Slashdot Mirror
Single Drive Wipe Protects Data
ALF-nl writes "A forensics expert claims that wiping your hard drives with just one pass already makes it next to impossible to recover the data with an electron microscope." But that's not accounting for the super secret machines that the government has, man.
Just use encryption (of your whole drive or partition) and forget about wiping it.
It's not that hard. For example, several modern Linux distros support encrypting your entire installation out of the box.
-- MartinG To mail me: echo kewyjlcxyzvjfxbqwh | tr bcefhjklqvwxyz
1) next to impossible != impossible
2) if the feds require multi-pass wipes for non-classified data and media destruction for classified data, why should I settle for anything less?
OK, maybe this guy is right and maybe the feds are behind the times, but I'd like to see multiple independent studies come out and say this before I'm getting rid of my drive sanitizers. I mean, we all know what happens to societies when they get rid of their equipment sanitizers, don't we?
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
It's the difference between what slashdotters enjoy doing to old hard drives and what's actually required to securely destroy the data on them.
Ita erat quando hic adveni.
Writing random numbers would be more sufficient than just zeros.
For example painting a wall with one layer of white paint could still show the outlines of a gratify underneath that layer.
But if you would use various colors all over the place it would become very hard to identify any shape beneath it even if you where using just one layer.
[pulls tinfoil hat tighter over head]
Sure, that's just what they want you to think.
Even if it isn't deleted, try to recover a simple 10Mb jpg using an electron microscope... I guess it is as close to the "next to impossible" as if the file was deleted.
If there were a reliable way to read the previous value of a bit written to a drive, the drive manufacturers would already be using it to increase density -- effectively storing two bits in the space of one. This is similar to the basic principle of MLC flash drives.
Which, of course, would still make it impossible to recover data that has been overwritten, since each "bit" would be overwritten twice.
It seriously depends on your crime as to how far police will go to obtain data from a hard disk.
If, for instance, to kill no more than three people in cold blood. They won't even look.
If, you have a few ounces of pot, the DEA will use the FBI forensics labs.
If you have a history of violence and have beaten countless women, they won't even look.
If you've given more than a few hundred bucks to an Islamic charity, the NSA will step in.
If you bilk hundreds or thousands of people out of millions of dollars, they won't even look.
if you are accused of fighting on the train in San Fransisco, they'll just hold you down and shoot you in the back. Fuck the computer.
DD is probably the best bet for discarded/ebay'ed drives. I can't think of anyone who has the time or resources to dig up my data. If you're a fortune 500 company, or an international drug/arms/people/whatever smuggler, then you probably want to just go ahead and shred the drive. That way you don't have to worry about Joe skipping out early on Friday and forgetting to wipe the out-going CEO's drive.
For the rest of us, just think about the economics of it; what criminal organization has access to a lab full of electron microscopes and has the time and money to search discarded drives for credit card information? Perhaps a large government has access to these resources, but once again, unless you're really up to no good or have a large company, why would anybody bother?
Thank goodness for a suddenoutbreakofcommonsense here.
This one's tricky. You have to use imaginary numbers, like eleventeen... --Hobbes
From the article:
A coin toss is usually referenced as the worst way to try and predict a 50:50 chance event. Disregarding all of the obvious problems (i.e. - that the bits on a hard disk do not have a 50:50 distribution (unless compressed or encrypted), and that a coin is not necessarily the most random thing, I'm still left with a puzzler
If his methods have less chance of prediction than a coin toss, all he has to do is add a "not" gate at the end of his prediction algorithm, and he'll have better chance than a coin toss.
To take this to an extreme, assuming random incoming data, a coin toss has 50% chance of a hit for the next bit. If you find a method that has a 0% chance of a hit, then just flip its output and you'll get a 100% chance of a hit. Lower chances than a coin toss actually mean a good prediction ability
Shachar
To me a more valid concern is the following linear time algorithm to break encryption: /dev/randing a hdd is so easy that if you are paranoid to encrypt your whole hdd, including swap and filenames, then you might as well erase you hdd just to be on the safe side.
