Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I've been reading about various utilities that erase the free space on your hard drive, and they all talk about doing multiple passes of writing random strings of 1's and 0's using various algorithms...

My question is this--why not simply write all 0's to the free space (or all 1's)? A single pass and you're done? I'm guessing I'm missing something really basic...

share|improve this question

3 Answers 3

up vote 7 down vote accepted

In very loose terms, to emphasize where the complication lies:

The bits on the drive are interpreted as binary, "1" and "0" if you like, but in reality it is a continuous variable that is measured. One could figuratively say that every bit really can take any value between 0 and 1, and the drive interprets all values >0.7 as 1, and all values <0.3 as 0.

Let's say a bit is at charge 0.9. You then overwrite it with a 0, which effectively lowers the charge. The final charge will be maybe 0.25, but if the bit originally had been a zero at charge 0.2, maybe it would end up as 0.15. Thus, by using equipment possible to read the charges at high precision, in theory one could recreate data that has been overwritten by all zeroes by using a normalization where charge<0.2 is a zero and charge>0.2 is a one.

If one instead overwrites the data with random numbers, it is instantly much harder for this recreation. That's why it is preferred for very sensitive data.

In reality algorithms are much more clever, depending on how good the resolution of the equipment used to analyze the magnetization of the disk is. There is a reason why the data recovery companies charge silly money :-)

share|improve this answer
    
Thanks for the wonderful explanation. But what about solid state drives, where we don't use magnets. –  kadaj Dec 21 '10 at 6:17
    
Great explanation. I would like to know how this differs in SSD's. –  Belmin Fernandez Dec 21 '10 at 15:40
    
    
I haven't encountered SSDs in this area. At a first look it should be harder to recover "shadowed" data as with mechnical disks, so a zero fill might seem to be more effective in this case. There are problems with the internal disk controller algorithms which reduce fatigue of memory cells, but in this process might neglect to write certain blocks of the disk if one approaches the data erasing naively. I read the article cl.cam.ac.uk/~sps32/DataRem_CHES2005.pdf about the technical problem of recovering data, I can recommend it for the interested (at least the "Conclusion" part). –  Daniel Andersson Dec 22 '10 at 1:21

I think the basic idea is that the data is written to a narrow circular track on the rotating disc. The head moves to different tracks but this movement has a limited accuracy. So when the head moves to that track to write zeroes, it may not write them exactly over the top of your data. There is probably a lot of overlap, but, in theory, in a laboratory the disk platter could be put into a special drive with narrow heads that move more precisely and this way the edge of your old data might be read. Either that or, because the data is written by re-orienting magnetic "particles" in the disk, which is essentially an analogue statistical physical process, some faint magnetic "shadow" of the old data might remain which could still be detected by sensitive heads. I'm not sure that any of this is more than hypothetical.

So the idea is to overwrite the data multiple times, like scribbling over your credit-card number on a piece of paper to stop anyone being able to read it. The more times you scribble, the harder it is to read what was underneath.

share|improve this answer

Todays forensic and data recovery techniques are accurate enough to still read the original data if only one pass of 0 or 1 is written over the original contents.

share|improve this answer
    
So they are able to read what was previously written to the drive, even though the bit currently has a different value? –  Jeremy Dec 21 '10 at 0:25
    
If the drive is intact and being read through its own interface, NO. The majority of what you are hearing about is mostly at the three letter goverment agency level where they take the drive apart and try to read the actual platters with very specialized equipment. When you are discussing an intact hard drive, a single pass using anything is enough. –  Blackbeagle Dec 21 '10 at 2:41
2  
In fact this is no longer true (at least according to published literature). It was true a couple of decades ago, but as data density increased, the probability of correctly recovering each bit dropped to barely over 50%, not enough for any practical recovery. I don't have a reference handy, but I'm sure this has been the topic of several questions here already. –  Gilles Dec 22 '10 at 0:25

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.