destorying the hard drive

On Fri, 21 Mar 2008 11:46:57 -0600, "philo" put
finger to keyboard and composed:

No one has *EVERY* given evidence of retrieving data from a properly
zero-wiped drive.

Here is the definitive answer:

http://searchwincomputing.techtarget...246592,00.html

I see that the author cites a paper by Peter Gutmann:
http://www.cs.cornell.edu/people/cla...e_deletion.pdf

Gutmann states that ...

================================================== ===================
Most drives are capable of microstepping the heads for internal
diagnostic and error recovery purposes (typical error recovery
strategies consist of rereading tracks with slightly changed data
threshold and window offsets and varying the head positioning by a few
percent to either side of the track), but writing to the media while
the head is off-track in order to erase the remnant signal carries too
much risk of making neighbouring tracks unreadable to be useful (for
this reason the microstepping capability is made very difficult to
access by external means).
================================================== ===================

In the 80s I used to service CDC SMD hard drives which supported track
offsets and early/late data strobes for improving the reliability of
data retrieval. These features were part of the documented command
set. I still don't see how, by using a simple software approach, one
could extract the remnant magnetisation at the track edges from the
much more dominant primary data.

- Franc Zabkar
--
Please remove one 'i' from my address when replying by email.

On Fri, 21 Mar 2008 02:38:55 -0300, John John
put finger to keyboard and composed:

Lee wrote:

Best advice yet is correct, but your advice on zero filled data is
totally incorrect.

No, his advice is totally correct! I challenge you, or anyone reading
these groups, to offer concrete proof that they can recover zero
written/wiped files or to give us the names of data recovery firms who
can do it.

It cannot be done, it has never been done, no one has ever been able to
do it and no one has ever been able to offer a shred of evidence that
they have successfully recovered files on securely wiped disks.

John

The following article was written by a company that is selling data
wiping software, so actual data recovery may be less plausible than
they make out, if not impossible:

http://web.archive.org/web/200703070...com/art15.html

The article states that "horizontal head alignment and vertical head
placement is just a bit different every time data is written and
rewritten to the same track". This results in horizontal and vertical
magnetic "shadow data" which can be recovered by sensitive equipment.

Curiously the article claims that "if you have an interest in
researching and experimenting with shadow data, basic tools are
available for free download over the Internet". However the authors
qualify this statement by adding that "software solutions provide
limited success because they rely upon the same mechanical flaws
discussed above". I don't understand how software could do what the
authors claim, although I expect that one could use undocumented
commands (if they exist) to add track offsets and/or early/late data
strobes to any read or seek command. But AFAICS this would only be
useful in retrieving marginal primary data, not remnant data.

- Franc Zabkar
--
Please remove one 'i' from my address when replying by email.

Format. There was no such thing as a format with adjectives. No "low
level", no "full", no "quick". Just plain format...
"during which time the drive geometry - cylinders,
tracks - is laid out, tracks are numbered, the entire drive is
written
with a byte pattern and verified."
Except there were no cylinders on 5 1/4 floppies..

dadiOH
______________

Gary S. Terhune wrote:
What did?


"dadiOH" wrote in message
...
Use to be just plain "format" (sans adjectives)

dadiOH
_____________

Gary S. Terhune wrote:
What you describe is a "low-level" format, not a "full" format.


"dadiOH" wrote in message
...
Bill in Co. wrote:
Even as I said, if you do a Full format, I think you'll be hard
pressed to recover much, despite what Gary said. But I think
Gary was thinking of the Quick Format (and I don't consider
that a real format).

There is no longer such a thing as a true "full format" of a hard
drive except the one done by the manufacturer originally.
Certainly, not one by Windows...a full format of even a smallish
hard drive would take many hours during which time the drive
geometry - cylinders, tracks - is laid out, tracks are numbered,
the entire drive is written with a byte pattern and verified.

If the OP wants to destroy everything on the drive - including
all intersector bytes - passing a magnet over it should do it.
...a help file of info about MP3s, recording from
LP/cassette and tips & tricks on this and that.
Get it at http://mysite.verizon.net/xico

Franc Zabkar wrote:

I suspect that the difference in the treatment of FDs and HDs may be
due to the fact that diskettes can be magnetically blank, ie they
may have no prerecorded sector IDs, in which case they need to be
low level formatted. HDs, OTOH, are already low level formatted at
the factory.

- Franc Zabkar

Bingo.

--

dadiOH
____________________________

dadiOH's dandies v3.06...
....a help file of info about MP3s, recording from
LP/cassette and tips & tricks on this and that.
Get it at http://mysite.verizon.net/xico

On Fri, 21 Mar 2008 13:41:24 +1100, Franc Zabkar
put finger to keyboard and composed:

Typing "help format" at the DOS prompt documents the function of
several switches, including /U, which is supposed to "destroy all
existing data":

I now recall doing some pertinent testing (on an NTFS volume from a
Win98SE box) in this group over a year ago. Here is what I found at
that time:

http://groups.google.com/group/micro...b?dmode=source

"I was able to confirm that an Fdisk does write F6 data patterns to
those sectors identified in a previous post, but I was surprised to
find that neither Format /u nor Format /c (in real DOS mode) appeared
to write anything at all to the disc ... A Windows full format appears
to write the boot block, initialise the FATs with zeroes, and create a
new root directory containing a volume name and the Recycled folder.
It appears that nothing else is written to the disc - all the original
NTFS data are still there."

