webdevRefinery Forum: Data Erasing and Recovery - webdevRefinery Forum

Jump to content

Kick back!

Posts in this forum don't count toward your post count. We're trying it out to see how it goes :). See the details on why in this thread.
  • 3 Pages +
  • 1
  • 2
  • 3
  • You cannot start a new topic
  • You cannot reply to this topic

User is offline TheMaster 

  • *-c0de master-*
  • Group: Members
  • Posts: 748
  • Joined: 24-May 10
  • LocationAustralia
  • Expertise:HTML,CSS,PHP,Java

Posted 08 August 2012 - 01:39 AM (#1)

Data Erasing and Recovery


This post was partly inspired by the recent hacking of that Honan guy, who sadly had all his main devices erased!!

It got me thinking along a similar line, except from the owner's perspective.

---------

Anybody who's been using computers for a while, and knows a thing or two about how they work, realises that simply "deleting" a file doesn't erase it from the HDD completely. Friends are always asking me to recover files for them which they've accidentally deleted, which is simple enough using even free file recovery programs (they still have no idea how I do it :P).

Now, I've looked into file shredders and that sort of thing that do so many passes when deleting files. I THINK it works by overriding the data a certain number of times with random data. (Please correct me if I'm wrong).

Even using these methods, how easy is it for somebody, say, from the NSA or the FBI or whatever, to recover data once its been overridden, like, 35 times? I'm just interested to know! I heard somebody talking about all sorts of ways they use to extract data from a HDD they've confiscated or something.

Is it really IMPOSSIBLE to erase data from a HDD? Once its on there, its on there forever? Is there truly any way to erase data without blowing the HDD up? (Even then, I'd bet there's a way to get it back).

Thoughts?
0


User is offline Leamsi 

  • RoyLee KinsJen
  • Group: Members
  • Posts: 806
  • Joined: 18-March 10
  • LocationJonas Brothers Concerts

Posted 08 August 2012 - 02:22 AM (#2)

Eat the evidence.
"Years ago I got addicted to this one drug, it made me feel happy and awesome. It was music." -Koen
Posted Image
(I admin this server, drop by, and ask for Ismael!)
1


User is offline Quinn 

  • More pew-pew, less QQ
  • Group: Members
  • Posts: 1307
  • Joined: 08-March 10
  • LocationPalmyra, PA, USA
  • Expertise:HTML,PHP,Javascript

Posted 08 August 2012 - 02:37 AM (#3)

OS X has a built in method that erases empty space - overwriting all of it with 0s. Once that's done, it's gone.
<Imp> [F3ar 40]  [PWNbear 17]  [magik 15]  [dissident 10]  [mark 7]

View PostKyek, on 07 February 2011 - 07:11 AM, said:

Though anyone who thinks Europe is a country should be smacked in the face. By a train.
0


User is offline TheMaster 

  • *-c0de master-*
  • Group: Members
  • Posts: 748
  • Joined: 24-May 10
  • LocationAustralia
  • Expertise:HTML,CSS,PHP,Java

Posted 08 August 2012 - 02:57 AM (#4)

View PostQuinn, on 08 August 2012 - 02:37 AM, said:

OS X has a built in method that erases empty space - overwriting all of it with 0s. Once that's done, it's gone.


But does replacing it all with 0's gonna actually get rid of the data forever? There's no where to look at the platter and get it back or something?
0


User is offline ianonavy 

  • Group: Members
  • Posts: 685
  • Joined: 14-April 10
  • Expertise:HTML,CSS,Java,Javascript,Python

Posted 08 August 2012 - 03:02 AM (#5)

Yeah, all those 35+ overwrite methods (Gutmann, DoD 5220-22-M, NSA 130-1, etc.) are just WAY overkill and a waste of time. The idea behind all those extra writes is that supposedly a bit that's been written with a 0 that was originally a 0 is somehow physically different than a 0 that was originally a 1. That paper by Gutmann was written in 1996 and is pretty much obsolete for any modern HDD or SSD including flash media (SD cards, USB drives, etc.). One wipe with random data from /dev/random and a second with zeroes is more than plenty.

If you're VERY paranoid, there's the secure-delete package in APT. It does 38 writes by default, but all those extra writes are just going to eat away at your hard disk rather than make your data "more secure."

