Forgot your password?
typodupeerror
Data Storage Security

Single Drive Wipe Protects Data 625

Posted by CmdrTaco
from the two-wipes-are-better-than-one dept.
ALF-nl writes "A forensics expert claims that wiping your hard drives with just one pass already makes it next to impossible to recover the data with an electron microscope." But that's not accounting for the super secret machines that the government has, man.
This discussion has been archived. No new comments can be posted.

Single Drive Wipe Protects Data

Comments Filter:
  • by htnmmo (1454573) on Monday January 19, 2009 @10:42AM (#26515481) Homepage

    One wipe is never enough.

    Didn't your mommy teach you anything?

    Especially true after Taco Bell.

    • Re: (Score:3, Funny)

      by craagz (965952)
      This guy here [bash.org] will need 30 bullets to wipe his hard drives.
    • by Anonymous Coward on Monday January 19, 2009 @11:31AM (#26516119)

      "One up, one down, one to polish."

      Dave Lister

    • by Crudely_Indecent (739699) on Monday January 19, 2009 @12:07PM (#26516549) Journal

      Like the Lemur King Julian said in the movie Madagascar:

      "Who wipes?"

      Seriously though, anyone sufficiently interested in protecting data can do it in numerous ways.

      I used a script to sanitize drives used in forensic collection. First pass writes from /dev/urandom, second pass writes from /dev/zero.

      When drives died or became unuseable they would meet a sledgehammer moving at high velocity.

      • by EdIII (1114411) * on Tuesday January 20, 2009 @01:48AM (#26525539)

        I used a script to sanitize drives used in forensic collection. First pass writes from /dev/urandom, second pass writes from /dev/zero.

        I use a script that writes random files from a 6TB collection of porn. That way, when somebody does find the drive it will be impossible for them to argue that I overwrote it with porn.

        Why is this drive filled with 2TB of porn? Answer: Why NOT?

        Why do you have to 10 drives filled with the same porn? Answer: My backup policies force me to protect data relative to it's importance. Next.

        Did these drives always have porn on them? Answer: Absolutely.

        Most juries would buy those answers in a second.

    • by rubycodez (864176) on Monday January 19, 2009 @12:45PM (#26516989)

      and both female slashdotters should remember to always wipe front to back

  • by MartinG (52587) on Monday January 19, 2009 @10:45AM (#26515513) Homepage Journal

    Just use encryption (of your whole drive or partition) and forget about wiping it.

    It's not that hard. For example, several modern Linux distros support encrypting your entire installation out of the box.

    • by postbigbang (761081) on Monday January 19, 2009 @10:53AM (#26515643)

      Sadly, it's best just to physically destroy the drive after use. I suggest a two-year old child just after its nap ought to do the trick.

    • by dmdavis (949140) on Monday January 19, 2009 @10:59AM (#26515735)
      You encrypt it, and someone can still potentially get it, even if the probability is miniscule. Maybe the algorithm is discovered to be flawed, or they see you type your password, or they install a hardware key-logger, or while it would theoretically take thousands of years to brute force it, random chance has them guess the right sequence on the first try (it could happen). You wipe the data though, and there is no chance for anyone to get it.

      Encrypting it is definitely a good idea, but not as a replacement for wiping it.

      • Re: (Score:3, Interesting)

        by itsme1234 (199680)

        while it would theoretically take thousands of years to brute force it, random chance has them guess the right sequence on the first try (it could happen). You wipe the data though, and there is no chance for anyone to get it.

        If we are to totally forget the order of magnitude needed for random chance to guess the key at first try then we can say that by chance "they" could actually guess your data at first try! Even if you wipe the data! Even if you vaporize your hdd!

      • by this great guy (922511) on Monday January 19, 2009 @01:54PM (#26517903)
        You are wrong. Because any decent hard drive encryption solution will not use the password to directly encrypt the sectors. They will use it to encrypt one ore more master keys which will then be used to encrypt sectors. For example dm-crypt/LUKS works that way (up to 7 master keys), as well as TrueCrypt. They do that precisely to render all the data inaccessible by simply wiping the master key. Another advantage of this technique is that the user can change her password at anytime without having to re-encrypt the whole disk (the app just re-encrypts the master key).

