Overwrite Hard Disk One Time Adequate?

[Tripper]

1-pass, just makes me change to the next set too often

[Abu Riyah]

I'm certainly not saying that anything is absolutely impossible or that it has never, ever been done in some form or other, especially when talking about older magnetic storage technologies. I'm just saying that if someone wipes their modern hard drive (manufactured within the last 10 to possibly 20 years), using a wipe utility or even performing a full format (with a current, modern OS), they are extremely unlikely to face any risk of having the wiped data recovered.

I would never say that anyone is stupid to choose a 3-pass (or higher) wipe if it makes them feel better or if necessary to comply with company or agency requirements (I do so when working with military and federal agency systems), but I would also challenge anyone to examine a drive with any of the forensic software tools available, before and after both a 1-pass and a 3-pass wipe, and demonstrate any difference in the results. I regularly use a 1-pass wipe which I verify afterward with forensic utilities to have been effective.

Again, this is all with current/recent/modern drive technologies in the real world and not theoretical/not-reproducible outside of the lab demonstrations with older/obsoleted tech.

[HKJay]

Jeezus this thread is painful.

gdr_11, the one thing that I'll add that I didn't see anyone else mention is that using a tool like CCleaner to overwrite your disk is not doing what you're intending. 1 pass or 100 passes. CCleaner runs within Windows. So it is only overwriting your free space. It won't be overwriting your core windows flies and other data that you probably wouldn't want other people getting ahold of. You need an overwrite tool that you boot from.

If you have an SSD (Solid State Disk) check the drive manufacturers site for a wipe utility. If you have a HDD (Hard Drive Disk), DBAN is a decent tool for wiping.

SSD's have changed the ways drives need to be overwritten. A lot of advice in this thread is "right" but based on outdated knowledge. Generally, Abu Riyah knows what he's talking about.

Here's a decent article: http://www.makeuseof.com/tag/securel...ut-destroying/

For HDDs I'd personally do 3 passes because it doesn't take that much more time. But generally one should be enough for most people against most threats.

[Abu Riyah]

As HKJay pointed out and I failed to clarify earlier, CCleaner is a great tool to prepare a system for resale, donation, or gifting to someone else. On the system drive, you basically delete all of your personal files (including all temp files and browser caches) and uninstall any applications you do not want to pass on...then you run CCleaner's wipe utility which will then effectively sanitize all of the unallocated space (where the deleted stuff is still present in hidden form). Ideally, you will want to create a new user profile, delete your old one(s), and then run CCleaner again to wipe the newly deleted profiles.

It will fully wipe additional drives, but not the system drive. It is just great for prepping a system and leaving the OS intact, if that is what you need/want to do. To fully wipe the system drive, you'll need to boot up from a bootable utility disk (CD or USB) with the wipe utility on it. Alternatively, you can pull the drive out and connect it to another system which has the appropriate wipe utility.

[Jeepergeo]

Been doing this for 25+ Years for the Gov. Use DODwipe or BCwipe.

These will write all zeros, then all ones then random. That's what we use in the Govt. Also, when done, shoot that sucker full of holes!!

Just because "That's what we use in the Govt." means so very little these days.

Edward Snowden and Hillary Clinton taught us that the Govt. is pretty much inept at keeping anything secure.

[stilly]

Used drives being resold like that are frequently not actually wiped and contain old data on them....very common.

Single-pass wipe is still fine....as long as it is done correctly. That is why I verify whatever utility and process I use. The issue here is that the company's IT department did not wipe it correctly, maybe not even at all.

It is a violation of a number of federal/military regulations for any hard drive that has been used in one of the three-letter agencies or military to later be used outside of that environment even after being forensically wiped. That is a different issue and one that I regularly deal with the military and several of those agencies, so I question what that company is doing reselling their used hard drives.

Degaussers that work on hard drives actually destroy the drive so it cannot be used again at all. The strength of the magnetic fields effectively erases the data on the platters, but it also fries the electronics on the controller board. Again, this is something I deal with regularly.

In the old days, there were degaussers that worked on cassette tapes, audio and data, and on floppy disks. Those just erased the data or audio and the media could be reused...audio tapes could be taped over again and computer media just needed to be reformatted before being used again.

I had a laptop that I got from Ebay. It was an HP NC6400 and after about a year I decided to upgrade so I pulled out the HD to put into an NC6520 and I discovered that there was a piece of paper attached to the HD that said it had been degaussed and wiped per some govt regulation...

Funny, I never could tell. I got it as an empty drive in a laptop and installed windows and STILL to this day have had no issues with it. It is about 4 years + old now...

[Frisco3Gun]

1. Open up the command line. Type:

cipher /wC:\

2. ?????

3. Profit

[the86d]

Single-pass wipe is forensically sound for any magnetic drive made in the past 10 years. Anything more is a waste of time. I like CCleaner and I have verified its single-pass wipes using forensic software, so I know for a fact that it does the job.

Another option is to just perform a full format from within your operating system, not the "quick format." Windows' format utility has been doing a full wipe ever since Windows XP SP3, as long as you do not click the "quick format" box.

If you want to verify it for yourself, you can download a free forensic utility called FTK Imager or just about any hex editor which will allow you to view the actual bytes on the hard drive. You can easily see whether or not the wipe has been successful, regardless of how you choose to do it and how ever many passes you choose.

This is false, about the full-format... (low-leveling is different, but you should only low-level if you have a util. from the MFR)
I did a test, and full-formatted a drive NTFS w/4k blocks, I then formatted it FAT32 with a different block size, then EXT3 with 4k blocks, then I carved a boatload of files off of it...

