10

If a quick format just marks bits as writable, and a normal format writes 0s to the entire disk, why do people bother with DBAN, and why are multiple passes ever required?

10

It used to be possible by reading the residual magnetism left by the previous bit. This isn't so much of an issue now that the tracks and bits that hard drives write are so small. It is almost impossible to recover any meaningful data off of a zeroed drive with modern disks.

EDIT: This next section is only true for XP. Psycogeek pointed out that Vista and up does zero out the drive if you do a full format.

That being said, your definition of quick format and normal format is off. A normal format doesn't zero out the disk, that would take too long. The difference between the two is that the normal format looks for bad sectors on a drive, while the quick does not.

So it's best to use a tool like DBAN to at least do one pass if you want to make sure data isn't recoverable. And if you're doing one, why not a few more for fun!

  • thanks. had no idea about format scanning for bad sectors. – cantsay Jan 31 '14 at 21:41
  • No problem! Did this answer your question? – Alex McKenzie Jan 31 '14 at 21:48
  • 2
    depends on the OS, it is said that later versions of windows systems do zero out the drive when running a full format, which does take forever. superuser.com/questions/393912/… – Psycogeek Jan 31 '14 at 22:24
  • Incidentally, checking for bad sectors in software is anachronistic at this point. Drive controllers do it automatically in hardware as the drive operates, so unless you’re using an extremely old drive, there’s no need to force that check; it just takes extra time. – Benjamin Barenblat Feb 1 '14 at 17:12
  • these days with bits scrambled and using more complex encoding zero is not really flat magnetism so residual data is more hidden – Skaperen Aug 28 '15 at 9:56
0

If a quick format just marks bits as writable, and a normal format writes 0s to the entire disk, why do people bother with DBAN,

On older setups a format indeed wrote a pattern to the whole disk (e.g. all zero's though any pattern would have done). A single pass of this is enough to wipe all data for regular users.

I mention regular users because with sensitive enough equipment it was possible to recover some of the old data. This means data was not save the NSA or any similar group which can afford some very expensive equipment. Overwriting the data several times with different patterns however made the information on the disk really unrecoverable.

This point is probably moot for modern platters since the magnetized particles have become much smaller.

and why are multiple passes ever required?

A single pass is enough to make a disk controller read the newly written data.

However consider the following simplified example:
A magnetic north (say 100% intersity north) represents a 1
A magnetic south (say 100% intersity south) represents a 0

Now what happens when we encounter a 85% north?
The disk controller will interpreted it as a 1.
No big deal, values do not need to be perfect.

Now to wiping a disk. I have 100% charge N, I wipe it with all zero's, ideally setting it too 100% S. But what happens is that it might end up 90% S. Now I heave a disk with 100% S parts (which originally were 0's) and with 90% S (which originally were 1's). So if I scan carefully enough I can reconstruc the old data.

And once more, that example is not technically correct. It is very much simplified.

Overwriting the data with multiple passes with different data makes enoguh of a mess out of it that it becomes unrecoverable. Add a few more passes and you get goverment standards for wiping. This is why some tools offer multiple passes.


Moving on to DBAN:

DBAN can send the 'secure erase' command to a disk. If the disk supports this it should erase itself without any further activity from the computers. That can yield significant speed gain. (e.g. when you connect the drive over a slow bus like USB).

And on SSD's this is often very quick because some of them always encrypt their data. A secure erase just deletes the key to that data and generates a new one. That makes safely wiping the SSD a matter of roughly 0 seconds.

< hat type="tinfoil">Assuming there is no backdoor in the firmware </hat>. :)

0

1) EDIT: This next section is only true for XP. Psycogeek pointed out that Vista and up does zero out the drive if you do a full format.

2) That being said, your definition of quick format and normal format is off. A normal format doesn't zero out the disk, that would take too long. The difference between the two is that the normal format looks for bad sectors on a drive, while the quick does not.

In 1. u say if you do full format the disk is zeroed, and in 2. u say normal fomrat (full u mean i guess) does NOT zero the disk

Well does a full format zero the disk or not? thnx

0

Look at it this way...

When you throw things away at your house, you can take that trash to the dump. On a computer, all the data is on the drive. Period. There is nowhere else for it to go. Recovering data from formatted drives is much like the ability to recover files that were deleted from a recycle bin. In each case, the data still exists but is no longer put together. Recovery programs know how to locate the data and reconstruct it.

The reason for multiple passes is to make it more difficult to recover/restore data in an effective way. It is a matter of data security. The more sensitive the data, the more passes you want. The Department of Defense recommends 7 passes. This is what they consider to be a sufficient deterrent and, perhaps, making it theoretically impossible to recover anything.

0

If a quick format just marks bits as writable, and a normal format writes 0s to the entire disk, why do people bother with DBAN, and why are multiple passes ever required?

The use of DBAN and equivalent stems from a combination of older technology, paranoia and a misunderstanding of "The Gutmann method". (The Gutman method was looked at as a definitive method of ensuring data was wiped from pretty much any type of disk using 35 different passes, a long time ago) People misunderstood it to be what was required to ensure data was unrecoverable, when in fact only 1 or 2 passes were required. Similar specifications were designed by militaries, and so the idea of lots of overwriting passes were cemented in management belief and policy.

Other considerations - old drives had the data scattered across the disks with less density, and, crucially, higher tolerance of write heads. On an old disk that was overwritten with "all zeros", it would be possible to replace the heads (or sometimes just the circuitry) and amplify the signals coming off the heads as a 0 which was previously a 1 would still read slightly higher then a true 0, thus making it possible to recover data. Writing random data / other patterns negates/largely negates the ability to recover data this way.

Programs like DBAN will also try to write over sectors which have been marked bad by media - formats would not "get to" this data so its more recoverable.

Not the answer you're looking for? Browse other questions tagged or ask your own question.