        So the GP is right: use disk encryption instead of relying on time-wasting/manual/unreliable data wiping !
    • by morgan_greywolf (835522) on Monday January 19, 2009 @11:05AM (#26515823) Homepage Journal

      Yep. They'll never get my data. It's all encrypted with the superior ROT13 encryption method. Twice just to be sure.

    • by Z00L00K (682162) on Monday January 19, 2009 @11:15AM (#26515929) Homepage

      Add a wipe to the encryption and you may be safe.

      The old problem with multiple wipes depended on the fact that there were rather large tolerances, but modern drives are very close to limits caused by physics, which means that it's a lot harder to extract wiped data.

      If the data also was encrypted it will probably be impossible to re-create since there always is a level of loss even at recovery. For unencrypted data this may not be a big problem and it can be rectified by hand, but for encrypted data it will upset the whole packet that was encrypted.

      But in a majority of cases a single wipe will be sufficient when the hardware is sold as surplus, since it's not easy to track and find out if a certain drive contains anything of interest.

    • Re: (Score:3, Interesting)

      by Kr3m3Puff (413047)

      Just to point out that we have to be abrest of the limitations of our chosen encryption scheme. Several of the IT Foresincs have started to exploit some the weaknesses that, while they may not be able to de-code infromation, might be able to identify that encrypted information is there and even what type of infromation might be encrypted.

      Legally, in some places, like the UK, you do not have the legal option to not disclose your encryption keys. Your only hope of keeping the government out of your pants is

    • by AusIV (950840)
      Take it one step further and overwrite the headers for your encrypted partition. Then nobody can compel you to produce the key.

      I use LUKS, which uses anti-forensic techniques for storing a copy of the key (encrypted with the user's password) in a header. The header is about 1 kb (see payload offset in cryptsetup luksDump). Finish with a drive, write random data over the first kilobyte of it, and if you trust 256 bit AES, your data is gone.

  • by davidwr (791652) on Monday January 19, 2009 @10:45AM (#26515527) Homepage Journal

    1) next to impossible != impossible
    2) if the feds require multi-pass wipes for non-classified data and media destruction for classified data, why should I settle for anything less?

    OK, maybe this guy is right and maybe the feds are behind the times, but I'd like to see multiple independent studies come out and say this before I'm getting rid of my drive sanitizers. I mean, we all know what happens to societies when they get rid of their equipment sanitizers [tlb.org], don't we?

    • by Talderas (1212466) on Monday January 19, 2009 @11:05AM (#26515815)

      Unless you work for the government or military, no one would be interested enough in the data on your drives to go through the effort and cost of doing the forensic investigation to find out what was on your hard drive before the wipe.

      For those of you in Rio Linda, nobody cares about you, or your data, unless you work for the government or military.

    • Re: (Score:3, Insightful)

      by Gorshkov (932507)

      if the feds require multi-pass wipes for non-classified data and media destruction for classified data, why should I settle for anything less?

      Yes, because we are all so fully aware that the US government only ever worries about REAL security, and not security theatre.

    • by holychicken (1307483) on Monday January 19, 2009 @11:23AM (#26516025) Homepage
      The government overdoing something based on a popular misconception? I am shocked and appalled!
    • Re: (Score:3, Insightful)

      by arminw (717974)

      .....why should I settle for anything less......

      because as a /. member it is highly unlikely that your deep dark secret data is worth the effort it takes to recover it after a single pass wipe. Anyone who posts on /. has, by definition, no data the NSA, KGB, Gestapo or any other such entity could possibly be interested in.

    • by Thaelon (250687) on Monday January 19, 2009 @11:32AM (#26516129)

      1) next to impossible != impossible
      2) if the feds require multi-pass wipes for non-classified data and media destruction for classified data, why should I settle for anything less?

      Because the government is rife with paranoid, bureaucratic nitwits with more motivation to be "safe" than is scientifically prudent, and far more motivation to further their own careers?

