Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

To stupid people, like me, you would have thought overwriting each bit on a disk would render the data completely unrecoverable.

Why do disk wiping tools have the option for multiple passes, i.e. 3 or 5, even 7 and different methods? Surely the first pass does the job?

My question -
Is it just down to pure paranoia or should I be using multiple passes when wiping disks... and why?

share|improve this question
3  
See the accepted answer here, plus its comment. –  Daniel Beck Nov 28 '10 at 12:00
add comment

4 Answers

up vote 18 down vote accepted

It's paranoia.

The fastest way to "delete" things on a hard drive is simply to remove the references to that region of the hard drive, so the data remains there if you used a dedicated tool to recover it, the kind the police would have for example.

A much slower way to "delete" things is to write over every bit of information with a 1 or a 0, or random bits, so that even if you use aforementioned tool, all you would see is the result of this operation.

Theoretically, you can recover residual data (which is why tools have the option of using multiple passes) because the data is all stored magnetically.

If you have a clean disk, and write a 1 to it, then overwrite that 1 with a zero, the new "zero" will be slightly less "zero" than if you wrote a zero to that space on a clean disk, and even less than if you wrote a "zero" over a "zero".

I won't go too far into materials science.

It does depend why you're wiping your drive.

If you're trying to destroy the drive and never use it again. Physically bend it. This is all you have to do, no existing tool, or tool in development can read a bent drive.

Alternatively, heating up magnets completely resets their magnetism, as does passing a strong magnet over them.

If you're looking into data security on a long term basis, it is possible to buy hard drives that encrypt all data stored on them. If you change the core encryption key then all the data is completely unrecoverable, it takes a fraction of a second to do, and is more secure than repeatedly overwriting data with more data.

If you're just looking to hide your porn stash, or you are reselling your computer, a single pass of 1's will be more than enough. The actual process of rewriting every bit on a modern hard-drive (which will easily have over a TB of space) will take hours and hours.

The cost of recovering data from a zero'd out computer, to a forensics team, is well into the thousands of dollars and requires the skills of specialist computer scientists.

share|improve this answer
3  
Good answer except for the following - bending, using a magnet (to try and degauss) and heating are not sufficient if the value of the information on the disk is high enough for an attacker –  Rory Alsop Dec 4 '10 at 1:35
    
+1 for a great answer. Strong Encryption or a blow torch, take your pick, if you are paranoid that is. –  Moab Dec 4 '10 at 2:09
    
+1 for the detailed answer, made me perk up and go research what you mentioned about bits not actually being properly overwritten, ended up on cmrr.ucsd.edu/people/Hughes/SecureErase.shtml - really interesting stuff and I never knew there was a hidden built-in command set with modern ATA disks for securely wiping them. -1 for mentioning my porn stash (and then making it bold!) –  Kez Dec 31 '10 at 11:10
    
"The cost of recovering data from a zero'd out computer, to a forensics team, is well into the thousands of dollars [...]" Actually, I have never heard of any case where overwritten data was restored. So it's unlikely that any data can be recovered after zeroing the data. –  sleske Mar 28 '11 at 18:29
add comment

The necessity of extreme measures during deletion depends on the value of the information.

For your pron stash that you don't want Mom to find: Delete the file, overwrite all free space with zeros (sdelete will do the job). To my knowledge, no one has EVER demonstrated the ability to recover data from a normal hard disk after an over-write of any kind. The theoretical possibility is there, but no one's shown it can be done. Even if it can, it's going to be monstrously expensive and slow, and probably can't recover all desired data.

If it's worth millions of dollars, or if people are going to die if the info is revealed, take the drive apart and sand-blast the magnetic media off of the disk surface (don't forget proper air filtering - some of that stuff might be nasty). Congratulations - the data can't be recovered. If you happen to have access to foundry that does aluminum, you could always toss the platters into the next batch (the platters are often aluminum with magnetic oxide coatings). By melting the platters, you again free up the magnetic particles and let them float around. As a bonus, aluminum is usually melted in electric arc furnaces, which will surely play hob with the magnetic fields even before they slag the platters down.

share|improve this answer
add comment

Agree with the above answer, it is mostly paranoia. If you are a home user, then a single pass low level format will do the trick. There are many theories about how effective multiple wipes are, (some even go as far as reccomending 35 wipes!!) but generally a one pass wipe is good enough. Destroying the disk by bending it, breaking the disk plates (using a hammer) or drilling holes through it is a good way to safeguard your personal data but it depends on whether you want to use the disk again. Also, if you are disposing of your old machine by resale, without a disk you may realise up to a 40% reduction in value(depending on the machine).

Due to Privacy laws these days, organisations are paranoid about having their information leak into the open, since they can face litigation and fines. That is contributing to the sensitivity around disk wiping standards.

Unless you are an organisation which has to protect confidential client information, IP or other proprietary information, and a potential target of hackers who may want to steal or misuse such data, then you really dont need to consider very high levels of data security.

share|improve this answer
add comment

Build a notepad file of any number or character (1-0 a-z) so it is around a gig in size. Then save it anywhere on the drive. Now make copies of this file until you have filled the hard drive up. delete all the copies and the original. this would make the hard drive almost impossible to recover as all the tracks would be filled with the data you had saved. Slow but effective.

share|improve this answer
3  
-1 Even if this works (which is a gamble), it's much more complicated than just running DBAN or similar, so why bother? –  sleske Mar 8 '11 at 22:59
    
Anyone can open notepad and do that, and it is a good start. But to just run DBAN, you would need to start to get it, download, install, learn, etc, so no, it is not more simple. –  Cesar Vega Feb 19 '13 at 22:01
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.