In Wiping a Hard Drive With DD, the author said:

Due to the way hard drives are made it is often possible to determine what was written beneath the most current write operation. If you write the entire drive with zeros, it will be quite easy to see what data was written before. It will be the one that is not a zero!

I wonder how (theorically) it can determine what was written before the most current write operation, if every bit is written with 0.


Recovering data after a re-write from a hard drive allegedly involves "reading" the platters manually using scanning probe electronic microscope. Some researchers claim that after you re-write the disk with all zeroes, there are still minute differences between bits that were zeros before the overwrite and those that were ones. And you can pick those differences with a a microscope, reading data bit-by-bit.

There are some academic references available at Forensics Wiki. It also claims that:

Whether or not such data can be recovered has been a question of debate for decades. Unfortunately, there have been few hard facts published.

Obviously, such data recovery is not economical, and if possible, can only be done by bodies (governments, corporations) with huge budgets. Nobody knows for sure, of course, so people decide to err on the side of caution, after all, multiple overwrites with random data patterns are just as easy as one overwrite with all zeros.

Not the answer you're looking for? Browse other questions tagged or ask your own question.