews forth a never-ending stream of bytes. cat /dev/null returns zero bytes.

Re:Do many companies really do EFM recovery?

[LaskoVortex]

but you need knowledge of the file system in question, and how exactly it stores its file names.

Its good you brought this up, because the poster went back in time and included it in TFA. Its people like you keeping these guys honest:

We did a default initialization and NTFS format from within Windows XP.

Re:Do many companies really do EFM recovery?

[Jah-Wren Ryel]

It's always satisfying to fix a computer problem with a hammer, even though you are being very careful.

It's called percussive maintenance.

Re:Do many companies really do EFM recovery?

[Kent Recal]

I can just picture it: The FBI kicks down your door at 3:40am, male voices scream "F-B-I", guns clicking, laser-sight dots hushing over the walls, someone jumps through your bedroom window, kicks you out of bed knocks you onto the floor, jams his knee into your neck... Then a nutty professor with fat glasses in a white coat runs onto the scene and screams "FREEZE!!!" as he sprays ice onto your RAM modules...

C'mon kids, won't happen. You've been to the movies too much. In the real world they just send you a letter. And you pay and/or get to clean some public spaces. And mommy will lock away the computer. That's it.

Re:Do many companies really do EFM recovery?

[arth1]

That doesn't explain exactly how it stores the file names. The onus is on the one doing the recovery to find that out, which is unreasonable.
If you manage to recover a few thousand humanly readable words, how are you to know which ones of those are file names, which ones are part of other metadata, and which ones are data, without being an expert in the file system in question?

(Also note that different version of NTFS may behave differently -- the position of the metadata on the disc, for example, has changed.)

Re:Do many companies really do EFM recovery?

[Deagol]

Got cites?

I know of the original Gutmann paper, his follow-up debunking the "magical" 35-pass requirement, and then there was a dude who tried (unsuccessfully) to track Gutmann's original source material to see if any *real* data recovery had actually been done. This topic really interests me, and I've yet to find *any* evidence that data simply overwritten with zeros has *ever* been recovered (even partially) from modern hardware that even Gutmann himself feels is pretty immune to such techniques, given the density.

As illustrated in the old humorous "Physics Warning Lables" piece:

Advisory: There is an Extremely Small but Nonzero Chance That, Through a Process Known as 'Tunneling,' This Product May Spontaneously Disappear from Its Present Location and Reappear at Any Random Place in the Universe, Including Your Neighbors Domicile. The Manufacturer Will Not Be Responsible for Any Damages or Inconvenience That May Result."

Likewise, it's *theoretically* possible that such low-level magnetic scanning voodoo could recover overwritten data, but real-world evidence thus far has been nil. As others have pointed out, if such equipment sensitivity were feasible, then that technology would have been used to increase HD data density. In addition, if such techniques were truly feasible, any company that could do it would have enormous fame and financial success.

It's a shame that this particular "challenge" was so piss-poorly implemented. Maybe James Randi should put up some cash for such data recovery, as it pretty much can be filed under the "paranormal" category. :)

Re:Do many companies really do EFM recovery?

[Tassach]

Because the offered reward is not worth the effort. The guy's a nobody, and the price is a joke. If it were a major university or an individual of some note in the information security community who were sponsoring a contest, then it might be worthwhile. Some nobody with an obscure blog? Give me a break. Even if I still had access to a fully-equipped electronics lab, I've got better things to do with my time and $60.

Re:Do many companies really do EFM recovery?

[MR LOLALOT]

Kernel memory pages are usually not swappable. They will stay on physical memory.

Re:Do many companies really do EFM recovery?

[Hal_Porter]

Except that in the real world the FBI bust you because they have other evidence. If your Truecrypt partition doesn't have any trace of the stuff they know you've done they'll know it's the outer one, not the inner one.

The best way to avoid this sort of thing is to not do the sort of things that cause the FBI to go after you in the first place and not try to use your intelligence as a way to be completely immoral. Because we all know how well that worked out for Hans Reiser.

000 00 00000 000000000

[MillionthMonkey]

000 000, 0 000 0000 0000000 0 0 0 0000 00000! 000 0 000 000 0000000 000 000000 00000? 00 000 000000!

000 000 00 0000 000.

Re:000 00 00000 000000000

[MillionthMonkey]

That's just what I'd expect a monkey like you to say.

Well maybe 00000000 you can help me with my typing here. I've been trying to decide, 000000 should I have Hamlet's mother die in the last act or just kill off Claudius and have a happy ending 000000000000?

"....less than a zero percent chance"

[Joce640k]

That word "percent", I don't think it means what you think it means...

Re:"....less than a zero percent chance"

[Reality Master 101]

I think their problem is with understanding the concept of "zero", rather than "percent". Either that, or your understanding of hyperbole is flawed. :)

Re:"....less than a zero percent chance"

[cortesoft]

Nah, you can have a negative percent chance of succeeding in a task. For example, if you have a -5% chance of succeeding, not only will you fail every time you make an attempt, you will also fail 1 in 20 times that you don't even try.

Re:"....less than a zero percent chance"

[antifoidulus]

I've been looking for a slashdot comment that succinctly sums up my life, and now I've found it!

Re:"....less than a zero percent chance"

[magus_melchior]

"You tried your best, and you failed miserably. The lesson is, never try."

--Homer Simpson

Wow, what a prize!

[Dahan]

So the prize for winning is a $60 hard drive, plus $40? Damn, I don't know why people aren't just jumping all over that!

Also, disassembling the drive is against the rules of the challenge, unless you're a "established data recovery business ... or a National government law enforcement or intelligence agency".

This "challenge" is stupid.

Re:Wow, what a prize!

[agurk]

Actually they also ask you to tell how you did it. Even though they claim it is not a scam it seems like a scam in the sense that they after this weird experiment have proven that recovery is impossible.

It is like me setting up a challenge - can ketchup stains be removed from my white t-shirt?

Send a self-addressed, postage-paid box you pay shipping both ways with packaging material to the address listed below along with a sixty $60 USD deposit United States Postal Service Money Order only and I will mail the t-shirt to you.

If you can remove the stain you get to keep the t-shirt and I will give you the amazing amount of money $50 and the right to become "official stain remover". Btw, if you can't prove you are a established ketchup removal business - you cannot use water or any other fluid.

If this challenge is not taken within a year I have the right to tell the world that the worlds dry cleaners can't remove ketchup stains. The whole clothes cleaning industry is a hoax.

Re:Wow, what a prize!

[Renraku]

The challenge isn't stupid, the rewards are.

If this were an X-prize type of deal, it'd be a lot better. Who's going to bother with EFMing a drive for $40? I guess some college students with access to those machines might, but those are very fickle and easy-to-fuck-up machines..aka..kept under lock, key, and password.

Re:Wow, what a prize!

[childoftv]

Here's a thought: I just accidentally erased a drive fulla my favourite/most mission critical data by "mixing up the or and else clause" when I was running dd or somesuch. I know that normal companies would charge $$$ for the service of recovering the data and those are $$$ I don't have. But I think, "hey Slashdot is awesome", maybe if I put it up as a challenge with a social rather than significant financial reward (see Predictably irrational by Dan Arielly) I'll get my frickin data back?

Jeez

[trifish]

Interestingly, the most important thing is missing from the summary -- the prize. So, what the prize is you ask?

An incredible, unbelievable, astonishing and amazing amount of... wtf... fourty (40) US Dollars? Yes, you heard that right! No wonder nobody has shown any interest in participating.

Full quote from the site: Should someone win, they get to keep the drive. They also will receive $40.00 USD and the title "King (or Queen) of Data Recovery".

Re:Jeez

[7 digits]

> Interestingly, the most important thing is missing from the summary

Not only that, but also the fabulous restriction:

"You may not [...] disassemble the drive"

This is ridiculous. A drive overwritten with zero data will, by definition, returns 0s through ATA commands. The reason why some people overwrite sensible data several time is to guard against a possible scanning transmission electron microscopy, which, of course would need the disk to be disassembled to be performed.

How can this ends on slashdot ? Don't know...

Re:Jeez

[Anonymous Coward]

Yes, but once the Nation of Data Recovery rises, that prize will seem a lot better.

Re:Jeez

[arth1]

$300? That's for running what's pretty much an "undelete" like any shareware program can do.
$3,000, and you might get what amounts to a sector dump.
$30,000 and damaged platters/heads might be replaced, and attempts at hardware recovery done.
$300,000, and the electron microscopes might see use.

Where are the challengers?

[phantomfive]

Ugly unprofessional website, a prize purse of $40USD (plus the hard drive), restrictions that the drive can't be disassembled.....I can't imagine why they're having trouble getting interest. Raise the purse to $10,000 and you might have something.

