34

To stupid people, like me, you would have thought overwriting each bit on a disk would render the data completely unrecoverable.

Why do disk wiping tools have the option for multiple passes, i.e. 3 or 5, even 7 and different methods? Surely the first pass does the job?

My question -
Is it just down to pure paranoia or should I be using multiple passes when wiping disks... and why?

1
  • 3
    See the accepted answer here, plus its comment.
    – Daniel Beck
    Nov 28, 2010 at 12:00

5 Answers 5

33

It's paranoia.

The fastest way to "delete" things on a hard drive is simply to remove the references to that region of the hard drive, so the data remains there if you used a dedicated tool to recover it, the kind the police would have for example.

A much slower way to "delete" things is to write over every bit of information with a 1 or a 0, or random bits, so that even if you use aforementioned tool, all you would see is the result of this operation.

Theoretically, you can recover residual data (which is why tools have the option of using multiple passes) because the data is all stored magnetically.

If you have a clean disk, and write a 1 to it, then overwrite that 1 with a zero, the new "zero" will be slightly less "zero" than if you wrote a zero to that space on a clean disk, and even less than if you wrote a "zero" over a "zero".

I won't go too far into materials science.

It does depend why you're wiping your drive.

If you're trying to destroy the drive and never use it again. Physically bend it. This is all you have to do, no existing tool, or tool in development can read a bent drive.

Alternatively, heating up magnets completely resets their magnetism, as does passing a strong magnet over them.

If you're looking into data security on a long term basis, it is possible to buy hard drives that encrypt all data stored on them. If you change the core encryption key then all the data is completely unrecoverable, it takes a fraction of a second to do, and is more secure than repeatedly overwriting data with more data.

If you're just looking to hide your porn stash, or you are reselling your computer, a single pass of 1's will be more than enough. The actual process of rewriting every bit on a modern hard-drive (which will easily have over a TB of space) will take hours and hours.

The cost of recovering data from a zero'd out computer, to a forensics team, is well into the thousands of dollars and requires the skills of specialist computer scientists.

11
  • 6
    Good answer except for the following - bending, using a magnet (to try and degauss) and heating are not sufficient if the value of the information on the disk is high enough for an attacker
    – Rory Alsop
    Dec 4, 2010 at 1:35
  • 4
    "The cost of recovering data from a zero'd out computer, to a forensics team, is well into the thousands of dollars [...]" Actually, I have never heard of any case where overwritten data was restored. So it's unlikely that any data can be recovered after zeroing the data.
    – sleske
    Mar 28, 2011 at 18:29
  • 2
    @Kez, Link is down.
    – Pacerier
    Dec 12, 2014 at 10:32
  • 2
    @sleske, Wait, that's unlikely simply because you've never heard of it? Does seems to me like an over-estimation of your own ability. Indeed, such cases wouldn't be leaked in the first place. Will the CIA really tell you that they have the technology to easily recover anything less than 7 wipes?
    – Pacerier
    Dec 12, 2014 at 10:34
  • 3
    No, but chances are that at least one indy infosec outfit would have replicated and published an equivalent achievement, surely? The tools are of no obligation to reveal themselves only to sinister acronym agencies. Jul 31, 2015 at 17:52
11

The necessity of extreme measures during deletion depends on the value of the information.

For your pron stash that you don't want Mom to find: Delete the file, overwrite all free space with zeros (sdelete will do the job). To my knowledge, no one has EVER demonstrated the ability to recover data from a normal hard disk after an over-write of any kind. The theoretical possibility is there, but no one's shown it can be done. Even if it can, it's going to be monstrously expensive and slow, and probably can't recover all desired data.

If it's worth millions of dollars, or if people are going to die if the info is revealed, take the drive apart and sand-blast the magnetic media off of the disk surface (don't forget proper air filtering - some of that stuff might be nasty). Congratulations - the data can't be recovered. If you happen to have access to foundry that does aluminum, you could always toss the platters into the next batch (the platters are often aluminum with magnetic oxide coatings). By melting the platters, you again free up the magnetic particles and let them float around. As a bonus, aluminum is usually melted in electric arc furnaces, which will surely play hob with the magnetic fields even before they slag the platters down.

4

Agree with the above answer, it is mostly paranoia. If you are a home user, then a single pass low level format will do the trick. There are many theories about how effective multiple wipes are, (some even go as far as reccomending 35 wipes!!) but generally a one pass wipe is good enough. Destroying the disk by bending it, breaking the disk plates (using a hammer) or drilling holes through it is a good way to safeguard your personal data but it depends on whether you want to use the disk again. Also, if you are disposing of your old machine by resale, without a disk you may realise up to a 40% reduction in value(depending on the machine).

Due to Privacy laws these days, organisations are paranoid about having their information leak into the open, since they can face litigation and fines. That is contributing to the sensitivity around disk wiping standards.

Unless you are an organisation which has to protect confidential client information, IP or other proprietary information, and a potential target of hackers who may want to steal or misuse such data, then you really dont need to consider very high levels of data security.

1

For modern hard drives, one pass is sufficient to destroy its data. Doing anything more (from 2 passes all the way up to the mythical 35 passes) is an urban legend and gives a wasteful false sense of security. I have not seen any evidence of data being recovered after a single pass wipe. See this article for more detail: https://www.howtogeek.com/115573/htg-explains-why-you-only-have-to-wipe-a-disk-once-to-erase-it/

And if the data is classified, you do zero passes. That's right zero. You pulverize or melt the drive platters if it contains classified data. So your options are either doing a 1-pass write of the entire drive or physically destroying the drive. Both will give the same result, but the latter option might help you sleep better at night.

2
  • Welcome to SuperUser. Please try to avoid creating new answers with similar content to existing answers to questions asked multiple years ago. Old questions and answers should just get some up and down votes to indicate their utility to future visitors. The original question was already a duplicate of an existing question, as noted by @DanielBeck in the first comment. Jun 24, 2019 at 20:42
  • Thanks, @ChristopherHostage. I thought the link to the HowToGeek article qualified this answer as being different enough to post it since it contains more up-to-date information and more detail than the other answers. Parts of it had been mentioned in a few answers, but none brought it all together in one answer. I missed the fact that this was a duplicate question because the word duplicate wasn't in his comment and the question wasn't marked as a duplicate. New answers to this question are good since the answer has changed over time with bigger HDD's. I'll be more careful going forward.
    – rcronk
    Jun 25, 2019 at 23:11
-1

Build a notepad file of any number or character (1-0 a-z) so it is around a gig in size. Then save it anywhere on the drive. Now make copies of this file until you have filled the hard drive up. delete all the copies and the original. this would make the hard drive almost impossible to recover as all the tracks would be filled with the data you had saved. Slow but effective.

3
  • 8
    -1 Even if this works (which is a gamble), it's much more complicated than just running DBAN or similar, so why bother?
    – sleske
    Mar 8, 2011 at 22:59
  • 1
    Anyone can open notepad and do that, and it is a good start. But to just run DBAN, you would need to start to get it, download, install, learn, etc, so no, it is not more simple.
    – Cesar Vega
    Feb 19, 2013 at 22:01
  • 4
    Someone who is not willing or capable to learn how to securely erase properly...probably shouldn't be let into a situation where they have to Jul 31, 2015 at 17:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .