Fact or Fiction?

[Firn]

I work with hard drive repair. (In Brazil there is actually a market for this) We have hundreds (if not thousands) of hard drives and as I'm sure everyone knows, a very small percentage of them are actually repairable.

Most of the hard drives we work with are from banks, resulting in mostly confidential information. My question is this:

In movies I have seen how "hackers" erase all evidence using like a "blue light" to wipe information in seconds. If such equipment really exists, what is it called, where can we get it, and how does it work? (Could it be built?) We take pride in handing back the trash to them with no information whatsoever, but it is not always possible to erase the hard drives, and even so - it takes too much time.

I realize that this forum is mostly for hard drive repair and recovery of data - not destuction of data

Thanks in advance ...

[Doomer]

No you can't
using lasers you can only read data, not write it

[aimtrading]

It's impossible to 'erase' data for good. A lot of development has been made in data recovery. Even after 50 formats they can still restore original files. I know there are tools out there to 'zap' data for good, but none of them can make sure that the data is REALLY gone.

The only way to really wipe data is to melt the HDD

[Doomer]

Even after 50 formats they can still restore original files.

This is bullshit

[aimtrading]

Even after 50 formats they can still restore original files.

This is bullshit

Maybe badly phrased, but calling it bullshit is an opinion, since the statement can't be falsified.

While a HDD represents digital information, the magnetic platters are analogue itself. A '1' in digital form isn't exactly a '1' in the magnetic form. The small deviances can be analysed and used to make a prediction of several layers backwards. Even Gutman himself, who did the original research (http://www.cs.auckland.ac.nz/~pgut001/p ... e_del.html), said that his 35 times formatting technique couldn't assure that data is really 'gone'.

The best tool IMHO to 'wipe' a HDD is 'DBAN', which can be downloaded here:

http://dban.sourceforge.net

Even this coder states in the FAQ on his site that you might have a problem when "somebody with a lot of time, money, and brains needs to recover your data. "

You simply can NOT be 100% sure that your data is really gone. If you really want to be sure, just take Darik's (the coder of DBAN) advice and melt all parts.

[Doomer]

Even Gutman himself, who did the original research (http://www.cs.auckland.ac.nz/~pgut001/p ... e_del.html), said that his 35 times formatting technique couldn't assure that data is really 'gone'.

It has alredy discussed
NOBODY with ANYTHING can restore information from modern HDD if this information has rewrited once
And if you read this article carefully you can observe what they trying to use floppy disks for examples - floppy disk has completle different type of data writing
People wasting years for getting information about modern HDDs data internal encoding (for getting data directly from the drive platters), but this data should be on the platters
And nobody can get data if it was rewrited
I know this, because my company is working on it
You could read this document if you want - http://actionfront.com/ts_whitepaper.aspx

[Doomer]

A '1' in digital form isn't exactly a '1' in the magnetic form.

And you will surprise
Modern HDDs do not use "1" or "0" for storing data on the platters
They use analog signals, very,very difficult analog signals
And for decoding this and be sure what you get exactly what you want you must read this signals at least 3 times (if you use direct reading and decoding, like we do)

[Daniel Ferreira]

About Gutmann's paper, I believe that most people don't understand it, maybe because they may have been recovering and repairing disks for years but don't know enough about the physics of magnetic recording, which is the real thing in this discussion.

The fact that there are a lot of tools around that use the 35 pass method is the proof that a programmer can write a good piece of software for erasing data that works but not necessarily in an intelligent way. The result, as good it may be, is ridiculous from a simple scientific stand.

Also, there are a lot of people writing in data recovery foruns and talking about data restore from burned and oxidated platters and so on. They never did it, but they always know someone who knows a guy who did it.

And finally, why do people insist that it is not possible to recover overwritten data from modern disks, but it possible to do it from floppies? Floppy heads have two more ones from each side (you can see them by yourself, just open the case and look). Their role is to erase side bands caused by track shifting, to avoid cross-talking interference with old data, the data that MFM pretends to recover...

