Dave Plater wrote:

Hans defaber wrote:

...

What is the best (easiest) way to overwrite old harddisks with random garbage ?

thanks, Hans Hi, use badblocks

Make sure you use the -w flag if you use this method

Dave

-- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

On Wednesday 26 March 2008 14:16, Jim Staunton wrote:

Hans defaber wrote:

...

What is the best (easiest) way to overwrite old harddisks with random garbage ?

Have a look at shred - 'man shred' will explain how to use it...

Jim

If you are to toss the drive: Use a 10 mm drill . Just make a couple of holes thru the whole case and you are done. Fast, secure and cheep... I've done that procedure at work where a bank left some workstations to be disposed of. A nice 10 mm drill, redecorate the case to resemble a swiss cheese.. and presto! Nothing is getting of THAT drive in a hurry...

On Thursday 27 March 2008 03:45, JB2 wrote:

On Wed 26 March 08, Rikard Johnels wrote:

...

On Wednesday 26 March 2008 14:16, Jim Staunton wrote:

...

Hans defaber wrote:

...

What is the best (easiest) way to overwrite old harddisks with random garbage ?

Have a look at shred - 'man shred' will explain how to use it...

Jim

If you are to toss the drive: Use a 10 mm drill . Just make a couple of holes thru the whole case and you are done. Fast, secure and cheep...

I've done that procedure at work where a bank left some workstations to be disposed of. A nice 10 mm drill, redecorate the case to resemble a swiss cheese.. and presto! Nothing is getting of THAT drive in a hurry...

It's more fun to set the hdd up on a fence or rock and target practice on it with a Colt .45 or .223 rifle.

-- "Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety." Benjamin Franklin

Religion - it's not just for breakfast anymore...murderers, dictators, child molesters and all other similar ilk use it daily too!

True. But here in Sweden the arms laws are a bit more regulated. Not too much free shooting like that i'm afraid... Its pure fun tho :P

JB2 schreef:

On Wed 26 March 08, Rikard Johnels wrote:

...

On Wednesday 26 March 2008 14:16, Jim Staunton wrote:

...

Hans defaber wrote:

...

What is the best (easiest) way to overwrite old harddisks with random garbage ?

Have a look at shred - 'man shred' will explain how to use it...

Jim

If you are to toss the drive: Use a 10 mm drill . Just make a couple of holes thru the whole case and you are done. Fast, secure and cheep...

I've done that procedure at work where a bank left some workstations to be disposed of. A nice 10 mm drill, redecorate the case to resemble a swiss cheese.. and presto! Nothing is getting of THAT drive in a hurry...

It's more fun to set the hdd up on a fence or rock and target practice on it with a Colt .45 or .223 rifle.

Yes, that is very nice.. ;) -- Enjoy your time around, Oddball (Now or never...) Besturingssysteem: Linux 2.6.25-rc5-git2-5-default x86_64 Current user: oddball@AMD64x2-sfn1 System: openSUSE 11.0 (x86_64) Alpha3 KDE: 4.00.66 (KDE 4.0.66 >= 20080313) "release 6.1" -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

On March 26, 2008 11:50:59 pm Sam Clemens wrote:

Rikard Johnels wrote:

...

On Wednesday 26 March 2008 14:16, Jim Staunton wrote:

...

Hans defaber wrote:

...

What is the best (easiest) way to overwrite old harddisks with random garbage ?

Have a look at shred - 'man shred' will explain how to use it...

Jim

If you are to toss the drive: Use a 10 mm drill . Just make a couple of holes thru the whole case and you are done. Fast, secure and cheep...

I've done that procedure at work where a bank left some workstations to be disposed of. A nice 10 mm drill, redecorate the case to resemble a swiss cheese.. and presto! Nothing is getting of THAT drive in a hurry...

If the information is extremely secret, be sure to mutilate the surfaces of the disks. Otherwise, I can just take the platters to the drive's manufacturer, and have them put in side a case of another identical drive.

5 pound sledge hammer is also a useful device. Bonus: no electricity.

I have used DBAN with good effect. I have a friend who works for the government in an IT security shop, and the best tool that he has for recovering data from erased hard drives can't find anything usefull after DBAN is done with a drive. http://dban.sourceforge.net/ -- Jeremy Baker GnuPGP fingerprint = EE66 AC49 E008 E09A 7A2A  0195 50EF 580B EDBB 95B6 -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Jim Staunton wrote:

Hans defaber wrote:

...

What is the best (easiest) way to overwrite old harddisks with random garbage ?

Have a look at shred - 'man shred' will explain how to use it...

LOTS of caveats there. Most data which is that valuable is also being kept on journaled filesystems and probably RAID, too...both of which violate shred's assumptions. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Sam Clemens wrote:

Jim Staunton wrote:

...

Hans defaber wrote:

...

What is the best (easiest) way to overwrite old harddisks with random garbage ?

Have a look at shred - 'man shred' will explain how to use it...

LOTS of caveats there.

Most data which is that valuable is also being kept on journaled filesystems and probably RAID, too...both of which violate shred's assumptions.

I thought the discussion was about disposing of old hard drives. Data retained in a live system is not relevant to the point. -- Use OpenOffice.org http://www.openoffice.org -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

On Wednesday 26 March 2008 11:00:40 am Jeffrey L. Taylor wrote:

Quoting Hans defaber :

...

What is the best (easiest) way to overwrite old harddisks with random garbage ?

To do a whole harddisk I use Deriks Boot and Nuke, and it comes in two formats CD ISO and Floppy. The bad thing about it is that its pretty much a waste of a CD because its not even 3 MB, also I wouldn't call it easy its not very well documented so it will take some time to figure out what it is doing. The good thing is it can do anything from a quick wipe, one pass writing 0s on the whole disk (Recommended for internal use only) to a Guttman wipe, 36 passes writing 0s (Most secure wipe it can do), I also beleave that you can customize it to wipe as many times as you want it to.

On Wednesday 26 March 2008 08:30, James Knott wrote:

Hans defaber wrote:

...

What is the best (easiest) way to overwrite old harddisks with random garbage ?

thanks, Hans

Install Windows? ;-)

already have a bootable linux? how about dd if=/dev/random of=/dev/hdd where hdd is the disk you want to wipe?

Actually, I assume you want to make sure there's no data on them, before tossing. There are utilities available for download. I think there's one called Disk Wipe or similar. Or you can simply copy from /dev/random using dd

-- Use OpenOffice.org http://www.openoffice.org

-- David Bear College of Public Programs/ASU 411 N Central, Phoenix, AZ 85004 -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Greg Freemyer schreef:

On Wed, Mar 26, 2008 at 6:38 AM, Hans defaber wrote:

...

What is the best (easiest) way to overwrite old harddisks with random garbage ?

thanks, Hans

Lots of ways, but the easiest is "dd if=/dev/zero of=/dev/sdX bs=4k conv=noerror"

Basically everything beyond that is overkill. Even NIST has started buying off on the above for drive 20GB or larger. holding confidential data (Older, less dense drives need more passes, random data, etc.) For more secret data, they require physical destruction I think.. I have not seen any docs that cover drives holding top secret data etc.

If you need a boot CD/floppy look into dban.

If you think you data is worth someone attempting a multi-million dollar recovery on and you think their is an ultra-secret government agency that actually has some SciFi like ability to recovery overwritten data, then take it apart and belt sand the magnetic media off of each platter. You should probably do that while wearing an aluminum hat. That way they can't be reading your mind during the process and somehow be using you as a transmitter to read your data.

Greg

Yes an aluminium hat... lol. -- Enjoy your time around, Oddball (Now or never...) Besturingssysteem: Linux 2.6.25-rc5-git2-5-default x86_64 Current user: oddball@AMD64x2-sfn1 System: openSUSE 11.0 (x86_64) Alpha3 KDE: 4.00.66 (KDE 4.0.66 >= 20080313) "release 6.1" -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Sam Clemens schreef:

Oddball wrote:

...

Greg Freemyer schreef:

...

On Wed, Mar 26, 2008 at 6:38 AM, Hans defaber wrote:

...

What is the best (easiest) way to overwrite old harddisks with random garbage ?

thanks, Hans

Lots of ways, but the easiest is "dd if=/dev/zero of=/dev/sdX bs=4k conv=noerror"

Basically everything beyond that is overkill. Even NIST has started buying off on the above for drive 20GB or larger. holding confidential data (Older, less dense drives need more passes, random data, etc.) For more secret data, they require physical destruction I think.. I have not seen any docs that cover drives holding top secret data etc.