If you don't believe me, check out this reference, which I found while reading this article.
reputation += 1 if post.is_helpful else 0
0


User is online SapporoGuy 

  • Group: Members
  • Posts: 905
  • Joined: 10-June 11
  • LocationSonyLand

Posted 08 August 2012 - 03:07 AM (#6)

I am not sure but from what I've read there still seems to be a chance even after its been over written 0s. However, I'm not sure how many times is enough. 35 possibly ....

Eating is actually the best!
On prison break, Micheal threw his hard drive in the river. Stooopid! All you need is the same hard drive, a clean room and experience to move the platters over to the new hard drive box.

Which means, actually melting or shredding the platters is your best option for full security.

If not then, tear apart your drive, pull the platters and scratch the fuck out of them. But even then I wonder what a forensic lab could do ???

When I sell off my old hardware I, 0 out the drive with the original OS, throw in a linux live cd and do it again, and then 1 more time with the original OS hoping that Linux will have played with the boot sectors and the area that stores the category tree.

Just not sure if that is enough though :(
0


User is offline TheMaster 

  • *-c0de master-*
  • Group: Members
  • Posts: 748
  • Joined: 24-May 10
  • LocationAustralia
  • Expertise:HTML,CSS,PHP,Java

Posted 08 August 2012 - 03:21 AM (#7)

Yeah, hard drives seem to be one of those things that are almost impossible to completely erase!!!

Intentional? :P
0


User is online SapporoGuy 

  • Group: Members
  • Posts: 905
  • Joined: 10-June 11
  • LocationSonyLand

Posted 08 August 2012 - 03:44 AM (#8)

Intentional ... Conspiracy theory ... Yes!
Or a combination of both! Started off as a user feature later a NSA feature ;)
1


User is offline AwesomezGuy 

  • Certified Asshole™
  • Group: Members
  • Posts: 1245
  • Joined: 08-March 10
  • LocationIreland
  • Expertise:HTML,CSS,PHP,Javascript,SQL

Posted 08 August 2012 - 07:45 AM (#9)

Can we just throw TheMaster and SapporoGuy into a Conspiracy forum so we don't have to deal with this crap.

You can easily wipe a drive in a tonne of different ways:

  • Overwrite it a few times with random data, The DOE Compliant number is 35, but no one bothers with that, a 3 pass wipe is completely sufficient to permanently wipe the drive
  • Create an extremely powerful electromagnet around your door frame, anyone that tries to bring your PC out the door will completely wipe the drive
  • Dump the drive in a bucket of hydrochloric acid


And that's only 3 ways. Please stop your bullshit, every single thread on this forum is beginning to resemble a conspiracy thread thanks to you two. I for one would like Googlers who come here to take the forum seriously and talk about web development, not be scared off by conspiracy theories.
2


User is online SapporoGuy 

  • Group: Members
  • Posts: 905
  • Joined: 10-June 11
  • LocationSonyLand

Posted 08 August 2012 - 08:31 AM (#10)

Wow! We're just goofing off dude! Relax :)

If you're so worried about the reputation of these forums then why are you coming off like that? Yes, googlers will end up here but which will people remember? A couple of folks joking around or getting reprimanded for doing that?

Levity helps to make a bad / hard day that much easier. Not even mentioning how it actually improves study / work production.

@ conspiracy theories
I take the Discovery Channel rather seriously and yet they air conspiracy shows ...

@ drive disposal
A few screwdrivers and a good etching tool will be cheaper!
0


User is online callumacrae 

  • {{ post.author }}
  • Group: Members
  • Posts: 2862
  • Joined: 20-January 11
  • LocationWarwickshire, England
  • Expertise:HTML,CSS,PHP,Javascript,Node.js,SQL

Posted 08 August 2012 - 08:34 AM (#11)

View PostAwesomezGuy, on 08 August 2012 - 07:45 AM, said:

Can we just throw TheMaster and SapporoGuy into a Conspiracy forum so we don't have to deal with this crap.

Please stop your bullshit, every single thread on this forum is beginning to resemble a conspiracy thread thanks to you two. I for one would like Googlers who come here to take the forum seriously and talk about web development, not be scared off by conspiracy theories.

+1

Quote

You can easily wipe a drive in a tonne of different ways:

  • Overwrite it a few times with random data, The DOE Compliant number is 35, but no one bothers with that, a 3 pass wipe is completely sufficient to permanently wipe the drive
  • Create an extremely powerful electromagnet around your door frame, anyone that tries to bring your PC out the door will completely wipe the drive
  • Dump the drive in a bucket of hydrochloric acid


And that's only 3 ways.