      And I add bureaucratic for very pointed reasons. In the beginning, suppose they had a competent CS guy deciding the policies for HD erasure, he probably figures a single zeroing is sufficient. And at the time (perhaps now too) he's correct. Then his successor wants to make in impression and put some bullet points on his resume, so he makes a big stink about "increasing security through a continuing commitment to data erasure" or some buzzword nonsense. Let's say this guy was a friend or relative of the previous guy - and not necessarily as competent. Now this did fuck all for actually making the data any harder to get at, but it furthered his career just a tiny bit. Now add 3-4 repetitions of this to the mix and you can see how the policies got to be so ridiculous. Now I am making all this up, but to me, this seems far more plausible than recovering overwritten data on a hard drive. How many times have you had trouble with your drive accidentally reading previous data from it? You know, with a drive head that was designed, redesigned, and improved over 50 years to read data from that disk.

      I don't get why people often think that the US government has super awesome technology that borders on magic in the field of computer science. In my experience they were 30+ years behind the times in some areas. Some better, some worse.

      The government is just made up of people. Like everyone else, so there's lots of human error. And since they get paid through taxes and don't have to worry about profits, they have little to no motivation to do a good job if their superior doesn't make them. It's why the government is into contracting these days, they get the job done quicker and better for less money because (in most cases) they have competition.

    • by Gordonjcp (186804) on Monday January 19, 2009 @12:25PM (#26516765) Homepage

      There is *no* way to recover the data on a modern drive after a single wipe. It is actually impossible. It cannot be done.

      The reason is simple - although you may be able to detect a tiny tiny bit of data from the previous recording, you've no idea how strongly overwritten it is. Now, with old drives which used simple on/off pulses to write data to the disk, it would be possible to see if the bit you're looking at is a little higher or lower than it should be, and infer the previous value from that. Modern drives use a system similar to QAM - quadrature amplitude modulation - to pack more bits of data into each transition on the disk. Since the signal is essentially analogue, you'd need to know how badly degraded the print-through was. You can't do this, so you can't recover data after it's been overwritten even once.

    • Multiple reasons (Score:3, Informative)

      by Sycraft-fu (314770)

      One reason they require it is simple paranoia. The lengths you go to protect something depends on the value of the thing you are protecting and thus the lengths someone might go to get it. Same reason they use lots of armed, highly trained agents to protect the president. The president is extremely important to the nation and people will go to great lengths to harm him. When you are talking about classified data, you go to the paranoid extreme.

      Another reason is inertia. These rules were written back when dr

  • by sakdoctor (1087155) on Monday January 19, 2009 @10:46AM (#26515529) Homepage

    I thought a few weeks ago we were supposed to drill holes in the drive platters and fill the case with thermite, then drop the whole computer into the fires of mount doom.

    This week, a one pass wipe is enough.

  • by m0i (192134) on Monday January 19, 2009 @10:46AM (#26515533) Homepage

    it is not like you can have 2 values for a single bit at the same time.. and density is so high these days that it makes sense to have a single write wipe the previous data forever.

  • Sure... (Score:5, Interesting)

    by MyLongNickName (822545) on Monday January 19, 2009 @10:47AM (#26515557) Journal

    That's what they WANT you to think.

    In all seriousness. If the government wants to get information, they are not going to the trouble of an electron microscope to look at your hard drive. I'm sure they have other methods of extracting the information they want. While this information (about how many wipes you need) is interesting from a theoretical point of view, it is useless from a practical one.

  • some subject (Score:5, Interesting)

    by Zironic (1112127) on Monday January 19, 2009 @10:47AM (#26515559)

    I thought this would be fairly obvious from the fact there doesn't exist any recovery services that will recover zerod out data for you, at most they can usually try to recover data that has been deleted(forgotten) by the operating system.

    • Re: (Score:3, Interesting)

      by rolfwind (528248)

      It relies on the fact that the delete portion of the trash doesn't actually touch the disk so much as it tells the computer those areas of disk are free to be used. I heard that Windows tends not to touch those regions for a while while Linux usually makes use of those first. But I don't remember if the issue was FAT/NTFS vs ext2/3 specific.

