Slashdot Mirror
Single Drive Wipe Protects Data
ALF-nl writes "A forensics expert claims that wiping your hard drives with just one pass already makes it next to impossible to recover the data with an electron microscope." But that's not accounting for the super secret machines that the government has, man.
Just use encryption (of your whole drive or partition) and forget about wiping it.
It's not that hard. For example, several modern Linux distros support encrypting your entire installation out of the box.
-- MartinG To mail me: echo kewyjlcxyzvjfxbqwh | tr bcefhjklqvwxyz
1) next to impossible != impossible
2) if the feds require multi-pass wipes for non-classified data and media destruction for classified data, why should I settle for anything less?
OK, maybe this guy is right and maybe the feds are behind the times, but I'd like to see multiple independent studies come out and say this before I'm getting rid of my drive sanitizers. I mean, we all know what happens to societies when they get rid of their equipment sanitizers, don't we?
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
It's the difference between what slashdotters enjoy doing to old hard drives and what's actually required to securely destroy the data on them.
Ita erat quando hic adveni.
[pulls tinfoil hat tighter over head]
Sure, that's just what they want you to think.
It seriously depends on your crime as to how far police will go to obtain data from a hard disk.
If, for instance, to kill no more than three people in cold blood. They won't even look.
If, you have a few ounces of pot, the DEA will use the FBI forensics labs.
If you have a history of violence and have beaten countless women, they won't even look.
If you've given more than a few hundred bucks to an Islamic charity, the NSA will step in.
If you bilk hundreds or thousands of people out of millions of dollars, they won't even look.
if you are accused of fighting on the train in San Fransisco, they'll just hold you down and shoot you in the back. Fuck the computer.
From the article:
A coin toss is usually referenced as the worst way to try and predict a 50:50 chance event. Disregarding all of the obvious problems (i.e. - that the bits on a hard disk do not have a 50:50 distribution (unless compressed or encrypted), and that a coin is not necessarily the most random thing, I'm still left with a puzzler
If his methods have less chance of prediction than a coin toss, all he has to do is add a "not" gate at the end of his prediction algorithm, and he'll have better chance than a coin toss.
To take this to an extreme, assuming random incoming data, a coin toss has 50% chance of a hit for the next bit. If you find a method that has a 0% chance of a hit, then just flip its output and you'll get a 100% chance of a hit. Lower chances than a coin toss actually mean a good prediction ability
Shachar
Define next to impossible
The researcher did. From TFA:
Recovering a single byte of data, for example, on a used drive is successful less than one percent of the time, he found. Accurately recovering four bytes, or 32 bits, of data only works nine times out of each million tries.
So, 1 specific byte of data could be recovered 1% of the time, 4 bytes -> .0009%.
Extrapolating to 10Mb is about 1/10^(10^6 / 8)=0% according to my calculator which keeps goes to 10^-324. So, I think 'next to impossible' is a pretty accurate term.
Like the Lemur King Julian said in the movie Madagascar:
"Who wipes?"
Seriously though, anyone sufficiently interested in protecting data can do it in numerous ways.
I used a script to sanitize drives used in forensic collection. First pass writes from /dev/urandom, second pass writes from /dev/zero.
When drives died or became unuseable they would meet a sledgehammer moving at high velocity.
"Lame" - Galaxar
The guy's a forensics expert. Of course he's going to tell you one wipe is enough. If you do more than that, he might be out of a job.
I'm surprised he didn't say "It's cool man, just write 'DELETED' in sharpie on the case and your drive will never function again. *snicker*"
It's rare that you're presented with a knob whose only two positions are Make History and Flee Your Glorious Destiny.
That's why the DoD has lowered their standards to a single fixed wipe and to prove it is going to send all of their super secret hard drives to china to be proven that the data is unreadable.
Because the DoD makes ALL its decisions based on sound science. That's why the Air Force took over the CIA's sponsorship of remote viewing in 70s, why the Navy funded research into cold fusion and anti-grav, and why we're buying hand-held polygraphs for troops in Afghanistan.
I mean, I had the same knee jerk suspicion, but I'm not going to hold up the DoD's standards as proof of anything but potentially reasonable paranoia. The Pentagon has a long-demonstrated sweet tooth for junk science.
If it's for-profit but free, you're not the customer -- you're the product (e.g., the Slashdot Beta's "audience").
If anyone can recover data from a dd if=/dev/zero of=/dev/sda hard drive, I suspect $500 isn't enough financial incentive for that person to reveal his/her ability to do it. $500,000, then we're talking.
I once had a signature.