Mailinglist Archive: opensuse (2459 mails)

< Previous Next >
Re: [opensuse] scrathsing old harddisks
  • From: "Greg Freemyer" <greg.freemyer@xxxxxxxxx>
  • Date: Thu, 27 Mar 2008 12:50:42 -0400
  • Message-id: <87f94c370803270950u54692d40ha901f66e3914973c@xxxxxxxxxxxxxx>
On Wed, Mar 26, 2008 at 11:33 PM, Sam Clemens <clemens.sam1@xxxxxxxxx> wrote:
Greg Freemyer wrote:
> On Wed, Mar 26, 2008 at 6:38 AM, Hans defaber <hans.defaber@xxxxxxxxx>
wrote:
>> What is the best (easiest) way to overwrite old harddisks with random
garbage ?
>>
>> thanks, Hans
>
> Lots of ways, but the easiest is "dd if=/dev/zero of=/dev/sdX bs=4k
> conv=noerror"
>
> Basically everything beyond that is overkill. Even NIST has started
> buying off on the above for drive 20GB or larger. holding confidential
> data (Older, less dense drives need more passes, random data, etc.)
> For more secret data, they require physical destruction I think.. I
> have not seen any docs that cover drives holding top secret data etc.
>

U.S. government SECRET requires a low-level format.
TOP SECRET requires destruction of the disk platters.


> If you need a boot CD/floppy look into dban.
>
> If you think you data is worth someone attempting a multi-million
> dollar recovery on and you think their is an ultra-secret government
> agency that actually has some SciFi like ability to recovery
> overwritten data, then take it apart and belt sand the magnetic media
> off of each platter.

You would be amazed at what can be accomplished with scanning
electron microscopes (due to the fact that the path of an
electron is effected by magnetic fields.). From what I
understand, due to hysteresis effects, a track starts out
at 'full width', but each time a magnetic field is reversed,
a "tail" is left on each side. Apparently, these residual
fields can be used to reconstruct data which was previously
overwritten.

I would love a true reference (from the last 15 years). I have spent
many hours looking into the question. The best I have seen is people
claiming they can recover a bit here and bit there from modern drives.
Not even any full bytes.

I have a NIST document that says labratory based recovery of data is
impossible for disk drives 20GB or larger if the have been overwritten
with a single pass of data. ie. Any data including all zeros.

Greg
--
Greg Freemyer
Litigation Triage Solutions Specialist
http://www.linkedin.com/in/gregfreemyer
First 99 Days Litigation White Paper -
http://www.norcrossgroup.com/forms/whitepapers/99%20Days%20whitepaper.pdf

The Norcross Group
The Intersection of Evidence & Technology
http://www.norcrossgroup.com
--
To unsubscribe, e-mail: opensuse+unsubscribe@xxxxxxxxxxxx
For additional commands, e-mail: opensuse+help@xxxxxxxxxxxx

< Previous Next >