    • Re: (Score:3, Insightful)

      by txoof (553270)

      DD is probably the best bet for discarded/ebay'ed drives. I can't think of anyone who has the time or resources to dig up my data. If you're a fortune 500 company, or an international drug/arms/people/whatever smuggler, then you probably want to just go ahead and shred the drive [flixxy.com]. That way you don't have to worry about Joe skipping out early on Friday and forgetting to wipe the out-going CEO's drive.

      For the rest of us, just think about the economics of it; what criminal organization has access to a lab fu

  • by dbIII (701233) on Monday January 19, 2009 @10:49AM (#26515579)
    Myhtbusters need to look at this. Then they should do a wipe that would really suit their style - a shock wave through the drive will raise the temperature at the wave front above that where the material is magenetic (curie temperature). In other words - explosives!
  • Also (Score:3, Funny)

    by DetpackJump (1219130) on Monday January 19, 2009 @10:49AM (#26515601)
    I found that taking the disk platter out and using it as a coaster helps too.
  • Lies (Score:5, Funny)

    by Renderer of Evil (604742) on Monday January 19, 2009 @10:54AM (#26515667) Homepage

    Last month my grandma asked for a new laptop and prior to putting her old HP on ebay I wiped it via Gutmann 35-Pass method, way above DoD and NATO standards, so her ultra-secret vanilla cake recipe could remain a household secret.

    • Re:Lies (Score:5, Funny)

      by paeanblack (191171) on Monday January 19, 2009 @11:22AM (#26516007)

      Using a Gutmann 35-pass wipe is like cleaning your sink with bleach, shampoo, baby wipes, ammonia, laundry detergent, insecticide, paint remover, furniture polish, glass cleaner, body wash, whiteboard cleaner, and gasoline.

      Using full Gutmann suite is a waste of time. You only ever need the 1 or 2 runs that were designed for your drive.

      Essentially, you did the computing equivalent of trying to clean a barbecue grill with saline solution.

      • Re:Lies (Score:5, Funny)

        by jimicus (737525) on Monday January 19, 2009 @12:01PM (#26516465)

        Using a Gutmann 35-pass wipe is like cleaning your sink with bleach, shampoo, baby wipes, ammonia, laundry detergent, insecticide, paint remover, furniture polish, glass cleaner, body wash, whiteboard cleaner, and gasoline.

        Oh, so you've seen my sink?

    • Re:Lies (Score:4, Informative)

      by ksd1337 (1029386) on Monday January 19, 2009 @11:59AM (#26516443)
      Gutmann 35-pass is designed for hard drives which use MFM/RLL encoding. New disks don't use this encoding anymore, so this method is pretty much equal in deletion quality to the other methods.
  • Pre-scrambling drive (Score:4, Interesting)

    by davidwr (791652) on Monday January 19, 2009 @10:54AM (#26515669) Homepage Journal

    It says data written to a pristine drive is much easier to access.

    If drive-manufacturers wrote random data to their drives 2 or 3 times before shipping, I wonder if this would help?

    Combine this with OS-level "overwrite with random after delete" or, to allow for "oopsies," delayed-overwrite after delete but before next use, the problem of "ghost data" in unallocated drive space could mostly disappear.

    Of course, there are other issues, like data internal to a file that is no longer current, data in paged-memory files, and data on backup media, but that's outside the scope of the "I deleted the file, it should be gone but it's not" problem.

  • by necro81 (917438) on Monday January 19, 2009 @10:56AM (#26515693) Journal

    A forensics expert claims that wiping your hard drives with just one pass already makes it next to impossible to recover the data with an electron microscope.

    [pulls tinfoil hat tighter over head]

    Sure, that's just what they want you to think.

  • by JeanBaptiste (537955) on Monday January 19, 2009 @10:58AM (#26515729)
    These guys will give you 500 bucks [16systems.com]

    which is surely worth the time and effort involved in something like this.
  • by chord.wav (599850) on Monday January 19, 2009 @11:00AM (#26515745) Journal
    Even if it isn't deleted, try to recover a simple 10Mb jpg using an electron microscope... I guess it is as close to the "next to impossible" as if the file was deleted.
    • by coolsnowmen (695297) on Monday January 19, 2009 @11:57AM (#26516425)

      Define next to impossible

      The researcher did. From TFA:

      Recovering a single byte of data, for example, on a used drive is successful less than one percent of the time, he found. Accurately recovering four bytes, or 32 bits, of data only works nine times out of each million tries.

