Overwrite Hard Disk One Time Adequate?

[Abu Riyah]

Been doing this for 25+ Years for the Gov. Use DODwipe or BCwipe.

These will write all zeros, then all ones then random. That's what we use in the Govt. Also, when done, shoot that sucker full of holes!!

There's really no need to shoot them full of holes after they are wiped, but yes, it is a lot of fun!

Within the Intelligence Community, there are policies & procedures in place that allow for the reuse of wiped hard drives, even in systems at a lower level of classification, as long as they are maintained within govt control.

[sl0re10]

or just get a degausser...

that's gonna blow the hidden behind the scenes low level format and make the drive not work (it's still there; but done at the factory since the controller is part of the drive).

Might as well just open and break the platters up.

multi wipes are good if you want to resell the drive.

[Abu Riyah]

In the old days when disks were real disks, a single write pass was not considered sufficient. It was claimed possible to stick the platter in a lathe, and skim off just the outer surface, exposing the old data which being there longer was recorded more deeply.

Back then I worked for Honyewell, and a multics customer asked how to securely erase a disk before decommissioning a system - the answer provided was to destroy the disk in a fordge.

With flash devices that do wear leveling, it is hard to overwrite data.
So now as then physical destructions is best.

If you are not THAT worried about your data a single overwrite will do.

While doing forensics for an Intel agency that I'll leave unnamed, we discovered certain models of SSDs that did not correctly implement certain commands designed to wipe the flash memory. After that, physical destruction of decommissioned solid state drives was required.

Even some newer SSDs with corrected instruction sets were found to not be wiped after using certain utilities because they had been updated to deal with the specific requirements of solid state drives...they basically treated them as magnetic hard drives which did not work.

Be very careful about wiping SSDs since it may not work as expected.

[Victor Cachat]

Every old HD I have decommissioned in the last 10 years has been disassembled.
The magnets are holding things to my fridge.
The disks are scaring birds after getting real close to the magnets.

[gorn5150]

CCleaner has been mentioned twice before in this thread. The point that is being discussed, and perhaps debated, is that there is no difference between a 1-pass wipe and a 35-pass wipe except that one takes a lot longer than the other. The additional passes do not make the wiped areas more "zero" than they are on the first pass. Once a byte is set to x00, it is x00 and you are done.

Not really true. The reason for multiple passes is to cover the data area. HD heads don't hit the same exact spot every singe time. Doing at least three passes will pretty much cover the whole area but 7 passes used to be the federal standard. How do I know? I used to be one of the lead detectives on a state/federal high tech crimes taskforce before I retired.

That being said, 1 pass will probably be fine for non top secret type info as long as the pass writes random patterns. The British standard is to run a 24 pass wipe then melt the drive. They then run the slag through a crusher and lock the power away in a special vault. Way overkill but that is what they do.

Even with multiple pass wipes if someone has lots of money to throw at the drive data can be recovered. It involves electron microscopes. Formatting a drive is not a real good way to delete data. I have restored lots of drives that have been formatted.

[nothinghere2c]

1 pass of random data will get you by for any typical recovery

if you're worried about it, do 2 or even 3 of random data

if you're paranoid, which you should be, destroy the drive

[gorn5150]

1 pass of random data will get you by for any typical recovery

if you're worried about it, do 2 or even 3 of random data

if you're paranoid, which you should be, destroy the drive

Best answer so far. Even after my long winded post. I don't ever sell for give a drive away. I do a 3 pass random wipe then destroy the drive.

[Tripper]

3 pass DoD wipe minimum, thats if you have something that someone else would find worth spending 100s of thousands of dollars to recover. if you have nothing on the drive worth the cost it would take to recover, its a waste of time, well it really isnt that rough, i put it on and let it go over night or however long, its not like i have to sit there and watch it, so length of time is kind of not relevant. the more passes, and type of passes the more time and money it takes
destruction, has to be the right kind of destruction, keep in mind, a significant portion of the crashed space shuttle hard drives were recovered.

