Overwrite Hard Disk One Time Adequate?

[gdr_11]

Being an old guy, I am prone to taking extra precautions when selling a computer. About 15 years ago, I started using utilities to do what was then called a "military wipe", that is the rewriting of all free space three separate times. Been doing this for a long time and never had an issue. Occasionally, I have just removed the hard drive and sold the computer without one.

I was running a CC Cleaner three time overwrite on the PC I am getting ready to sell and decided to browse the web to see if there was anything new on wiping disk space. Read an article that said anything more than a one time wipe is a waste of time since modern hard drives are essentially clean from being able to restore data once they are overwritten one time.

What say you, Calguns tech experts?

[d33pt]

once for SSD is fine, but for magnetic drives I'd do at least 3.

[Abu Riyah]

Single-pass wipe is forensically sound for any magnetic drive made in the past 10 years. Anything more is a waste of time. I like CCleaner and I have verified its single-pass wipes using forensic software, so I know for a fact that it does the job.

Another option is to just perform a full format from within your operating system, not the "quick format." Windows' format utility has been doing a full wipe ever since Windows XP SP3, as long as you do not click the "quick format" box.

If you want to verify it for yourself, you can download a free forensic utility called FTK Imager or just about any hex editor which will allow you to view the actual bytes on the hard drive. You can easily see whether or not the wipe has been successful, regardless of how you choose to do it and how ever many passes you choose.

[stilly]

Being an old guy, I am prone to taking extra precautions when selling a computer. About 15 years ago, I started using utilities to do what was then called a "military wipe", that is the rewriting of all free space three separate times. Been doing this for a long time and never had an issue. Occasionally, I have just removed the hard drive and sold the computer without one.

I was running a CC Cleaner three time overwrite on the PC I am getting ready to sell and decided to browse the web to see if there was anything new on wiping disk space. Read an article that said anything more than a one time wipe is a waste of time since modern hard drives are essentially clean from being able to restore data once they are overwritten one time.

What say you, Calguns tech experts?

Yeah right.

Tell that to the FBI contractor whose HD I ended up with after buying on ebay after their company IT department gave it one wipe and sold it and then I bought it as "NEW"...

BAHAHAHAHAHA. One wipe... Not even for your butt.

I would look for a good program and let it run per DOD specs or just get a degausser... Degaussers do not cost much and only cost about uhh, OKay I was wrong. Degaussers do kinda cost a little bit of money...

http://www.ebay.com/sch/i.html?_sacat=0&_nkw=degausser&_frs=1

[Abu Riyah]

Yeah right.

Tell that to the FBI contractor whose HD I ended up with after buying on ebay after their company IT department gave it one wipe and sold it and then I bought it as "NEW"...

BAHAHAHAHAHA. One wipe... Not even for your butt.

I would look for a good program and let it run per DOD specs or just get a degausser... Degaussers do not cost much and only cost about uhh, OKay I was wrong. Degaussers do kinda cost a little bit of money...
http://www.ebay.com/sch/i.html?_saca...gausser&_frs=1

Used drives being resold like that are frequently not actually wiped and contain old data on them....very common.

Single-pass wipe is still fine....as long as it is done correctly. That is why I verify whatever utility and process I use. The issue here is that the company's IT department did not wipe it correctly, maybe not even at all.

It is a violation of a number of federal/military regulations for any hard drive that has been used in one of the three-letter agencies or military to later be used outside of that environment even after being forensically wiped. That is a different issue and one that I regularly deal with the military and several of those agencies, so I question what that company is doing reselling their used hard drives.

Degaussers that work on hard drives actually destroy the drive so it cannot be used again at all. The strength of the magnetic fields effectively erases the data on the platters, but it also fries the electronics on the controller board. Again, this is something I deal with regularly.

In the old days, there were degaussers that worked on cassette tapes, audio and data, and on floppy disks. Those just erased the data or audio and the media could be reused...audio tapes could be taped over again and computer media just needed to be reformatted before being used again.

[CaliforniaCowboy]

[Abu Riyah]

As most of you probably know, but for those that may not. When you hit delete, that info is not actually erased or even touched at all. when you delete 5 gigs of something and you see your drive space go up by 5 gigs, that is not 5 more gigs of empty space, that is just your system saying "hey we have some space over here, it has info on it but if you need the space you can write over it, but until then, the info remains, and if you write over it, it is corrupted but sometimes not completely, the more you write over it the more the origional data is broken down and harder to recover.

