Companies try to zero-fill their hard drives several times when they decommission them, why? Surely one pass of zero-fill would do the job exactly as they need. I understand the reasoning for the companies to do it but the need to run it several times. Could someone explain the process to help me with my understanding.
Here is a great article (and comments/links) about disk wiping, single vs multiple passes
If you want an easy analogy, suppose you have a wall, and someone stick a wallpaper on it (as if you wrote data to your hard disk drive - HDD). if you pass by your car you see the wallpaper painting (this is how the system reads the data on the HDD). To remove the writing from the wall, (think format the HDD), someone just put new white wallpaper on top. For the cars passing by, the wall is clean again, but for someone with the time to go and start carefully taking the white wallpaper off, they can see the writings below.
By writing again and again random data, the HDD drive contains a lot of magnetic residual for someone to be able to figure out what was the relevant data that was written.
If you go back to our wall/wallpaper analogy, if someone put one so many layers of wallpapers containing a lot of random writing. And to make is more realistic, on a disk the only things you can write is 0 and 1, so if your wallpapers had only 0s and 1s, it gets really hard to be able to remove the layers, and getting back to what layer you wanted to hide, given that everything is 0s and 1s, and you know which belongs to which layer etc..
The problem is exist two method to "format" a harddisk:
1) rewrite every single bit of information and putting zeros or ones, it is pretty safe with the exception of some expensive hardware that can recover some isolated bits.. but it is a hell of expensive to do that and there are not warranty of you can recover the information. So:
a) if you are a spy or work for the FBI, then format it using multipass, it write zeros 00000000, then ones 11111111 and later checker (10101010) and in some cases it can do a random pass.
b) otherwise, a single pass is more than enough.
2) The second method is the default method in most system, it does not delete the information, instead it delete the index, or even worst, it mark the index's flag as deleted. Most file system uses a backup for the index (fat/ntfs for example), so most "unformat" tools simply can copy the backup index and replace for the "deleted index", recovering most if not all the information.
Can you say that it is the least safe method for format a harddisk and it is correct, some "unscrupulous" technical buy used pc for recover the information contained in the pc.