In addition, according to Wikipedia, what he proposes is actually impossible, at the very least an electron microscope would be needed.

Can't say I'm entirely disappointed by this story, though. At least I learned something that I was ignorant of before.

Utter stupidity

[Reality Master 101]

First of all, do data recovery firms ever *claim* they can recover from a zeroed drive? No, they don't. The claim is that government-level forensic analysis *might* be able to recover data with only a single overwrite, with very sensitive expensive equipment. Not terribly surprising the FBI wouldn't take them up on this challenge.

Second of all, someone is supposed to waste a lot of time and money for just a cheap drive and a piece of paper from some entity no one has ever heard of?

And they're doing this to "prove" that this type of data recovery can't be done?

This has to be the lamest challenge that's ever been issued.

Re:Utter stupidity

[Mike1024]

someone is supposed to waste a lot of time and money for just a cheap drive and a piece of paper from some entity no one has ever heard of?

I know the dollar has declined in value a lot in recent years, but it's hyperbole to call $40 "a piece of paper from some entity no one has ever heard of"

I think you got it at the beginning.

[khasim]

It's about money.

Since the "reward" offered seems to be less than the regular fee that a company would charge for such, why would any recovery company waste resources on it?

Re:I think you got it at the beginning.

[gEvil (beta)]

That was my thought, too. Reading through the challenge page, all I could think was "a whole 40 bucks?!?" I mean, even if I could do it, I'm not sure I'd waste my time for 40 bucks and the title of "recovery king".

Re:I think you got it at the beginning.

[dotgain]

If my interpretation is correct, you're still $20 behind (unless you actually value an 80GB drive), since if you win you get to keep the drive, but apparently aren't refunded your $60 deposit. This was exactly why I read the article - and when I found out what's at stake I thought it pretty obvious why even ten-year-old johnny with his hex editor haven't entered - this is the most pathetic competetition I have read of in all my time.

Re:challengers

[anagama]

The challenge does not seem well designed. First of, the person attempting it has to pay postage both ways, deposit $60 with the organization hosting the challenge and forfeit the deposit if the drive is not returned in the same condition as it was when sent (how are you going to use a scanning tunneling microscope if you don't take it apart), they only get three days, and the reward is a whopping $40.

why would anyone do this?

[mrvan]

Okay, here are my 3 reasons why a company would not accept this challenge:

(1) economical:

- I am asked to mail 60 USD to a random address, who claim they will return it to me if I send the harddisk back. This is a risk (how do I know it is not a scam?)
- In any case, I lose shipping charges both ways
- Maximum gain is 40$, plus an obscure web site calls me King of data recovery.
- Risk + Cost >> Gain

(2) International

I am asked to ship a US Postal money. A WHAT? Hello, creditcard? Paypal? Normal internaional cheque?

(3) Disassembly

All reasons I've heard for doing something more than dd is that there might be residual magnetic charge on the platter that is ignored by the filesystem. According to the rules of engagement, only some weird collection of institutions ("established data recovery business located in the United States of America" or "National government law enforcement or intelligence agency (NSA, CIA, FBI)") may disassemble the drive. How am I going to detect residual charge if I cannot disassemble it?

The last arguments compounds the first two, as only US Companies can disasseble, and disassembly voids the deposit, meaning I am certainly out 60$.

Next time that they want to be "noble and just to dispel myths, falsehoods and untruths", they should make a challenge that is actually interesting to any party to pick up.

From The Experts

[randomc0de]

Given my general level of paranoia, I recommend overwriting zeros, and five times with a cryptographically secure pseudo-random sequence. Recent developments at the National Institute of Standards and Technology with electron-tunneling microscopes suggest even that might not be enough. Honestly, if your data is sufficiently valuable, assume that it is impossible to erase data complete off magnetic media. Bur or shred the media; it's cheaper to buy media new than to lose your secrets.

Because all data recovery companies have electron-tunneling microscopes on hand for recovery and aren't just running a Linux distro with a modified ext3fs to ignore "deleted" inodes. The longest AES key I've cracked is 28 bits (in Python, no less!). Yet we still use a minimum of 128, more likely 256. It's not the guys running recover I'm worried about. It's the spooks with electron f'ing microscopes and a direct connection to AT&T.

Re:From The Experts

[randomc0de]

However, you can pad out the start with zeroes.

Precisely. In my case, I could brute-force keys with 1-28 "real" bits... presumably 29 would have taken twice as long, around 4 hours. I didn't have to heart to put my laptop's little fan through that. Also, keep in mind that a Feistel-type cipher lends itself to variable key sizes, and Rijndael could probably be modified for lower keys sizes. The reason AES specifies Rijndael with a minimum 128 bit key is exactly the same reason you overwrite a disk multiple times. Technically 56 bits is enough, but 128 is only a constant slower, and several orders of magnitude harder to attack.

An urban legend

[Ancient_Hacker]

It's an urban legend. You can't recover erased bits. If you could it would imply that you can store at least two bits in the space of one. Disk companies have a pretty good idea what their heads and surfaces can do. Do you think they'd be passing up big $$$ by under-utilizing their disk's capacity?

There is that one Usenix conference "paper" foating around out there, but if you read it carefully it does not give a single example of one recovered bit.

If you've ever looked at the waveform coming off a disk head, you'd wonder with all the x/y noise and jitter how they can get even ONE bit out of that hairball. The answer is, they can, just barely, by applying all the sync, gating, PLL, and deglitching tricks, just barely reliably recover bits at the maximum recording density possible.

And all those pictures they show of bit patterns lingering under large erased areas are actually counter-examples. They prove that you can detect periodic bit patterns under large erased areas. Duh. In the real world the underlying data is not periodic, and the erasure isn't smooth or periodic either. If you overwrite real typical data with random data, you can't recover the original data. Shannon and company, you know.
 

Re:An urban legend

[fluffykitty1234]

I believe that you might be able to determine that if the current value is a 0, that at some point in the history it was a 1. And vice versa. The problem as I see it is that you wouldn't be able to determine how far in the past. Image if the disk were written:

1, 0, 0

You would probably still have some residual history of the '1'.

If you had a disk that was written exactly 1 time, and then overwritten with 0's, then I would believe you could recover some of the data. But how likely is that?

damn straight!

[larry bagina]

Last month, I challenged every female olympic gymnast to prove she was over 16 by having sex with me. (The age of consent is 16 in my state). To date, every gymnast has ignored me, with the exception of 1 whose boyfriend threatened to kill me. Therefore, we now have proof that all the female olympic gymnasts are under 16 and should be disqualified.

Re:damn straight!

[Anonymous Coward]

You have the same problem the Great 0 Challenge has, your prize is too small!

Not so.

[Jane Q. Public]

If you were a data recovery company, you would gain an ENORMOUS reputation if you were to complete the challenge. And the cost? Shipping.

That is the cheapest publicity they would ever receive... and what publicity they would receive!

Re:Not so.

[DigitAl56K]

That is the cheapest publicity they would ever receive... and what publicity they would receive!

Yes, what publicity they would receive? :) I've never heard of 16systems.com before, their site is barebones with almost no articles. I dare say they caught a lucky break with this Slashdot article. Maybe I'm wrong, but it seems that there is no obvious publicity to be had (before now). And should recovery firms respond to everyone with a small website who issues a challenge?

Re:Not so.

[Henneshoe]

I hope that was sarcasm, because really who hasn't heard of 16systems.com and their (not so) great challenge. The publicity from winning this is next to nothing.

Re:bad terms & conditions

[pegr]

Agreed. They should save the expense of shipping the drive and just email a drive image instead. Being all zeros, it should compress well...

It is NOT an "urban legend"...

[Jane Q. Public]

... it is merely old tech that is no longer relevant. In the old days of sloppy mechanical tolerances (and read-write heads), it was possible to leave traces that were misaligned with the main bits of the current data. With good custom drivers and software, it was often possible to recover some of this data.

This is of course no longer true what with much tighter tolerances, smaller and vertical magnetic domains, and so on. I think that is the point of this challenge.

It is recoverable, but at a price.

[viking80]

It is likely that there is a hysteresis in the platter causing a "0" written on top of a "1" to be slightly "weaker" than a "0" written on top of a "0".

On old tape, this hysteresis was about 10%, and was actually visible with a magnetic loupe, so depending on s/n ratio, you could recover quite a bit, no pun intended.

The problem with a HDD is that the signal from the heads go through a lot of signal processing including Extended PRML or EPRML. There is also an algorithm like RZ to not have a long series of the same bit written physically. If you take the electrical output from the read head, you will have a big task reconstructing the data, even if there only good data.

The only places today that can analyze well what is read physically is at HDD manufacturers research lab, and probably using custom HW to read the platter that collects all the errors and offsets. For a recovery company to do this, they probably would have to invest millions of $$$, so they will not.

