If a quick format just marks bits as writable, and a normal format writes 0s to the entire disk, why do people bother with DBAN, and why are multiple passes ever required?
It used to be possible by reading the residual magnetism left by the previous bit. This isn't so much of an issue now that the tracks and bits that hard drives write are so small. It is almost impossible to recover any meaningful data off of a zeroed drive with modern disks.
EDIT: This next section is only true for XP. Psycogeek pointed out that Vista and up does zero out the drive if you do a full format.
That being said, your definition of quick format and normal format is off. A normal format doesn't zero out the disk, that would take too long. The difference between the two is that the normal format looks for bad sectors on a drive, while the quick does not.
So it's best to use a tool like DBAN to at least do one pass if you want to make sure data isn't recoverable. And if you're doing one, why not a few more for fun!
On older setups a format indeed wrote a pattern to the whole disk (e.g. all zero's though any pattern would have done). A single pass of this is enough to wipe all data for regular users.
I mention regular users because with sensitive enough equipment it was possible to recover some of the old data. This means data was not save the NSA or any similar group which can afford some very expensive equipment. Overwriting the data several times with different patterns however made the information on the disk really unrecoverable.
This point is probably moot for modern platters since the magnetized particles have become much smaller.
A single pass is enough to make a disk controller read the newly written data.
However consider the following simplified example:
Now what happens when we encounter a 85% north?
Now to wiping a disk. I have 100% charge N, I wipe it with all zero's, ideally setting it too 100% S. But what happens is that it might end up 90% S. Now I heave a disk with 100% S parts (which originally were 0's) and with 90% S (which originally were 1's). So if I scan carefully enough I can reconstruc the old data.
And once more, that example is not technically correct. It is very much simplified.
Overwriting the data with multiple passes with different data makes enoguh of a mess out of it that it becomes unrecoverable. Add a few more passes and you get goverment standards for wiping. This is why some tools offer multiple passes.
DBAN can send the 'secure erase' command to a disk. If the disk supports this it should erase itself without any further activity from the computers. That can yield significant speed gain. (e.g. when you connect the drive over a slow bus like USB).
And on SSD's this is often very quick because some of them always encrypt their data. A secure erase just deletes the key to that data and generates a new one. That makes safely wiping the SSD a matter of roughly 0 seconds.
< hat type="tinfoil">Assuming there is no backdoor in the firmware </hat>. :)
1) EDIT: This next section is only true for XP. Psycogeek pointed out that Vista and up does zero out the drive if you do a full format.
2) That being said, your definition of quick format and normal format is off. A normal format doesn't zero out the disk, that would take too long. The difference between the two is that the normal format looks for bad sectors on a drive, while the quick does not.
In 1. u say if you do full format the disk is zeroed, and in 2. u say normal fomrat (full u mean i guess) does NOT zero the disk
Well does a full format zero the disk or not? thnx
Look at it this way...
When you throw things away at your house, you can take that trash to the dump. On a computer, all the data is on the drive. Period. There is nowhere else for it to go. Recovering data from formatted drives is much like the ability to recover files that were deleted from a recycle bin. In each case, the data still exists but is no longer put together. Recovery programs know how to locate the data and reconstruct it.
The reason for multiple passes is to make it more difficult to recover/restore data in an effective way. It is a matter of data security. The more sensitive the data, the more passes you want. The Department of Defense recommends 7 passes. This is what they consider to be a sufficient deterrent and, perhaps, making it theoretically impossible to recover anything.