I have a program called CCLEANER, it basically runs in the background and does stuff like gets rid of temp files, cookies and stuff.. It also has a great feature called Drive Wiper. You pick a drive on your PC and then choose the number of passes you want it to make, up to 35 passes! It will re arrange the 1's and 0's on your drive with each pass. basically scrambling the info. It takes a while to do but it does the job.

CCleaner has been mentioned twice before in this thread. The point that is being discussed, and perhaps debated, is that there is no difference between a 1-pass wipe and a 35-pass wipe except that one takes a lot longer than the other. The additional passes do not make the wiped areas more "zero" than they are on the first pass. Once a byte is set to x00, it is x00 and you are done.

[LeadSlinger585]

CCleaner has been mentioned twice before in this thread. The point that is being discussed, and perhaps debated, is that there is no difference between a 1-pass wipe and a 35-pass wipe except that one takes a lot longer than the other. The additional passes do not make the wiped areas more "zero" than they are on the first pass. Once a byte is set to x00, it is x00 and you are done.

Then why bother to offer a 2, 5, 35, or "x" (where x=whatever) pass wipe?

[Abu Riyah]

Then why bother to offer a 2, 5, 35, or "x" (where x=whatever) pass wipe?

There is no reason to do so with modern hard drive technologies.

The multi-pass wipe procedures were developed decades ago when a single pass did not effectively wipe hard drives built upon earlier technologies.

The fact that current wipe utilities still have the multi-pass options is simply an unnecessary holdover from the past.

"One and done" works - I have verified it multiple times in forensic labs, just as many others have.

[nitehawk117]

One or two passes with a 5lb sledge and then bust up the platters. Should be fairly safe then.

[randomBytes]

In the old days when disks were real disks, a single write pass was not considered sufficient. It was claimed possible to stick the platter in a lathe, and skim off just the outer surface, exposing the old data which being there longer was recorded more deeply.

Back then I worked for Honyewell, and a multics customer asked how to securely erase a disk before decommissioning a system - the answer provided was to destroy the disk in a fordge.

With flash devices that do wear leveling, it is hard to overwrite data.
So now as then physical destructions is best.

If you are not THAT worried about your data a single overwrite will do.

[randomBytes]

If you are really worried about data, these days encrypt the filesystem.
Secure erase is then just a matter off erasing the key.

[glassparman]

Been doing this for 25+ Years for the Gov. Use DODwipe or BCwipe.

These will write all zeros, then all ones then random. That's what we use in the Govt. Also, when done, shoot that sucker full of holes!!

[flyinverted]

What happens with a write is that you're magnetically changing a block on the hard drive from a 0 to a 1 and vice versa.

Good forensics can analyze the track area that is NOT a block and determine what was in the adjacent block by the magnetic signature that is left there.

This is much like how a mechanic can tell what colors and how many times your car has been painted. There's always some remnants left over. Newer hard drives have smaller tracks, and smaller dead areas. That leaves smaller areas for magnetic footprints. With a modern drive, I would be very surprised if a 1-3 pass wipe did not destroy the data and the remaining unused track area provided any recoverable/usable data.

[Abu Riyah]

What happens with a write is that you're magnetically changing a block on the hard drive from a 0 to a 1 and vice versa.

Good forensics can analyze the track area that is NOT a block and determine what was in the adjacent block by the magnetic signature that is left there.

This is much like how a mechanic can tell what colors and how many times your car has been painted. There's always some remnants left over. Newer hard drives have smaller tracks, and smaller dead areas. That leaves smaller areas for magnetic footprints. With a modern drive, I would be very surprised if a 1-3 pass wipe did not destroy the data and the remaining unused track area provided any recoverable/usable data.

What do you define as"good forensics?" I would be very interested in knowing what utility and/or process can do what you are claiming can be done. There was some truth to this years ago, but with modern drives (as you mentioned in your final sentence), this just is not possible with any process that I know of. After a 1-pass wipe of just about any hard drive you could possibly find today, you will not recover a single byte of the pre-wipe data.