      So, 1 specific byte of data could be recovered 1% of the time, 4 bytes -> .0009%.
      Extrapolating to 10Mb is about 1/10^(10^6 / 8)=0% according to my calculator which keeps goes to 10^-324. So, I think 'next to impossible' is a pretty accurate term.

  • by bunratty (545641) on Monday January 19, 2009 @11:07AM (#26515839)
    I've found one pass of a sledgehammer makes it next to impossible to recover data from a disk. Even read-only media!
  • by mlwmohawk (801821) on Monday January 19, 2009 @11:16AM (#26515943)

    It seriously depends on your crime as to how far police will go to obtain data from a hard disk.

    If, for instance, to kill no more than three people in cold blood. They won't even look.

    If, you have a few ounces of pot, the DEA will use the FBI forensics labs.

    If you have a history of violence and have beaten countless women, they won't even look.

    If you've given more than a few hundred bucks to an Islamic charity, the NSA will step in.

    If you bilk hundreds or thousands of people out of millions of dollars, they won't even look.

    if you are accused of fighting on the train in San Fransisco, they'll just hold you down and shoot you in the back. Fuck the computer.

  • origin of urban myth (Score:5, Informative)

    by e**(i pi)-1 (462311) on Monday January 19, 2009 @11:23AM (#26516021) Homepage Journal
    The source of the claim seems Gutmann's 1996 article: http://www.usenix.org/publications/library/proceedings/sec96/full_papers/gutmann/index.html [usenix.org] where he says: "Data overwritten once or twice may be recovered by subtracting what is expected to be read from a storage location from what is actually read. Data which is overwritten an arbitrarily large number of times can still be recovered provided that the new data isn't written to the same location as the original data (for magnetic media), or that the recovery attempt is carried out fairly soon after the new data was written (for RAM)." It was challenged already in 2003 http://www.nber.org/sys-admin/overwritten-data-guttman.html [nber.org] where Feenberg writes: "Surveying all the references, I conclude that Gutmann's claim belongs in the category of urban legend." As usual, this story shows that individual claims have to be checked by independent parties. Even the claim that it can not be done.
    • by homb (82455) on Monday January 19, 2009 @11:41AM (#26516231)

      Actually Gutmann updated his article by stating:
      the methods that applied specifically to the older, lower-density technology don't apply any more. Conversely, with modern high-density drives, even if you've got 10KB of sensitive data on a drive and can't erase it with 100% certainty, the chances of an adversary being able to find the erased traces of that 10KB in 80GB of other erased traces are close to zero.

      Further in his later epilogue regarding the referenced article, he doesn't dispute the fact that article says exactly what he's saying (i.e. "one pass is more than enough"), he disputes the technique they used by saying it's totally flawed.

      So yeah, even Gutmann says not to bother, and a single pass erase is more than enough in today's high-density drives.

  • by Sun (104778) <shachar@shemesh.biz> on Monday January 19, 2009 @11:33AM (#26516147) Homepage

    From the article:

    "In many instances, using a MFM (magnetic force microscope) to determine the prior value written to the hard drive was less successful than a simple coin toss."

    A coin toss is usually referenced as the worst way to try and predict a 50:50 chance event. Disregarding all of the obvious problems (i.e. - that the bits on a hard disk do not have a 50:50 distribution (unless compressed or encrypted), and that a coin is not necessarily the most random thing, I'm still left with a puzzler

    If his methods have less chance of prediction than a coin toss, all he has to do is add a "not" gate at the end of his prediction algorithm, and he'll have better chance than a coin toss.