The only one of those that will work is the third, I'm afraid (and even that one I'm not sure about) - the second has been tried before, and the cops generally notice things like that - especially as in order for it to be strong enough to take out the hard drive, it would easily attract anything metal within 5 or 6 metres :-D

The platter has to shatter - it's the only way. Drilling a few holes through it won't destroy *all* the data, unless it is turned on and active while you're doing it. I know of a few people who keep a bolt gun besides their hard drives, and if you're not in a hurry you can open it up and break it manually, or melt it using thermite.

There's an awesome video of a hard-drive shredder on YouTube somewhere :-D


ooor you could just get an SSD. Attach to battery = no more data.
Front-end developer and writer
Twitter | GitHub | phpBB Contributor and Website Team Member | lynxphp
0


User is offline Cyril 

  • Group: Members
  • Posts: 2544
  • Joined: 03-August 10
  • Expertise:HTML,CSS,PHP,Javascript,Graphics

Posted 08 August 2012 - 09:45 AM (#12)

View PostSapporoGuy, on 08 August 2012 - 08:31 AM, said:

Wow! We're just goofing off dude! Relax :)


The problem is, you're "goofing off" all the time. In all the threads. Just like TheMaster who denies his fanboyism with "I enjoy stirring people up".
We all have our little jokes, but learn to fucking take a break. You're taking it to the point of pissing people off, which is worsened by the fact that you can't seem to write properly, and half your text usually doesn't even make sense.

website :: github :: twitter :: dribbble :: forrst
html, css, php, javascript, graphics
0


User is offline AwesomezGuy 

  • Certified Asshole™
  • Group: Members
  • Posts: 1245
  • Joined: 08-March 10
  • LocationIreland
  • Expertise:HTML,CSS,PHP,Javascript,SQL

Posted 08 August 2012 - 09:54 AM (#13)

View Postcallumacrae, on 08 August 2012 - 08:34 AM, said:

+1



The only one of those that will work is the third, I'm afraid (and even that one I'm not sure about) - the second has been tried before, and the cops generally notice things like that - especially as in order for it to be strong enough to take out the hard drive, it would easily attract anything metal within 5 or 6 metres :-D

The platter has to shatter - it's the only way. Drilling a few holes through it won't destroy *all* the data, unless it is turned on and active while you're doing it. I know of a few people who keep a bolt gun besides their hard drives, and if you're not in a hurry you can open it up and break it manually, or melt it using thermite.

There's an awesome video of a hard-drive shredder on YouTube somewhere :-D


ooor you could just get an SSD. Attach to battery = no more data.


Ok maybe the second won't work, but the first and third will. You are not going to recover anything of use from a properly erased drive
0


User is online callumacrae 

  • {{ post.author }}
  • Group: Members
  • Posts: 2862
  • Joined: 20-January 11
  • LocationWarwickshire, England
  • Expertise:HTML,CSS,PHP,Javascript,Node.js,SQL

Posted 08 August 2012 - 10:00 AM (#14)

The reason you overwrite it multiple times is because every time a chunk of the data is removed and it becomes harder to recover. NO matter how many times you overwrite it, bits of information remain recoverable. Sure, it's a fairly small amount of information remaining, but it is still there.

It'll works, but it will have to be left for several hours. In what situation would you need to do that, and not find it easier to use a hammer?
Front-end developer and writer
Twitter | GitHub | phpBB Contributor and Website Team Member | lynxphp
0


User is offline ianonavy 

  • Group: Members
  • Posts: 685
  • Joined: 14-April 10
  • Expertise:HTML,CSS,Java,Javascript,Python

Posted 08 August 2012 - 10:12 AM (#15)

View Postcallumacrae, on 08 August 2012 - 10:00 AM, said:

The reason you overwrite it multiple times is because every time a chunk of the data is removed and it becomes harder to recover. NO matter how many times you overwrite it, bits of information remain recoverable. Sure, it's a fairly small amount of information remaining, but it is still there.

[Citation needed]
reputation += 1 if post.is_helpful else 0
0


User is online SapporoGuy 

  • Group: Members
  • Posts: 905
  • Joined: 10-June 11
  • LocationSonyLand

Posted 08 August 2012 - 10:25 AM (#16)

View PostCyril, on 08 August 2012 - 09:45 AM, said:

The problem is, you're "goofing off" all the time. In all the threads. Just like TheMaster who denies his fanboyism with "I enjoy stirring people up".
We all have our little jokes, but learn to fucking take a break. You're taking it to the point of pissing people off, which is worsened by the fact that you can't seem to write properly, and half your text usually doesn't even make sense.