So bottom line is that you could send the drive in to Western Digital, and they could probably recover the raw data with about 90% accuracy. If that is enough for the error recovery to chew on, I am not sure, but here and there, long strings would be recovered. They can for sure give the exact probability for the recovery of a bit.

WD however does not have any incentives to demonstrate that wiping their drives with "0" is not sufficient. aux contrare, they may consider this an undesirable property. Therefore, the only ones that can recover this is unwilling.

So the challenge remains unaccepted.

Re:It is recoverable, but at a price.

[glwtta]

So bottom line is that you could send the drive in to Western Digital, and they could probably recover the raw data with about 90% accuracy.

That's a pretty impressive number, to just pull out of your ass.

the drive must be in a living system???

[niiler]

See, here I was thinking a Cylon. Number 6 specifically.

it is PR

[someone1234]

1. if you don't accept this simple the challenge, you definitely scam your customers. Some will take notice, and you lose more.

2. if you accept the challenge and WIN, then you get free advertising. (If you accept but lose, you still get some bad PR, but at least you can say the drive was fake).

Re:it is PR

[arth1]

And the drive being fake is a distinct possibility here. The guy has an agenda, that's pretty clear. And where's the accountability? Why should we believe him when he says what has been done to the drive? Any more than we believe British barristers representing the late Mr. Ongopongo of Nigeria in their claims that they have some millions of dollars they want to give you?
Because we want to believe him, because his claim is very plausible? Sorry, that doesn't increase the accountability or invalidity of this "challenge".

Unless acceptable witnesses can observe (a) the original status of the drive, (b) what was being done to it, and (c) the drive being kept secure from interference from (a) onwards, it must be treated as suspect. No matter how honorable the intent is. Intent is worth shit, and any company or researcher that would be foolish enough to enter this "challenge" would be tainted with same.

Re:it is PR

[ShieldW0lf]

This is bullshit. The terms of the challenge indicate that you cannot disassemble the drive. Real life does not operate under such arbitrary rules, therefore, a failure to meet this challenge does not in any way establish that you cannot recover data from a drive that was treated in this fashion. All it establishes is that 3 random data recovery services are not confident in their ability to use the electronics integrated in the drive to recover the data off the platters. Or, they're not interested in participating in some contest because they've got paying clients to service. Can the data be recovered in a clean room with highly sensitive specialized tools? Who knows?

Re:it is PR

[KillerBob]

Bingo. It's also worth pointing out that the $40 prize offered isn't even close to the normal fees that such companies charge to do data recovery. The cheapest fee I've *ever* seen quoted for a post-format recovery was $1700, and that was a special offer being made to our customer care because of a tech. support fuckup. (they didn't tell the customer that reinstalling the OS would delete all their pictures, and the customer raised a stink).

Such a "title" as the one offered by this so-called "challenge" is hardly worth the effort expended. Especially considering that this article is the first I've heard of it... How is this Slashdot-worthy?

Re:it is PR

[Chaos Incarnate]

There's absolutely no evidence that the drive he ships out is the drive shown in the screenshot after exactly one iteration of dd and no other operations of any kind.

Re:it is PR

[arth1]

Encrypted by whom? Oh, that's right, by him.
Sorry, encryption doesn't lend any kind of credibility to the claim at all. That only makes it harder to change the list from now on, but doesn't validate that the list was correct in the first place. What would be stopping him from zeroing one drive and provide the list from another drive (or make one up), and then encrypt the wrong list? There's no verification process in place, which causes the addition of this encryption step to smell of snake oil, making it slightly less believable than if it had been all in the open.

I'm sorry, but you're taking his word on faith. Which is a very wrong thing to do, even if he is right. It's not the amount of money in question that's the big problem here, but the lack of accountability.

Re:it is PR

[temcat]

The terms of the challenge indicate that you cannot disassemble the drive.

Have you actually read the terms?

"If the challenger is an established data recovery business located in the United States of America (We would need to see Articles of Incorporation, a current business license and one other form of business identification in order to determine that they are indeed a professional, for-profit, established data recovery business) or a National government law enforcement or intelligence agency (NSA, CIA, FBI), then we will allow these type of organizations to disassemble the drive and to keep the drive for thirty (30) consecutive days. "

Re:it is PR

[FLEB]

Well, if a firm thinks they can recover files after a one-round zeroing, they can replicate the challenge themselves, document the entire process to the proper degree, then try the actual challenge to see whether it works the same. If it isn't, it's merely a matter of producing the evidence of their own in-house success and questioning the discrepancy.