    To take this to an extreme, assuming random incoming data, a coin toss has 50% chance of a hit for the next bit. If you find a method that has a 0% chance of a hit, then just flip its output and you'll get a 100% chance of a hit. Lower chances than a coin toss actually mean a good prediction ability

    Shachar

  • by geekmux (1040042) on Monday January 19, 2009 @11:37AM (#26516191)
    I work for an electronics manufacturing company, and with damn near every consumer device "going green" and being RoHS-compliant, we won't have to worry about long-term storage anyway. Things like tin whiskering will ensure that your data will be wiped for you after a few years of use due to malfunction. After that, nothing a sandblaster or a few high-powered rifle rounds can't ensure that it's completely wiped.
    • by delirium of disorder (701392) on Monday January 19, 2009 @04:04PM (#26519431) Homepage Journal

      I've worked in the electronics industry too. You might get tin whiskers if you use an immersion tin finish on the board and a tin solder for the assembly, but you don't need to do that to get a RoHS compliant product. There are immersion gold, immersion silver, and other leadfree solder finishes available. Modern leadfree solder alloys don't have the same kind of problems with tin whiskers as earlier ones. Reflow heating should be preformed as well. Effective conformal coating can also reduce the risk of whisker growth. Another issue is that many vendors lie or don't properly track how their components are made. Don't trust the sales people! Test your parts yourself to make sure that they comply with the specs that you ordered.

      I support the adoption of RoHS in the USA because I've seen how corporations ignore the safety of their employees and customers with regard to hazardous materials such as lead. Strong democratic unions could be used to keep companies honest, but currently American unions tend to be too corrupt and weak to be able to change the industry.

  • *shakes his head* (Score:5, Interesting)

    by Notabadguy (961343) on Monday January 19, 2009 @11:50AM (#26516339)

    I can't help but sit here shaking my head in some disbelief at the comments I've read on this thread. Slashdotters are a technologically savvy community for the most part, and I lost track of the number of times that I saw something to the effect of "The government probably has means/software/tools/hacks to get your info."

    Now, I've done extensive work *for* the government in the realm of computer forensics, which is as far as I'll elaborate, and the tools we use are commercially available. Were anyone so inclined, you could even attend or get notes on FBI or DoD taught digital forensics classes.

    There's nothing wrong with some good old fashioned suspicion or conspiracy theory, but the *one* area that slashdotters should be mostly competent and knowledgeable on has more of those wild ideas than anywhere else.

  • DBAN, DBAN, DBAN (Score:3, Informative)

    by jd142 (129673) on Monday January 19, 2009 @12:38PM (#26516931) Homepage

    Pop in a DBAN cd, hit enter. You can tell the boss that you've performed a wipe that meets DoD specifications. There's no real time difference in doing one wipe, which doesn't meet DoD specs, or the three that DBAN does by default. Unless, of course, you are sitting there watching the percent complete go up. If you have free time to do that, how can I apply for your job?

    For the google impaired, http://www.dban.org/

  • Did anybody RTFCA? (Score:4, Informative)

    by Bigjeff5 (1143585) on Monday January 19, 2009 @01:10PM (#26517307)

    In the epilogue of http://www.cs.auckland.ac.nz/~pgut001/pubs/secure_del.html [auckland.ac.nz], Peter Gutmann basically calls the author of TFA a rtrd.

    Apparently, he's confusing two different techniques, and Gutmann claims that, of course it won't work the way he's doing it. He's doing it wrong. You can't use the Magnetic Force Microscope to perform an error cancelling read, it doesn't work. The success rate is - surprise! - less than 1%, exactly like TFA claims.

    Also, mentioned in Gutmann's epilogue, TFA confuses an MFM and a scanning electron microscope. They are not the same thing. An MFM reads magnectic levels, it doesn't "see" electrons like a SEL will.

    In any case, Gutmann agrees with TFA but for very different reasons. The new encoding techniques nullify the MFM. There is no point using it because it won't give you any usefull information on a modern drive. Also, the extremely high densities mean the only practical and reliable method of recovery is basic error-cancelling techniques, and that's only practical after one wipe. Even then, it's iffy at best.

    So yes, a single wipe is probably all you need. But who knows what data recovery techniques will be invented? A single pass is probably good enough right now, but 3-4 random passes is pretty much a sure thing, regardless of future techniques.

"But this one goes to eleven." -- Nigel Tufnel

Working...