If you need a boot CD/floppy look into dban.

If you think you data is worth someone attempting a multi-million dollar recovery on and you think their is an ultra-secret government agency that actually has some SciFi like ability to recovery overwritten data, then take it apart and belt sand the magnetic media off of each platter. You should probably do that while wearing an aluminum hat. That way they can't be reading your mind during the process and somehow be using you as a transmitter to read your data.

Greg

Yes an aluminium hat... lol.

In college, this was part of my .plan(*)

Although you might have tinfoil in your hat to keep me from reading your mind, *I* have aluminum underwear!

(*) At the time, .plan files were the equivalent of a web home page. Edit a file .plan in your home directory, and then run this command.

$ finger [your_username_here]

Not much to google.... http://sunsite.ualberta.ca/jargon/html/P/plan-file.html http://sunsite.ualberta.ca/jargon/html/F/finger.html oddball@AMD64x2-sfn1:~> finger oddball Login: oddball Name: Oddball Directory: /home/oddball Shell: /bin/bash On since Thu Mar 27 09:35 (CET) on :0 (messages off) from console No Mail. No Plan. oddball@AMD64x2-sfn1:~> I get the point...... I renamed a textfile to .plan, but finger did not read it.. How to make a .plan file? -- Enjoy your time around, Oddball (Now or never...) Besturingssysteem: Linux 2.6.25-rc5-git2-5-default x86_64 Current user: oddball@AMD64x2-sfn1 System: openSUSE 11.0 (x86_64) Alpha3 KDE: 4.00.66 (KDE 4.0.66 >= 20080313) "release 6.1" -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Sam Clemens schreef:

strange. Back in the 80's, all we had to do is create it. Just tried on my system, still works as expected for me.

Is it located in ~/.plan? It MUST be in your home directory, not any of the sub-directories.

That i did not do, i just had it plain, not hidden, as i never have heard of it before, i did not know. Will try that, create ~/.plan ;) -- Enjoy your time around, Oddball (Now or never...) Besturingssysteem: Linux 2.6.25-rc5-git2-5-default x86_64 Current user: oddball@AMD64x2-sfn1 System: openSUSE 11.0 (x86_64) Alpha3 KDE: 4.00.66 (KDE 4.0.66 >= 20080313) "release 6.1" -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Sloan schreef:

jjs logged in on einstein Thu Mar 27 13:54:54

Plan: world domination einstein: /home/jjs (tty/dev/pts/7): bash: 1002 >

Good plan! LOL.. ;) -- Enjoy your time around, Oddball (Now or never...) Besturingssysteem: Linux 2.6.25-rc5-git2-5-default x86_64 Current user: oddball@AMD64x2-sfn1 System: openSUSE 11.0 (x86_64) Alpha3 KDE: 4.00.66 (KDE 4.0.66 >= 20080313) "release 6.1" -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Greg Freemyer wrote:

...

Yes an aluminium hat... lol.

I just found out about a better solution.

http://www.lessemf.com/personal.html

Greg

Do you suppose they would screen print Geeko on them? :) Dave -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Jim Flanagan wrote:

Greg Freemyer wrote:

...

On Wed, Mar 26, 2008 at 6:38 AM, Hans defaber wrote:

...

What is the best (easiest) way to overwrite old harddisks with random garbage ?

thanks, Hans

Lots of ways, but the easiest is "dd if=/dev/zero of=/dev/sdX bs=4k conv=noerror"

Basically everything beyond that is overkill. Even NIST has started buying off on the above for drive 20GB or larger. holding confidential data (Older, less dense drives need more passes, random data, etc.) For more secret data, they require physical destruction I think.. I have not seen any docs that cover drives holding top secret data etc.

If you need a boot CD/floppy look into dban.

If you think you data is worth someone attempting a multi-million dollar recovery on and you think their is an ultra-secret government agency that actually has some SciFi like ability to recovery overwritten data, then take it apart and belt sand the magnetic media off of each platter. You should probably do that while wearing an aluminum hat. That way they can't be reading your mind during the process and somehow be using you as a transmitter to read your data.