Re:it is PR

[cjanota]

He said that individuals could not take apart the drive. He did say that data recovery firms and gov't agencies could take apart the drive and have it for 30 days.

Re:Pop Quiz

[WK2]

Sumary of the fallacies I've seen mentioned on Slashdot so far:
1) lack of reward ($40, plus used 80GB drive worth $30-$40 new, minus shipping).
2) risky. You have to pay a deposit of $60, you have to pay shipping, and you only get the drive for 3 days.
3) You aren't allowed to take the drive apart, which, theoretically, would be necessary for EMF recovery
4) lack of publicity. Many of us didn't even know about the challenge until today. Most professionals probably will have never heard about the challenge even when it is over.

Basically, they are assuming that if nobody does the challenge, that nobody could.

The do have a valid point though. DOD 3-pass is more than enough for 99% of people. Common criminals and the FBI wouldn't recover that, and the NSA might not either. Destroying perfectly good drives is a waste of money and resources, and the practice should stop in 99% of cases.

Unfortunately, 16systems doesn't have enough funding to prove this. It would be nice if a more wealthy person/company would duplicate this challenge, but have several hard drives, pay shipping, have a reasonable reward ($5000+, the more the merrier), and be able to advertise the challenge better.

Re:The whole article is full of comedy gold

[cduffy]

"It can't be done" is a little strong: On older (early-1980s) hard drives it probably could be done. Modern drives, less likely. No-disassembly rule, no chance whatsoever.

That said, "industry best practices" is what it is. When I'm wearing my data security hat for a company managing people's medical records, I'm going to advise that we follow whatever accepted standards are for wiping drives; if FIPS says to degauss the drives, we're damned well degaussing the drives. "Nobody ever got fired for choosing IBM" may be a lousy rule for procurement, but "nobody ever got fired for insisting on industry-accepted security practices" is right on the money.

Prize

[FooGoo]

Hmmm, you get to keep the drive if you win which also means you get to keep any data recovered. If it's filled with pirated music that could add up to a lot of money at $750 per track.

This will sound totally paranoid, but

[bill_kress]

The few people who MIGHT have the capability to look beyond what is written on the drive and see patterns remaining from previous data are most likely the ones who would prefer that the concept remain vague and unproven.

Re:Once in a lifetime marketing opportunity

[bluelip]

The folks that can do this aren't closely interested in what few comments a bunch of /. folks can make about them.

Get a clue. If an organization does this type of work, 1st they're not going to advertise it. 2nd they'll have so much work, they don't need to advertise.

Wake the hell up and get out of VB and java land.

Eh

[OverlordQ]

A graduate of Virginia Tech (Phi Beta Kappa 2000), Brad has experience in systems administration, systems programming and IT management. Today, he primarily works on IT security reviews and writes programs such as Find_SSNs. Brad also assists with incident response, computer forensics, departmental database design and management, and works with students in the IT Security Lab as needed. He holds the SANS GCFA (computer forensics certification) and the GIAC STAR Payment Card Industry certificate.

I think somebody needs their money back from their forensics certification.

Re:Why Can't They?

[zippthorne]

Read the source.

If you feed it a long string of zeros and don't give it any stopping conditions, it activates the drive's vacuum pump and removes all of the air. This step eliminates the cushion keeping the heads off of the disk, so while "writing" zeros, they're also shaving a layer of magnetic material.

This is more than sufficient to wipe your drive and prepare for a fresh install, unless your drive uses vertical bits. Keep in mind, though, that hard drives are like wood floors. You can only plane them two, three times, tops, before they have to be replaced.

Real price is $700

[SuperKendall]

$300? That's for running what's pretty much an "undelete" like any shareware program can do.
$3,000, and you might get what amounts to a sector dump.

Not at all true. I priced this out for a friend that had removed data beyond what the simple undelete commands you mentiioned can do. The real cost is more along the lines of $700, and you get real data files back.

$3000 is more along the lines of, the actual physical disk inside the case has been disturbed and you are talking about recovering whatever data you can. That starts to get real pricey, really quickly.

Where in the hell...

[John Hasler]

...did these guys get the idea that anyone who knew what they were talking about claimed that it was possible to recover data from an overwritten drive without taking it apart?