1) Invest $1000.
2) Making use of Moore's law, wait until $1000 is enough to buy a machine that can break that now old outdated encryption.
3) Profit!
It seems to me that zeroing or
I've sent a drive in for data recovery before and was asked which operating system to recover: solaris or Windows NT....
A reinstall is not a drive wipe in regards to forensics. While IT may call it a wipe and refresh the data is easily recovered. It's this confusion between delete, reinstall, format, and wipe that starts unfounded rumors. Not to mention the differences between different file systems.
A wipe is a writing data to EVERY sector. A format does not wipe, a deletion does not wipe and wiping is not common practice. With the size of drives today, you'd practically have to leave it going overnight. Most drives go their whole life without ever once being wiped.
Like the Lemur King Julian said in the movie Madagascar:
"Who wipes?"
Seriously though, anyone sufficiently interested in protecting data can do it in numerous ways.
I used a script to sanitize drives used in forensic collection. First pass writes from /dev/urandom, second pass writes from /dev/zero.
When drives died or became unuseable they would meet a sledgehammer moving at high velocity.
"Lame" - Galaxar
> which is surely worth the time and effort involved in something like this.
Hardly. I think that you'll find that the machines required rent for more than $500/hour.
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
The guy's a forensics expert. Of course he's going to tell you one wipe is enough. If you do more than that, he might be out of a job.
I'm surprised he didn't say "It's cool man, just write 'DELETED' in sharpie on the case and your drive will never function again. *snicker*"
It's rare that you're presented with a knob whose only two positions are Make History and Flee Your Glorious Destiny.
There's a reason no one has accepted this challenge. At the very bottom: "You also must publicly disclose in a reproducible manner the method(s) used to win the challenge"
No self-respecting data recovery firm is going to take this challenge. My guess is that most places CAN recover the data, but they're under NDA not to disclose how. If this challenge was open to just anyone, I'd take it in a heart beat. My process would be:
Take drive to Ontrack
Pay $100
-wait-
take file list to challenge sponsor
But alas I cannot do that, so as curious as I am, I'm not willing to spend $100 to find out.
$500! Hot damn. That sure is a pretty penny to pay for something as EXOTIC AND EXPENSIVE as magnetic force microscopy.
Nice theory, but totally full of shit.
I've done contracting for the government, and worked on a proposal which would have required "Secret" clearance for all staff involved. I have also worked with medical records for the local health authority. Finally, I've worked for oil companies that have both liability of both customer records and planned exploration/acquisition to keep private.
You're making the mistake that everyone else on /. is just like you, huddled at home, worried about their pr0n collection. However, some of us are actually computing professionals, working in sensitive areas. Hopefully none of us are using /. as their sole source of useful information, but it's definitely not a bad tertiary source of input.
"People who do stupid things with hazardous materials often die." -- Jim Davidson on alt.folklore.urban
That's why the DoD has lowered their standards to a single fixed wipe and to prove it is going to send all of their super secret hard drives to china to be proven that the data is unreadable.
Because the DoD makes ALL its decisions based on sound science. That's why the Air Force took over the CIA's sponsorship of remote viewing in 70s, why the Navy funded research into cold fusion and anti-grav, and why we're buying hand-held polygraphs for troops in Afghanistan.
I mean, I had the same knee jerk suspicion, but I'm not going to hold up the DoD's standards as proof of anything but potentially reasonable paranoia. The Pentagon has a long-demonstrated sweet tooth for junk science.
If it's for-profit but free, you're not the customer -- you're the product (e.g., the Slashdot Beta's "audience").
If anyone can recover data from a dd if=/dev/zero of=/dev/sda hard drive, I suspect $500 isn't enough financial incentive for that person to reveal his/her ability to do it. $500,000, then we're talking.
I once had a signature.