All threads??? [scratch my head]

I ignored your +1 above. if there is a problem take it up with a mod or go to pm or better yet!
Kick back!
0


User is offline AwesomezGuy 

  • Certified Asshole™
  • Group: Members
  • Posts: 1245
  • Joined: 08-March 10
  • LocationIreland
  • Expertise:HTML,CSS,PHP,Javascript,SQL

Posted 08 August 2012 - 10:28 AM (#17)

View Postcallumacrae, on 08 August 2012 - 10:00 AM, said:

It'll works, but it will have to be left for several hours. In what situation would you need to do that, and not find it easier to use a hammer?


That is true, though technically you could retrieve data from the fragments of the platters if you had the time/will to do so.
I much prefer my hydrochloric acid solution, 10 minutes in a bucket of hydrochloric acid and there won't be anything recoverable on that drive.
Just don't accidentally stick your foot in your "eraser bucket" under the desk. That could have nasty consequences. :/
0


User is online callumacrae 

  • {{ post.author }}
  • Group: Members
  • Posts: 2862
  • Joined: 20-January 11
  • LocationWarwickshire, England
  • Expertise:HTML,CSS,PHP,Javascript,Node.js,SQL

Posted 08 August 2012 - 10:44 AM (#18)

View PostAwesomezGuy, on 08 August 2012 - 10:28 AM, said:

That is true, though technically you could retrieve data from the fragments of the platters if you had the time/will to do so.
I much prefer my hydrochloric acid solution, 10 minutes in a bucket of hydrochloric acid and there won't be anything recoverable on that drive.
Just don't accidentally stick your foot in your "eraser bucket" under the desk. That could have nasty consequences. :/

The type of hydrochloric acid required to dissolve a hard drive should not be kept under a desk!

Or in a bucket!

The Internet reckons that it would take a couple hours to completely remove all the data.
Front-end developer and writer
Twitter | GitHub | phpBB Contributor and Website Team Member | lynxphp
0


User is offline cosmie 

  • Group: Members
  • Posts: 223
  • Joined: 30-April 11

Posted 08 August 2012 - 11:21 AM (#19)

View Postcallumacrae, on 08 August 2012 - 10:00 AM, said:

The reason you overwrite it multiple times is because every time a chunk of the data is removed and it becomes harder to recover. NO matter how many times you overwrite it, bits of information remain recoverable. Sure, it's a fairly small amount of information remaining, but it is still there.


Due to the funky methods employed to write data by modern drives, the statement that bits of information remain recoverable is true. However, due to the density of modern hard drives, this point also becomes moot. Modern drives are so dense that forensically recovering the data becomes statistically unlikely and financially unfeasible. Say a 1MB track of data on a 500GB platter is recoverable. That 1MB track constitutes 1/512000 (.000195%) of the total size of the platter. In contrast, if a 1MB track of an older platter (say 5GB, the average from 10 years ago) remains recoverable, that constitutes 1/5120 (.0195313%) of the total space. That's 2 orders of magnitude difference. Sifting out that 1MB strip of "useful" data from "random" data is like spotting a dog on the ground from inside an airplane at 30,000ft.

This is an interesting read. It's an epilogue written by Peter Guttman, the guy that spawned the 35-pass erasing procedure.

Edit: And if you're wanting to physically destroy it, then go with the lovely Disktroyer.
1


User is offline Mack 

  • http://mackgoodstein.com/
  • Group: Members
  • Posts: 2070
  • Joined: 08-March 10
  • Expertise:HTML,CSS,PHP,Javascript

Posted 08 August 2012 - 11:40 AM (#20)

View Postcosmie, on 08 August 2012 - 11:21 AM, said:

Edit: And if you're wanting to physically destroy it, then go with the lovely Disktroyer.


As far as physically destroying the data goes, I've heard thermite is one of the best methods.
0


Share this topic:


  • 3 Pages +
  • 1
  • 2
  • 3
  • You cannot start a new topic
  • You cannot reply to this topic

2 User(s) are reading this topic
0 members, 2 guests, 0 anonymous users


Enter your sign in name and password


Sign in options
  Or sign in with these services