[BigFatGuy]

Older drives, with larger "bits" that required more power to alter, took significant effort to change, and this lead to the DoD protocols.

rad-hard electronic devices (like those on the space shuttle) tend towards this style. big, power-hungry, slower, harder to delete.

Recent research has showed that more modern drives, meant for an air conditioned office, are sufficiently deleted after just one pass.

If you're really worried, sell the PC without the drive.

[Abu Riyah]

http://www.cs.auckland.ac.nz/~pgut00...ecure_del.html)

Mayergoyza, I.D., Tse, C., Krafft, & C., Gomez, R. D. (2001) "Spin-stand imaging of overwritten data and its comparison with magnetic force microscopy", JOURNAL OF APPLIED PHYSICS VOLUME 89, NUMBER 11

Ren, W. E, W. & Vanden-Eijnden, E. (2003) "Energy landscape and thermally activated switching of submicron-size ferromagnetic elements", J. Appl. Phys. 93, 2275?2282.

[Abu Riyah]

From: NIST Special Publication 800-88 Revision 1, Guidelines for Media Sanitization

For storage devices containing magnetic media, a single overwrite pass with a fixed pattern such as binary zeros typically hinders recovery of data even if state of the art laboratory techniques are applied to attempt to retrieve the data.

Full document is here: http://nvlpubs.nist.gov/nistpubs/Spe...P.800-88r1.pdf

[Abu Riyah]

Every old HD I have decommissioned in the last 10 years has been disassembled.
The magnets are holding things to my fridge.
The disks are scaring birds after getting real close to the magnets.

Those are some of the strongest magnets I've ever encountered...definitely keepers!

[odysseus]

Yes, this is what I was going to say. Single pass wipe is more than enough for most everyone these days, it has already been seen that one pass bit sector wipes actually are not readable using standard recovery methods. Now are there maybe further, and very expensive and exhaustive ways to possibly read ghost magnetic imprinting? Possibly yes - but that is very beyond what anyone should be even considering a reality in their world, and even IF so you were one of those people that would, you would be hard encrypting your drive anyway and this point would be more moot then.

Personally, if you are concerned, drill holes and shatter the media and destroy the drive completely. The stuff is cheap, and if you care that much so be it.

Okay...the FUD is getting very deep here. Electron microscopes and physical bit size and claims to have recovered data from fully formatted drives....all FUD unless you can provide scientific proof. Even NIST says that a 1-pass wipe is forensically sound. The SANS Institute says the same. There have been many, many publications of scientific research supporting this. You guys that claim otherwise are just perpetuating fallacies. 1-pass (done correctly) and you are not going to recover anything, regardless of how much time and money you throw at the drive with the very rare exception of certain drives and/or utilities that are known to not operate correctly. Still don't believe me (or SANS or NIST)? Read a few of these; if you still don't believe, then nothing will convince you to accept the facts:

[Tripper]

hmm, NIST, long ago, said DoD 7 pass might not be enough, when using some scopes. granted, new technology and data have changed the game, and it likely is not as important now as it was before
NIST and SANS still recommend data wiping tools and techniques, and have recent white papers/publications on the matter. i think they mostly suggest 1 pass is good on drives manufactured after a certain date or some types dirves. but heck, i like 3 cuz i've done 3 forever, and i can start a set of drives on 3 pass in the morning and they will be done by end of day. .gov still has mandates on data wiping.

Guttman (from your reference) is among some of the oldest methods of wiping drives.
even your reference shows the science behind the recovery of overwritten data
not sure what you are suggesting is FUD here
are you saying data recovery of a simple formatted hard drive is impossible, and has never been done? or that a single pass has never been recovered. or are you possibly referring to newer drives?

i think drives made in the last 10 years are probably good with a single pass, the technology is so much better, and data writing is more precise than it was in the 90's

oh, there are data centers now that have really old drives

[M1NM]

We don't trust any of them at work. The drives get pulled degaussed and crushed.