Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If a quick format just marks bits as writable, and a normal format writes 0s to the entire disk, why do people bother with DBAN, and why are multiple passes ever required?

share|improve this question
up vote 9 down vote accepted

It used to be possible by reading the residual magnetism left by the previous bit. This isn't so much of an issue now that the tracks and bits that hard drives write are so small. It is almost impossible to recover any meaningful data off of a zeroed drive with modern disks.

EDIT: This next section is only true for XP. Psycogeek pointed out that Vista and up does zero out the drive if you do a full format.

That being said, your definition of quick format and normal format is off. A normal format doesn't zero out the disk, that would take too long. The difference between the two is that the normal format looks for bad sectors on a drive, while the quick does not.

So it's best to use a tool like DBAN to at least do one pass if you want to make sure data isn't recoverable. And if you're doing one, why not a few more for fun!

share|improve this answer
    
thanks. had no idea about format scanning for bad sectors. – cantsay Jan 31 '14 at 21:41
    
No problem! Did this answer your question? – Alex McKenzie Jan 31 '14 at 21:48
2  
depends on the OS, it is said that later versions of windows systems do zero out the drive when running a full format, which does take forever. superuser.com/questions/393912/… – Psycogeek Jan 31 '14 at 22:24
    
Incidentally, checking for bad sectors in software is anachronistic at this point. Drive controllers do it automatically in hardware as the drive operates, so unless you’re using an extremely old drive, there’s no need to force that check; it just takes extra time. – Benjamin Barenblat Feb 1 '14 at 17:12
    
these days with bits scrambled and using more complex encoding zero is not really flat magnetism so residual data is more hidden – Skaperen Aug 28 '15 at 9:56

If a quick format just marks bits as writable, and a normal format writes 0s to the entire disk, why do people bother with DBAN,

On older setups a format indeed wrote a pattern to the whole disk (e.g. all zero's though any pattern would have done). A single pass of this is enough to wipe all data for regular users.

I mention regular users because with sensitive enough equipment it was possible to recover some of the old data. This means data was not save the NSA or any similar group which can afford some very expensive equipment. Overwriting the data several times with different patterns however made the information on the disk really unrecoverable.

This point is probably moot for modern platters since the magnetized particles have become much smaller.

and why are multiple passes ever required?

A single pass is enough to make a disk controller read the newly written data.

However consider the following simplified example:
A magnetic north (say 100% intersity north) represents a 1
A magnetic south (say 100% intersity south) represents a 0

Now what happens when we encounter a 85% north?
The disk controller will interpreted it as a 1.
No big deal, values do not need to be perfect.

Now to wiping a disk. I have 100% charge N, I wipe it with all zero's, ideally setting it too 100% S. But what happens is that it might end up 90% S. Now I heave a disk with 100% S parts (which originally were 0's) and with 90% S (which originally were 1's). So if I scan carefully enough I can reconstruc the old data.

And once more, that example is not technically correct. It is very much simplified.

Overwriting the data with multiple passes with different data makes enoguh of a mess out of it that it becomes unrecoverable. Add a few more passes and you get goverment standards for wiping. This is why some tools offer multiple passes.


Moving on to DBAN:

DBAN can send the 'secure erase' command to a disk. If the disk supports this it should erase itself without any further activity from the computers. That can yield significant speed gain. (e.g. when you connect the drive over a slow bus like USB).

And on SSD's this is often very quick because some of them always encrypt their data. A secure erase just deletes the key to that data and generates a new one. That makes safely wiping the SSD a matter of roughly 0 seconds.

< hat type="tinfoil">Assuming there is no backdoor in the firmware </hat>. :)

share|improve this answer

1) EDIT: This next section is only true for XP. Psycogeek pointed out that Vista and up does zero out the drive if you do a full format.

2) That being said, your definition of quick format and normal format is off. A normal format doesn't zero out the disk, that would take too long. The difference between the two is that the normal format looks for bad sectors on a drive, while the quick does not.

In 1. u say if you do full format the disk is zeroed, and in 2. u say normal fomrat (full u mean i guess) does NOT zero the disk

Well does a full format zero the disk or not? thnx

share|improve this answer

Look at it this way...

When you throw things away at your house, you can take that trash to the dump. On a computer, all the data is on the drive. Period. There is nowhere else for it to go. Recovering data from formatted drives is much like the ability to recover files that were deleted from a recycle bin. In each case, the data still exists but is no longer put together. Recovery programs know how to locate the data and reconstruct it.

The reason for multiple passes is to make it more difficult to recover/restore data in an effective way. It is a matter of data security. The more sensitive the data, the more passes you want. The Department of Defense recommends 7 passes. This is what they consider to be a sufficient deterrent and, perhaps, making it theoretically impossible to recover anything.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.