Sorry for my original disinformation.

- Franc Zabkar
--
Please remove one 'i' from my address when replying by email.

Ancient days, well before the technology that is the topic here.

--
Gary S. Terhune
MS-MVP Shell/User
www.grystmill.com
\
"dadiOH" wrote in message
...
Format. There was no such thing as a format with adjectives. No "low
level", no "full", no "quick". Just plain format...
"during which time the drive geometry - cylinders,
tracks - is laid out, tracks are numbered, the entire drive is
written
with a byte pattern and verified."
Except there were no cylinders on 5 1/4 floppies..

dadiOH
______________

Gary S. Terhune wrote:
What did?


"dadiOH" wrote in message
...
Use to be just plain "format" (sans adjectives)

dadiOH
_____________

Gary S. Terhune wrote:
What you describe is a "low-level" format, not a "full" format.


"dadiOH" wrote in message
...
Bill in Co. wrote:
Even as I said, if you do a Full format, I think you'll be hard
pressed to recover much, despite what Gary said. But I think
Gary was thinking of the Quick Format (and I don't consider
that a real format).

There is no longer such a thing as a true "full format" of a hard
drive except the one done by the manufacturer originally.
Certainly, not one by Windows...a full format of even a smallish
hard drive would take many hours during which time the drive
geometry - cylinders, tracks - is laid out, tracks are numbered,
the entire drive is written with a byte pattern and verified.

If the OP wants to destroy everything on the drive - including
all intersector bytes - passing a magnet over it should do it.
...a help file of info about MP3s, recording from
LP/cassette and tips & tricks on this and that.
Get it at http://mysite.verizon.net/xico

I don't know that floppies are treated the same but I think so.

--
Gary S. Terhune
MS-MVP Shell/User
www.grystmill.com

"Bill in Co." wrote in message
...
OK, but I apparently stand corrected in assuming that it was as "thorough"
on a hard disk as it was on a floppy - overwriting everything on the disk
(or at least I'm pretty sure that assumption is still true for a floppy
using full format).

Hmmm. Perhaps I should have known better in at least one way, because
I once tried one of those disk overwriting programs and it seemed it took
forever.

Gary S. Terhune wrote:
FORMAT C: takes a while because the default action is a Thorough scan by
Scandisk after formatting. To avoid this, use the /q (quick) switch.

--
Gary S. Terhune
MS-MVP Shell/User
www.grystmill.com

"Bill in Co." wrote in message
...
That's it, for a hard drive??? OK, then I stand corrected. Must be
only for floppies that it can do the whole shebang.

I had thought, though, in the past, when I did a format c:/s, for
preping
a hard drive for Win9x, it was overwriting all the hard disk, as it took
awhile (at least as I recall). Guess not.

Gary S. Terhune wrote:
You're wrong. Full format has no effect on the data. Full format is
Quick
format followed by a cluster integrity check, no more.

--
Gary S. Terhune
MS-MVP Shell/User
www.grystmill.com

"Bill in Co." wrote in message
...
Even as I said, if you do a Full format, I think you'll be hard
pressed
to
recover much, despite what Gary said. But I think Gary was thinking
of
the Quick Format (and I don't consider that a real format).

John John wrote:
Lee wrote:

Best advice yet is correct, but your advice on zero filled data is
totally incorrect.

No, his advice is totally correct! I challenge you, or anyone
reading
these groups, to offer concrete proof that they can recover zero
written/wiped files or to give us the names of data recovery firms
who
can do it.

It cannot be done, it has never been done, no one has ever been able
to
do it and no one has ever been able to offer a shred of evidence that
they have successfully recovered files on securely wiped disks.

John

Sounds about right. I realize, too, that I've been restricting my
considerations to HDs, not floppies.

--
Gary S. Terhune
MS-MVP Shell/User
www.grystmill.com

"Franc Zabkar" wrote in message
...
On Fri, 21 Mar 2008 05:32:07 -0700, "Gary S. Terhune" none put
finger to keyboard and composed:

You're wrong. Full format has no effect on the data. Full format is Quick
format followed by a cluster integrity check, no more.

I think you're right. Maybe the confusion, at least in my case, is due
to the different way the Format command appears to treat floppy
diskettes as opposed to hard drives.

Anyway, after "full" formatting a 320GB USB HD from within Explorer, I
used a disc editor to view the HD and found that all the data appeared
to be intact. I suspect that a "format /u" from within DOS would
produce the same result but I don't have a spare HD to reliably test
this (my USB HD stalls at 0%).

OTOH, a full format of a floppy diskette writes F6 bytes to every
sector in the data area. The same thing happens when I type ...

format a: /u

... at a DOS prompt.

A "quick" GUI format or a plain DOS format both leave the diskette's
data area intact.