There are some papers that debunk this myth of MFM and data recover, so please read them:

http://www.nber.org/sys-admin/overwritt ... ttman.html
http://www.actionfront.com/ts_whitepaper.aspx (Recovering Unrecoverable Data - The Need for Drive-Independant Data Recovery)

Daniel

[Reo51st]

I’m surprised that no one mentioned DoD 5220.22-M. Google it. That is the basic standard and is required by most banks and financial institutes for wiping drives.

Good luck.

[Doomer]

I’m surprised that no one mentioned DoD 5220.22-M. Google it. That is the basic standard and is required by most banks and financial institutes for wiping drives.

Good luck. :)

So, there are many stupid people who believe in "magic recovery of wiping data", and smart people create "standards" for best selling :)

[Reo51st]

Stupid is as stupid does!!! Do like we used to, take the platters out and grind them. When you have GLCM data on them better safe than sorry. Wouldn't want the info to fall into the wrong hands. We always had someone from the other side of the wall trying to get at info like that.

[Daniel Ferreira]

I’m surprised that no one mentioned DoD 5220.22-M. Google it. That is the basic standard and is required by most banks and financial institutes for wiping drives.

Good luck.

A standard? Wow! So what?

[Doomer]

Do like we used to, take the platters out and grind them.

You also can use a bullet or "molecular destroyer" or "supercrapyfuckingdatakiller"
smart guys will use one wiping cycle, because it's enough

[Daniel Ferreira]

Do like we used to, take the platters out and grind them.

You also can use a bullet or "molecular destroyer" or "supercrapyfuckingdatakiller"
smart guys will use one wiping cycle, because it's enough

Maybe we need a standard for destroying disks with nuclear weapons. A bullet will leave tiny pieces, which CIA or FBI can scan with their magic-wonder-super data recovery machines (I think I heard about one in a movie...). And the molecular destroyer is useless, because I know a guy who knows a guy who knows a guy who knows a guy who has a cousin who works for the government and can recover your bits even if they are turned into sub-atomic particles. Watch your back!

Daniel

[Daniel Ferreira]

Back into Gutmann, as I said, I think that most people don't understand it. If you read it carefully, the 35 pass method is part of the experiment, not of the conclusion.

In matter fact, he criticizes the use of 35 passes and he acknowledges that since the first edition of his article several data wiping tools showed up using that method, but it is not worth.

But this is only part of the story. Gutmann did not recover data, what he recovered were raw bits from disk surface, which is a completely different thing...

Daniel

[aimtrading]

So, there are many stupid people who believe in "magic recovery of wiping data", and smart people create "standards" for best selling

Imagine, that you are the IT manager of a bank. Your bank has a harddrive with all account numbers and passwords from your clients. Now you want to upgrade your server and replace your HDD with a bigger one. Now, are you going to wipe it once, because some guys at some tech forums say that this should be enough ? Or are you going to degauss it and burn it because you just NEED to be 100% sure ?

I get what you guys are saying, it will be VERY hard to recover data, even after 1 swipe, but I can also imagine situations where just wiping it once won't give you the 100% assure you NEED....

[Doomer]

Imagine, that you are the IT manager of a bank. Your bank has a harddrive with all account numbers and passwords from your clients. Now you want to upgrade your server and replace your HDD with a bigger one. Now, are you going to wipe it once, because some guys at some tech forums say that this should be enough ? Or are you going to degauss it and burn it because you just NEED to be 100% sure ? ;)

The question is "is it possible to recovery data from once wiped drive?" the aswer is "NO"
And "IT manager" can do whatever he wants

[BlackST]