Greg

Or you could encrypt it with strong encryption. Not sure how, but I hear its done.

Encryption does NOT prevent anyone from reading your messages or data. All it does is raise the amount of effort and time which must be devoted to reading it. Given sufficient time and computing power, all encryption will be cracked. The key is to use enough encryption such that the data which is protected isn't worth as much as the equipment needed to decrypt it and that once it is decrypted, it took so long that the information is no longer useful. If you cannot meet those two conditions, then you must keep physical control of the data, and ensure that it is destroyed before anyone can copy the encrypted data. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Greg Freemyer wrote:

On Wed, Mar 26, 2008 at 6:38 AM, Hans defaber wrote:

...

What is the best (easiest) way to overwrite old harddisks with random garbage ?

thanks, Hans

Lots of ways, but the easiest is "dd if=/dev/zero of=/dev/sdX bs=4k conv=noerror"

Basically everything beyond that is overkill. Even NIST has started buying off on the above for drive 20GB or larger. holding confidential data (Older, less dense drives need more passes, random data, etc.) For more secret data, they require physical destruction I think.. I have not seen any docs that cover drives holding top secret data etc.

U.S. government SECRET requires a low-level format. TOP SECRET requires destruction of the disk platters.

If you need a boot CD/floppy look into dban.

If you think you data is worth someone attempting a multi-million dollar recovery on and you think their is an ultra-secret government agency that actually has some SciFi like ability to recovery overwritten data, then take it apart and belt sand the magnetic media off of each platter.

You would be amazed at what can be accomplished with scanning electron microscopes (due to the fact that the path of an electron is effected by magnetic fields.). From what I understand, due to hysteresis effects, a track starts out at 'full width', but each time a magnetic field is reversed, a "tail" is left on each side. Apparently, these residual fields can be used to reconstruct data which was previously overwritten.

You should probably do that while wearing an aluminum hat. That way they can't be reading your mind during the process and somehow be using you as a transmitter to read your data.

Greg

-- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

On Thursday 27 March 2008 07:48, Bob Rea wrote:

...

U.S. government SECRET requires a low-level format.

How does one do a low level format? I got asked to do this at work but no one would tell me how.

If you use SCSI drives, then the SCSI adaptor may have a BIOS function for invoking low-level disk formatting operations, assuming the drive hardware permits it. You could look there. But I had gotten the impression (in this list a while back, if I recall correctly) that modern drives have their addressing information written at the factory and provide no means to change or redo it in the field.

...

-- Bob Rea

Randall Schulz -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Sam Clemens wrote:

Randall R Schulz wrote:

...

On Thursday 27 March 2008 07:48, Bob Rea wrote:

...

...

U.S. government SECRET requires a low-level format. How does one do a low level format? I got asked to do this at work but no one would tell me how.

If you use SCSI drives, then the SCSI adaptor may have a BIOS function for invoking low-level disk formatting operations, assuming the drive hardware permits it. You could look there.

But I had gotten the impression (in this list a while back, if I recall correctly) that modern drives have their addressing information written at the factory and provide no means to change or redo it in the field.

They've got some program, which, after you run it on an IDE drive, the thing seems to be unusuable for anything other than a paperweight.

I believe that's called "Vista". ;-) -- Use OpenOffice.org http://www.openoffice.org -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

What happens if one does an incomplete Windows install, i.e. only up to after the disk formatting step? Does that overwrite the data on the disk? Quoting Kai Ponte :

On Thursday 27 March 2008 07:48:47 am Bob Rea wrote:

...

...

U.S. government SECRET requires a low-level format.

How does one do a low level format? I got asked to do this at work but no one would tell me how.

Typically that's at the BIOS level. You do this from there.

However, pretty much any modern drive should not be low-level formatted since the manufacturers add crap that could be lost if you do such an item.

I haven't low-level formatted a drive since the turn of the century.

You might look at zero fill. I've used this pretty successfully, after booting from a live CD.

dd if=/dev/zero of=/dev/hda bs=1M

Or you can shred: shred -n 2 -z -v /dev/hda1

http://linux.about.com/library/cmd/blcmdl1_shred.htm

http://www.smartcomputing.com/editorial/article.asp?article=articles%2F2006%...

...

