Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 11 down vote favorite
1

Companies try to zero-fill their hard drives several times when they decommission them, why? Surely one pass of zero-fill would do the job exactly as they need. I understand the reasoning for the companies to do it but the need to run it several times. Could someone explain the process to help me with my understanding.

share|improve this question
youtube.com/watch?v=o-dc00iEhbo – rems Feb 24 '11 at 12:47
1  
What's wrong with physical destruction? It's not like used HDDs have much residual resale value. – James Feb 24 '11 at 18:21
Not much - 1. waste of resources 2. you throw away you (small) investement – Phil D. Feb 25 '11 at 7:23

4 Answers

up vote 11 down vote accepted

Physics. Rewriting the magnetic domains on the platter weakens them, but still leaves a residual amount of magnetism. The level of magnetism drops below the threshold to be readable by the electronics in the drive, but it is easily detectable with the appropriate equipment.

share|improve this answer
9  
'easily detectable' is often quite exaggerated. You would have to really want that data as something as Ingacio suggests could cost in the 10s of thousands if not more to do WITH no guarentees... Just because it leaves some residual amount there doesn't mean that its easily detectable. Write everything to 1's instead if this is so easy to detect... – g19fanatic Feb 24 '11 at 12:40
2  
@g19fanatic: All writing 1's does is shift the levels up instead of down. – Ignacio Vazquez-Abrams Feb 24 '11 at 12:43
2  
Nope. But I don't know of anyone that's been protected by it either. – Ignacio Vazquez-Abrams Feb 24 '11 at 12:52
1  
Ignacio Vazquez-Abrams is absolutely correct. Scientifically, a full zero-fill is not too difficult to do. The cost comes in due to the fact it has to be taken apart in a clean room and equipment that is not widely available is used. In fact, a zero fill is the easiest recovery type. random fill is far better(but not so available to do). – Jeff F. Feb 24 '11 at 14:10
2  
Show me one article where anyone has legitimately recovered data after one overwrite, zero or not, More then one overwrite it is a matter of paranoia. Fact is it has never happened or it would be known. Its all theory and so are aliens in Area 51. – Moab Feb 24 '11 at 16:40
show 9 more comments
up vote 7 down vote

Here is a great article (and comments/links) about disk wiping, single vs multiple passes

share|improve this answer
1  
+1, i was looking through my bookmarks to find this exact link. Great info and de-mystifies a lot of the hocum that surrounds this issue. – g19fanatic Feb 24 '11 at 12:52
This is a little off, however. Data is not retrieved by an "Electron Microscope" magnetism is invisible even at high magnification. Data CAN be retrieved after one pass of a full 0 write. A full random write would be much better. Look at it like this: .5 magnetism and above = 1 less then .5 = 0. if a full 0 is sent to a 1 it will be more like .8 or so then sent to a 0 more like a .3. so if a full 0 write was done. Former 1s may be a .3 and previous 0s may be a .2, and thus, it may be determinable what the prior state was. Readjust the formula .2=0 .3=1 and you have your data. – Jeff F. Feb 24 '11 at 13:57
2  
One overwrite is all it takes...nber.org/sys-admin/overwritten-data-guttman.html – Moab Feb 24 '11 at 18:24
up vote 5 down vote

If you want an easy analogy, suppose you have a wall, and someone stick a wallpaper on it (as if you wrote data to your hard disk drive - HDD). if you pass by your car you see the wallpaper painting (this is how the system reads the data on the HDD). To remove the writing from the wall, (think format the HDD), someone just put new white wallpaper on top. For the cars passing by, the wall is clean again, but for someone with the time to go and start carefully taking the white wallpaper off, they can see the writings below.

By writing again and again random data, the HDD drive contains a lot of magnetic residual for someone to be able to figure out what was the relevant data that was written.

If you go back to our wall/wallpaper analogy, if someone put one so many layers of wallpapers containing a lot of random writing. And to make is more realistic, on a disk the only things you can write is 0 and 1, so if your wallpapers had only 0s and 1s, it gets really hard to be able to remove the layers, and getting back to what layer you wanted to hide, given that everything is 0s and 1s, and you know which belongs to which layer etc..

share|improve this answer
Probably a better analogy, its more like using a pencil and eraser. No matter how hard you erase, there is still some remnants of the pencil left. – Jeff F. Feb 24 '11 at 22:00
Bad analogy - we don't erase we draw over it, much harder to find the original picture – Phil D. Feb 25 '11 at 7:22
up vote 0 down vote

The problem is exist two method to "format" a harddisk:

1) rewrite every single bit of information and putting zeros or ones, it is pretty safe with the exception of some expensive hardware that can recover some isolated bits.. but it is a hell of expensive to do that and there are not warranty of you can recover the information. So:

a) if you are a spy or work for the FBI, then format it using multipass, it write zeros 00000000, then ones 11111111 and later checker (10101010) and in some cases it can do a random pass.

b) otherwise, a single pass is more than enough.

2) The second method is the default method in most system, it does not delete the information, instead it delete the index, or even worst, it mark the index's flag as deleted. Most file system uses a backup for the index (fat/ntfs for example), so most "unformat" tools simply can copy the backup index and replace for the "deleted index", recovering most if not all the information.

Can you say that it is the least safe method for format a harddisk and it is correct, some "unscrupulous" technical buy used pc for recover the information contained in the pc.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.