One thing is fiction and movies, one thing is REAL LIFE: the difference is made of the relevancy of the information on the HDD. Let's make it clear : with advanced magnetic microscopy techniques you can "see" the 1 and 0s on the surface, but you still have to decode the information.
How is done ? For low density recording you have to put on the surface (it works on platters, magnetic tapes and on the mylar surface of the floppy disks) a revealer, that is a dispersal of ferromagnetic material on a liquid base. The orientation of the particles depends on the magnetic field around, and every bit of information on the platter is like a small magnet, capable of orienteering the particles of the revealer.
Then you can watch the result with a powerful electronic microscope.
How much does it cost and how many facilities capable of doing this are available ?
About laser reading : I haven't seen any laser capable of reading a platter or even magnetic tape or floppy. That's why we use DVDs, don't we ?
And anyway, one thing are experimental studies on hi-tech labs , other things are real life. Don't dream.
The only thing I think could lead - theoretically - to get the data back could be analyzing the magnetic field OUTSIDE the recording track, because when recording (shifting the poles of the infinitesimal magnets) the information , something happens NEAR the track. But you have again to decode the information, discriminate between data and noise and so on.
If a hard drive contains crucial information , simply degaussing the surface I think could destroy the information , but the drive will be unusable (the servo tracks and also the firmware zone will be destroyed, too).
A simple cycle of writing specific patterns of 1 and 0 (for example, 1010101010 , then 01010101 , then 11111111, then 00000000) could destroy even the toughest "memory" of the magnetic material, remember you have to make UNRECOGNISABLE the information.
I know no one has got the data back but a few bits on such HDDs.
You can more easily reconstruct information stored on heavily degaussed magnetic tapes because you only have to amplify the signal and process it, but on the digital world the things are different.
BTW, the new drives are using vertical recording techniques that make the things more complicated.
One issue could be the G-LIST sectors : during use, it's normal for every HDD to develop bad sectors that are automatically locked out and replaced with spare ones. The "bad" sectors are added to a list but the information is still there, and one sector could contain 512 bytes of data, sufficient for storing your personal info. !!!
The P-LIST (primary list of defects discovered at factory level) could not be important because when you start using a new drive, those sectors are already locked out.
So, a correct roadmap for securely destroy the data (and make it NOT ECONOMICALLY recoverable and also unaccessible to the majority of all poor mortals ) could be clearing the G-LIST, then writing sequential patterns of 1 and 0 as I said above , and then writing random pattern characters on each sector.
If you have the right knowledge, also, you can destroy adaptive data and firmware zone, write patterns on it (if possible).... and then give it to anyone you know is able to recover data....
I tried not to be so "technical" , further deep explanations go beyond the purpose of this forum, but the argument is very very actual and interesting.
Tell me what you think about what I said.
Regards.

[Doomer]

About laser reading : I haven't seen any laser capable of reading a platter or even magnetic tape or floppy. That's why we use DVDs, don't we ?

magnetic field can refract the coherent laser ray, this is a principle of operation of this device. This device is using for analyzing quality of HDD platters (you can get full magnetic image of surface for a few seconds)

A simple cycle of writing specific patterns of 1 and 0 (for example, 1010101010 , then 01010101 , then 11111111, then 00000000) could destroy even the toughest "memory" of the magnetic material, remember you have to make UNRECOGNISABLE the information.

the modern HDDs do not use binary writing on the platters

So, a correct roadmap for securely destroy the data (and make it NOT ECONOMICALLY recoverable and also unaccessible to the majority of all poor mortals :D ) could be clearing the G-LIST, then writing sequential patterns of 1 and 0 as I said above , and then writing random pattern characters on each sector.

The modern HDDs use special RLL encoding (and also ECC encoding) of data for prevent creating sequential patterns like 111111111111 or 000000000000, and this on digital read channel level on analog level HDDs use PRML analog encoding of this RLL and ECC encoded data

[BlackST]

Some explanation :

1) when I said that I haven't seen any laser for reading magnetised surfaces, I intended COMMERCIAL applications readily available, not multi-million dollar appliances used in hi-tech labs.
If you have to extract data from well-erased HDD , no law enforcement agency or government or private institution will pay million dollars for making such experiments... with small probability of getting what they want.

2) For "pattern" I intended writing BYTE SEQUENCES, for example, if a sector is made of "n" bytes, you fill the "n" bytes with 00 , FF , 51 and so on (in hex notation). The data used for error corection and check will be updated automatically (when something goes wrong with a sector you can have all the data in the sector OK and the ECC / CRC bad or vice-versa....) . Usually (during normal operations) all the error correction and encoding is transparent and done at hardware level when writing, the final risult is the magnetization of the surface on the sector , that's where we record and retrieve data....

I was trying to be not so "technical" as the posts are read even by newbies, if we have to speak about encoding techniques this goes beyond the purposal.

Anyway thanks for the attention, the thread goes on....

Regards.