16 Systems a FRAUD??

[sciop101]

Anybody find an archive of the "The Great Zero Challenge"?

16 Systems website looks like is a web-page assignment from an 1980's HTML tutorial.

The services listed are BASIC/Javascript end-of-chapter exercises.

Dear sir,

[mypalmike]

Kindly sir, I am a Nigerian Prince trying to transfer some data from a zero-ed out hard drive to my cousin in the U.S.A. If you would kindly deposit $60 into my bank account, I will send you the hard drive. Upon your transmission of the data to my cousin, I will promptly return your $60, plus $40 for your effort. You may also keep the hard drive.

Your friend,
Prince Njeme Nawabi, P.O.S.

Wrong interpretation

[Poingggg]

If my interpretation is correct, you're still $20 behind [....] since if you win you get to keep the drive, but apparently aren't refunded your $60 deposit.

Wrong interpretation! From TFA:

If you damage the drive, then your deposit will not be returned.

So, (if MY interpretation is correct) you will always get your deposit back if you return the drive in good order or win.

But I have to agree that it's not quite the amount of money I'd do it for, even if I were able to.

Data can be recovered ...

[Skapare]

... if using older recording technology that has gaps between tracks and records zeros in raw form. Today's recording involves multi-level coding and scrambling, where even all-zeros will have a big mash-up of flux values, and overlaps the gaps to some degree.

If that 80 GB drive that had been zeroed-out with dd had recorded Osama bin Laden's exact location, you can be sure the data recovery experts at certain nameless US government agencies would scramble to get hold of that drive, regardless. And it would not surprise me if they can recover some data from it. They would not be worried about getting their $60 deposit back, and the drive will likely be destroyed as a hard drive as we know it. The tab for such recovery could be in the millions of dollars, but for that kind of data, it would be worth it.

Is the data on your computer with that to someone?

Re:NSA claims to have this

[cduffy]

My mom attended a litigation support conference where NSA actually claimed to be able to read a drive's contents after SEVENTEEN zero overwrites.

Along those lines, I once knew a professor who claimed that the NSA was doing automated keyword scanning on the national phone system in the late seventies. There's quite a lot of uncertainty about just what their capabilities are and aren't... and presumably they like it that way.

Re:The whole article is full of comedy gold

[Bazman]

"No disassembly" doesn't mean you can't tap onto the drive's external circuit board, where you *might* just be able to get the voltages before they go digital, unless the ADC circuitry is inside the housing...

Re:Isn't that the POINT??

[Blakey Rat]

For $40?

I don't do anything IT-related for $40. I'd charge $120 to lean down and press your power button.

Critical line in the Challenge:

[Morosoph]

You may not write any data to the drive or disassemble the drive.

So you're not allowed to (for example) exploit redundancy or error checking on the drive itself? If dd wrote zeros, that's what'll be read unles you can get "lower" than normal drive access.

This challenge has nothing to do with the security of your wipe. Rather, it has everything to do with dd successfully writing zeros given normal access.

Re:Critical line in the Challenge:

[Molochi]

Yeah, when I saw that you weren't allowed to disassemble the drive, I knew they weren't challenging anything more than script kiddies and their corporate equivalents.

This "what do I need to do before I chuck a hdd" conversation has come up before. I'll ask, "How many dollars do you want somebody to spend to get the data?" They, almost invariably respond "I don't want them to be able to get any data." My response usually involves renting a shotgun/smg and some rangetime.

Re:Critical line in the Challenge:

[anilg]

RTFA, they specifically allow disassembling by data recovery organisations and the 3 letter ones to.

Re:Critical line in the Challenge:

[1u3hr]

You may not write any data to the drive or disassemble the drive.

RTFA. (How does someone get modded "insightful" when they haven't?)

That's not in the challenge NOW. It was some months ago, as he didn't want to supply a unlimited number of drives for people to trash, but now the drive does not have to be returned, you can do what you like.

Re:The whole article is full of comedy gold

[darqchild]

Actually, since the voltages are so tiny, the ADC is usually mounted on the arm right next to the heads. You can see it if you open the drive.

The problem is it isn't that simple

[Sycraft-fu]

Long gone are the days when drives stored things in a simple modulation format. That's what MFM hardrives were (MFM means Modified Frequency Modulation). Now harddrives store an analogue wave, and analyze it to determine the maximumly likely result for a given waveform. It's called EPRML, Extended Partial Response, Maximum Likelihood. You can Google for the specifics of how it works, but the general idea is there isn't a certain threshold beyond which something is 1 or 0. Rather it is an analogue wave of varying intensity and by looking at how it changes, the drive's processor can pick out the binary stream it is most likely to represent. Sounds like voodoo, but works really well and is extremely reliable.