And another thing. You notice all the stuff I deleted from previous messages. Wading through all that already-read cruft makes me wish for people to top post so I can see what they have to say without wading through verbal quicksand to the bottom of the post.

That has more to do with incorrect quoting than top poasting...

-- kai www.filesite.org || www.4thedadz.com || www.perfectreign.com

revolution is just a t-shirt away -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

-- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Greg Freemyer schreef:

On Thu, Mar 27, 2008 at 12:36 PM, Dirk Petry wrote:

...

What happens if one does an incomplete Windows install, i.e. only up to after the disk formatting step? Does that overwrite the data on the disk?

I have recovered large amounts of data from a Windows Server that later had Linux installed on it. Linux was 100% operational, but it seems the sectors it overwrote were not critical to the underlying NTFS filesystem it overwrote. Recovery was rather simple to be honest.

Greg

The point is also, that the drive 'has the intention' to save the info, even if you decide to delete it. So it will first use all unused space, until it gets to once used space, before it will overwrite the previous info. I know to get rid of very stubborn worms on windows, i had to format the drive 3 - 4 times, on dos level with fdisk, and create new bootrecords several times.. To demonstrate how persistant sw can be... After formatting a few times, there might be shreds of info left somewhere, but i do not know if they could be very usefull. To get rid of using the data, most times totaly overwriting twice just behind eachother was most succesfull in the time there were not such big drives... Shoot the disk is by far the most enjoyable way to make it useless.. ;) -- Enjoy your time around, Oddball (Now or never...) Besturingssysteem: Linux 2.6.25-rc5-git2-5-default x86_64 Current user: oddball@AMD64x2-sfn1 System: openSUSE 11.0 (x86_64) Alpha3 KDE: 4.00.66 (KDE 4.0.66 >= 20080313) "release 6.1" -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

On Thursday 27 March 2008 09:36:21 am Dirk Petry wrote:

What happens if one does an incomplete Windows install, i.e. only up to after the disk formatting step? Does that overwrite the data on the disk?

Sure it does. It also allows for virus and trojans to enter. :P -- kai www.filesite.org || www.4thedadz.com || www.perfectreign.com remember - a turn signal is a statement, not a request -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

On Thu, Mar 27, 2008 at 12:47 PM, Per Jessen wrote:

Kai Ponte wrote:

...

On Thursday 27 March 2008 07:48:47 am Bob Rea wrote:

...

...

U.S. government SECRET requires a low-level format.

How does one do a low level format? I got asked to do this at work but no one would tell me how.

Typically that's at the BIOS level. You do this from there.

Typically you won't find such an option in a modern BIOS. I'm not sure the IDE commandset even supports it anymore. A "low-level format" is a left-over from days long gone.

Not really the same but ATA has a "security erase" command now. And has for many years. In theory the drive has the ability to enhance the voltage going to the head and it overwrites all sectors, not just the user addressible ones. ie. bad blocks, HPAs, DCO protected, spare blocks, etc. I've read that the US government will accept a Security Erase as a disk wipe. I have not seen official docs to that effect. You can issue it via hdparm, but in my testing a lot of bios's block it from getting to the drive, so you need to test that it is working for you. If it does get to the drive it should take a long time to complete. Greg -- Greg Freemyer Litigation Triage Solutions Specialist http://www.linkedin.com/in/gregfreemyer First 99 Days Litigation White Paper - http://www.norcrossgroup.com/forms/whitepapers/99%20Days%20whitepaper.pdf The Norcross Group The Intersection of Evidence & Technology http://www.norcrossgroup.com -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

On Wed, Mar 26, 2008 at 11:33 PM, Sam Clemens wrote:

Greg Freemyer wrote:

...

On Wed, Mar 26, 2008 at 6:38 AM, Hans defaber wrote:

...

What is the best (easiest) way to overwrite old harddisks with random garbage ?

thanks, Hans

Lots of ways, but the easiest is "dd if=/dev/zero of=/dev/sdX bs=4k conv=noerror"

Basically everything beyond that is overkill. Even NIST has started buying off on the above for drive 20GB or larger. holding confidential data (Older, less dense drives need more passes, random data, etc.) For more secret data, they require physical destruction I think.. I have not seen any docs that cover drives holding top secret data etc.

U.S. government SECRET requires a low-level format. TOP SECRET requires destruction of the disk platters.