Here are two of the FD images:
http://www.users.on.net/~fzabkar/frmt_img.zip (4.2KB)

I suspect that the difference in the treatment of FDs and HDs may be
due to the fact that diskettes can be magnetically blank, ie they may
have no prerecorded sector IDs, in which case they need to be low
level formatted. HDs, OTOH, are already low level formatted at the
factory.

- Franc Zabkar
--
Please remove one 'i' from my address when replying by email.

Franc Zabkar wrote:

On Fri, 21 Mar 2008 02:38:55 -0300, John John
put finger to keyboard and composed:


Lee wrote:


Best advice yet is correct, but your advice on zero filled data is
totally incorrect.

No, his advice is totally correct! I challenge you, or anyone reading
these groups, to offer concrete proof that they can recover zero
written/wiped files or to give us the names of data recovery firms who
can do it.

It cannot be done, it has never been done, no one has ever been able to
do it and no one has ever been able to offer a shred of evidence that
they have successfully recovered files on securely wiped disks.

John


The following article was written by a company that is selling data
wiping software, so actual data recovery may be less plausible than
they make out, if not impossible:

http://web.archive.org/web/200703070...com/art15.html

The article states that "horizontal head alignment and vertical head
placement is just a bit different every time data is written and
rewritten to the same track". This results in horizontal and vertical
magnetic "shadow data" which can be recovered by sensitive equipment.

Curiously the article claims that "if you have an interest in
researching and experimenting with shadow data, basic tools are
available for free download over the Internet". However the authors
qualify this statement by adding that "software solutions provide
limited success because they rely upon the same mechanical flaws
discussed above". I don't understand how software could do what the
authors claim, although I expect that one could use undocumented
commands (if they exist) to add track offsets and/or early/late data
strobes to any read or seek command. But AFAICS this would only be
useful in retrieving marginal primary data, not remnant data.

The perpetuation of the myth that data can be recovered on wiped drive
is a self serving exercise that sellers of drive wiping software have
long engaged in. No one has ever been able to recover files on securely
wiped drives. The notion that this *might* be possible was only
advanced by Peter Gutmann as background material for his paper on Secure
Deletion of Data on drives. Furthermore, Dr. Gutmann's research was
done on an old class of drives that is practically out of use today, the
techniques described in his paper are hardly applicable to modern hard
drives, which is a moot point anyway because they didn't even work on
the old class of hard drives!

John

Mike Y wrote:

"John John" wrote in message
...

Mike Y wrote:


"John John" wrote in message
...


Lee wrote:



Best advice yet is correct, but your advice on zero filled data is
totally incorrect.

No, his advice is totally correct! I challenge you, or anyone reading
these groups, to offer concrete proof that they can recover zero
written/wiped files or to give us the names of data recovery firms who
can do it.

It cannot be done, it has never been done, no one has ever been able to
do it and no one has ever been able to offer a shred of evidence that
they have successfully recovered files on securely wiped disks.

John



Special hardware can could overwritten data. Either with an analog
analysis or looking for bit shifts. Don't get confused in thinking that
digital is digital, it's still an analog media...

That is not true, there is no such magical machine available at any cost
that can recover data on securely wiped (zero filed) drives. No one can
recover data on properly wiped drives, the notion that it can be done is
nothing more than a myth.

John


Well, when you say securely wiped, by that meaning multiple wipes, I agree.
(The most secure is to wipe multiple times with multiple and DIFFERENT
data)

Also, if you imply that there exists no machine that interfaces to the IDE,
then I also agree. At least, I've not heard of any. And I don't know of
any manufacturer that has backdoor hooks to allow the capabilities needed
to be implemented. (I'm not sure, but reasonably confident that most,
if not all, drives out there don't have the capability, even if a hacker had
ability to reprogram the firmware to do his bidding.)

However, there are TWO methods that will extract 'overwritten' info
from media. Both have strong points and caveats, and both involve
being able to access the drive other than through the 'user' interface.
Neither are 100% or secure, and neither can work through multiple
wipes. Or at least none that I know of can. But then...

It is NOT a myth.

The myth is telling people that it cannot be done.

Granted, it's beyond the abilities of almost any hacker I've heard of, but
it's NOT beyond the capabilities of manufacturers or certain organizations.

Risk to the consumer? Almost zilch.

But please don't come out with your blatant statement that it's a myth or
that it can't be done. You are just plain wrong, and either ignorant of
the technologies involved (I'll grant you that much) or are spouting a
'company line'. Which is it?

It is you who is ignorant of the facts! Please substantiate your claims!

The notion that data can be recovered on wiped drives is a myth, plain
and simple. Data cannot be recovered on a zero filled drive, even if it
was only written once! This is not a blatant statement, it's the truth.
If you think it can be done please supply reference material, sources
and names of companies who can do this.

You can use Magnetic Force Microscopy (MFM) or Scanning Tunneling
Microscopy (STM) and examine hard drive platters all that you want and
you will not be able to recover any data whatsoever on a wiped hard
drive, it can't be done, period!

John

And by the way, I do not work for any company that is in anyway involved
in the sale or development of anything to do with computer technology or
software.