Well, that means that data recovery of overwritten data just became a hell of a lot harder. It isn't a matter of saying "Well the current data is a 0, however it is on the high end of 0 so it was probably a 1 before." No now you have to be able to tell what the wave looked like beforehand, and interpret that.

Now maybe there's a way that it is possible, but I'm rather doubtful. There is, of course, also the time factor. Supposing you can do this, how long does it take you to read one byte? A second? A minute? Ok, how long are you willing to spend scouring a drive that has five hundred billion of those bytes? So not only do you need to be able to do this, but you need to be able to do it quite quickly if you are to have any hope of scanning a modern drive in a timescale that is useful.

Well known

[gweihir]

The German computer magazine c't did try to get a disk that was overweritten once with zeros recoverd two years ago or so. All data recovery companies they contacted (all the major ones) said they could not do it and that it was likely impossible. So this is not newa at all. Even Gutman had an addendum that says tomething close for modern disks.

The source of all these stories is that it used to be possible, when disc coatings were more advanced than r/w head and electronics. That is not the case anymore. It is very likely that you cannot put much more data on the disk than a moder HDD does. That also means that a single overwrite is an unrecoverable deletion. Keep in mind, that due to the particulars of the modulation, an all zero overwrite does not take up less of the surfaces data storage cabaliluty as a fully random overwrite.

Basically the pople that claim recovery is possible are one or so decades behind the times. Nothing new.

Get off it.

[Jane Q. Public]

You would do it once for less than $40 if you thought it would make you $400,000 over the next year in new business brought in because you proved you could do it. You would do it at your own expense. You would pay $1,000 to prove you could do it!

THAT is the whole point, in a nutshell. Anybody who could do this would have people lining up at their doors, wanting to lay down money for the service. Failing to even try to prove that they can do it demonstrates only one thing: they can't. The $40 thing is nothing but a red herring. Any company that could, would.

I would bet they are right

[Sycraft-fu]

What people also have to remember is that unless you ARE talking about data with national security type implications, commercial companies are all you are going to be facing anyhow. Sure, it is possible that the NSA or SIS or the like have some secret technique for recovering data from overwritten drives. Guess what? If they do, they aren't telling anyone, and that includes law enforcement, your company, etc. They wouldn't want anyone to know, lest a way be found around it.

Now, as for law enforcement agencies, well they don't have big secret research divisions. They buy products and services from regular commercial companies. Have a look at the weapons police use, for example. While they are sometimes variants that are not available to the general public due to various weapons laws, they are made by firearms providers you've heard of" Glock, Smith and Wesson, Sig Sauer, etc.

Same deal for forensic tools. By and large the most used tool for disk analysis, in fact the only one I've ever seen, is EnCase. It basically images an entire drive (including all empty space) and then allows you to look through it in various useful ways. However, this means that it is only looking at data currently on the drive. Anything overwritten even once isn't visible to it, since it is just pulling data through the drive's normal interface.

As a practical matter, the tools law enforcement uses need to be known because they are going to be scrutinized in court. In pretty much any court in any free nation when the question "What method was used to find this data?" is asked, an answer of "We can't tell you," isn't going to cut it. You discover that forensic methods of all sorts are subject to scrutiny. The way that DNA matches are done, the method for comparing paint chips, etc, all are open to be looked at. The investigators can't just say "Ummm ya, the DNA matches. We can't tell you how we know, we just do." Same deal for digital forensics.

So while there's certainly nothing wrong with running a good wipe as a CYA sort of measure, this paranoia of "OMG they can read your data no matter what!" needs to stop. For example we do DOD 5220.22 wipes at work because it is a good way to have ourselves covered if anyone asks. After all, it's an official DOD standard, if it's good enough for them it's good enough for us. However I've no illusions that it is necessary over a simple zeroing of the disk. Maybe if I was worried about the NSA reading our disks, but I'm not.

Yes intelligence agencies go to some extreme lengths (like wiping a disk, grinding it up and melting it down) but that's not because they think that is all needed, but because they don't want to find out they are wrong. When you are protecting national secrets, you don't take chances. However if you aren't, and people here aren't, then this paranoia is rather silly.