...

If you need a boot CD/floppy look into dban.

If you think you data is worth someone attempting a multi-million dollar recovery on and you think their is an ultra-secret government agency that actually has some SciFi like ability to recovery overwritten data, then take it apart and belt sand the magnetic media off of each platter.

You would be amazed at what can be accomplished with scanning electron microscopes (due to the fact that the path of an electron is effected by magnetic fields.). From what I understand, due to hysteresis effects, a track starts out at 'full width', but each time a magnetic field is reversed, a "tail" is left on each side. Apparently, these residual fields can be used to reconstruct data which was previously overwritten.

I would love a true reference (from the last 15 years). I have spent many hours looking into the question. The best I have seen is people claiming they can recover a bit here and bit there from modern drives. Not even any full bytes. I have a NIST document that says labratory based recovery of data is impossible for disk drives 20GB or larger if the have been overwritten with a single pass of data. ie. Any data including all zeros. Greg -- Greg Freemyer Litigation Triage Solutions Specialist http://www.linkedin.com/in/gregfreemyer First 99 Days Litigation White Paper - http://www.norcrossgroup.com/forms/whitepapers/99%20Days%20whitepaper.pdf The Norcross Group The Intersection of Evidence & Technology http://www.norcrossgroup.com -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Dave Howorth wrote:

Greg Freemyer wrote:

...

On Wed, Mar 26, 2008 at 11:33 PM, Sam Clemens wrote:

...

You would be amazed at what can be accomplished with scanning electron microscopes (due to the fact that the path of an electron is effected by magnetic fields.). From what I understand, due to hysteresis effects, a track starts out at 'full width', but each time a magnetic field is reversed, a "tail" is left on each side. Apparently, these residual fields can be used to reconstruct data which was previously overwritten. I would love a true reference (from the last 15 years). I have spent many hours looking into the question. The best I have seen is people claiming they can recover a bit here and bit there from modern drives. Not even any full bytes.

I have a NIST document that says labratory based recovery of data is impossible for disk drives 20GB or larger if the have been overwritten with a single pass of data. ie. Any data including all zeros.

It is certainly possible to read magnetic domain information from surfaces using an AFM (atomic force microscope) in Magnetic Force Mode (MFM). I've done that but not with a hard disk. If you google with those keywords you can find images showing what can be seen - e.g. left over data down the edge of tracks. But I don't know when those images were made or what's possible or not with current hard disks.

I don't know about any equivalent SEM techniques.

My understanding is that any method which has fine enough resolution to show the reversals of the magnetic domains is sufficient. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

On Thu, Mar 27, 2008 at 2:58 PM, Randall R Schulz wrote:

On Thursday 27 March 2008 09:50, Greg Freemyer wrote:

...

I would love a true reference (from the last 15 years). I have spent many hours looking into the question. The best I have seen is people claiming they can recover a bit here and bit there from modern drives. Not even any full bytes.

I have a NIST document that says labratory based recovery of data is impossible for disk drives 20GB or larger if the have been overwritten with a single pass of data. ie. Any data including all zeros.

That's not too surprising. All the new high-capacity drives use vertical recording and exploit giant magnetoresistance for reading. Thus there's much less magnetic energy associated with each bit recorded in these drives.

If you could give a reference (or some rough identifying information) for that NIST paper, I'd be interested in looking at it.

The url is: http://csrc.nist.gov/publications/nistpubs/800-88/NISTSP800-88_rev1.pdf And the quote in particular. NIST Special Publication 800-88 Guidelines for Media Sanitization August, 2006 "Advancing technology has created a situation that has altered previously held best practices regarding magnetic disk type storage media. Basically the change in track density and the related changes in the storage medium have created a situation where the acts of clearing and purging the media have converged. That is, for ATA disk drives manufactured after 2001 (over 15 GB) clearing by overwriting the media once is adequate to protect the media from both keyboard and laboratory attack." Greg -- Greg Freemyer Litigation Triage Solutions Specialist http://www.linkedin.com/in/gregfreemyer First 99 Days Litigation White Paper - http://www.norcrossgroup.com/forms/whitepapers/99%20Days%20whitepaper.pdf The Norcross Group The Intersection of Evidence & Technology http://www.norcrossgroup.com -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org