You just need to overwrite every block of data once on a mag-drive. (Bad sectors could theoretically be pulled from on a S.M.A.R.T. drive, but the data would be bad anyway...)
A zero-fill is easiest, and only one command (but does not wipe sectors marked bad via S.M.A.R.T. AFAIK):
dd if=/dev/zero of=/dev/sd(a, or whatever) bs=1M

On flash-drives, especially with wear-leveling there are sectors that need to be hit that you can't reach with a format, or a write, but I don't know much about those, but I assume that one could just zero-fill the drive a few times and the wear-leveling would hit most sectors... but most MFRs have a sanitize option w/their software.

http://www.noah.org/wiki/Dd_-_Destroyer_of_Disks

See: "Tinfoil hat paranoia"

[ocabj]

Several years back, there was a whitepaper regarding how it is theoretically possible to recover data from a zeroed out magnetic platter drive. But to this day, no one has has actually done it.

But I agree that anything beyond a single pass wipe is a waste of time.

[Abu Riyah]

This is false, about the full-format... (low-leveling is different, but you should only low-level if you have a util. from the MFR)
I did a test, and full-formatted a drive NTFS w/4k blocks, I then formatted it FAT32 with a different block size, then EXT3 with 4k blocks, then I carved a boatload of files off of it...

You just need to overwrite every block of data once on a mag-drive. (Bad sectors could theoretically be pulled from on a S.M.A.R.T. drive, but the data would be bad anyway...)
A zero-fill is easiest, and only one command (but does not wipe sectors marked bad via S.M.A.R.T. AFAIK):
dd if=/dev/zero of=/dev/sd(a, or whatever) bs=1M

On flash-drives, especially with wear-leveling there are sectors that need to be hit that you can't reach with a format, or a write, but I don't know much about those, but I assume that one could just zero-fill the drive a few times and the wear-leveling would hit most sectors... but most MFRs have a sanitize option w/their software.

http://www.noah.org/wiki/Dd_-_Destroyer_of_Disks

See: "Tinfoil hat paranoia"

Not false, though I appear to have been incorrect about which version of Windows began writing zeros during a full-format...per Microsoft, it began with Vista. I was sceptical at first too, but it was initially demonstrated to me by someone at Guidance Software, the makers of Encase.

I don't know what went wrong with your experiment, but I have repeated it multiple times and have always found that Windows 7's full-format does indeed write zeros to the entire drive. What OS did you use for your initial NTFS full-format? Obviously, your initial full-format did not overwrite the drive with zeros, otherwise there would have been nothing left to carve out.

Your statement about the possible risk of recovering data from bad sectors on a S.M.A.R.T. drive is a good observation.

From https://support.microsoft.com/en-us/kb/941961

The behavior of the format command changed in Windows Vista and later Windows versions. By default in Windows Vista and later versions, the format command writes zeros to the whole disk when a full format is performed. In Windows XP and earlier versions of Windows, the format command does not write zeros to the whole disk when a full format is performed.

[djhall]

For ordinary needs and traditional hard drives I find DBAN with autonuke to be free, easy, and effective (unless you are seriously worried that a fortune 500 corporation, research university, or 3 letter federal governmental agency would invest significant resources to recover your data).

[the86d]

Not false, though I appear to have been incorrect about which version of Windows began writing zeros during a full-format...per Microsoft, it began with Vista. I was sceptical at first too, but it was initially demonstrated to me by someone at Guidance Software, the makers of Encase.

I don't know what went wrong with your experiment, but I have repeated it multiple times and have always found that Windows 7's full-format does indeed write zeros to the entire drive. What OS did you use for your initial NTFS full-format? Obviously, your initial full-format did not overwrite the drive with zeros, otherwise there would have been nothing left to carve out.

Your statement about the possible risk of recovering data from bad sectors on a S.M.A.R.T. drive is a good observation.

From https://support.microsoft.com/en-us/kb/941961

I believe I was either on XP (I believe it was on SP3) when I did it. (I have never used Vista on any machine I frequent.) I should probably redo the test and try to carve for verification with something current.

[darkgrue]

Just because "That's what we use in the Govt." means so very little these days.

Especially since the most popular reference for "military-grade" drive wiping is a massively outdated version of the NISPOM that hasn't been in use for a long time.

Right now, the NISPOM doesn'r advocate *any* method for sanitization media (it stays it's a decision for the Cognizant Security Authority). The intelligence community uses NSA/CSS Policy Manual 9-12, which says magnetic media needs to be smelted.

Mind you, both standards are for classified media, but 99.9%, of the time when you see a vendor or someone taking about government methods, they're talking about a cherry-picked version of the NISPOM.

That all being said, I'd agree with the previous references that say for must people and businesses, a single pass wipe is fine. Do three if it makes you feel better. Doing more is a waste of time.

Don't even try using a overwrite utility for magnetic media on a SSD. It won't work properly. It will most likely *appear* to work. It'll chug away and go "bing" at the end. It won't accomplish what you want. Sanitizing a SSD must be done at the firmware level, so that wear leveling and other optimizations can be bypassed. Fortunately, more and more manufacturers are providing secure erase utilities for their SSDs these days.

And if you are being targeted by a nation state, and need to fear elaborate lab-grade analysis? Why are you saving the drive? Thermite and be done with it. Hysteresis is NOT your friend. =/

[Nodaedul]

Just do a full disk encryption using freeware like DiskCryptor. After that you can sell it without even deleting anything. But wipe it if it makes you happy.

[Exospeed]

For ordinary needs and traditional hard drives I find DBAN with autonuke to be free, easy, and effective (unless you are seriously worried that a fortune 500 corporation, research university, or 3 letter federal governmental agency would invest significant resources to recover your data).

Same here, Ive been using DBAN for a couple years now.