If this is your first visit, be sure to check out the FAQ by clicking the link above. You may have to register before you can post: click the register link above to proceed. To start viewing messages, select the forum that you want to visit from the selection below. |
|
|
Thread Tools | Display Modes |
#51
|
|||
|
|||
destorying the hard drive
On Fri, 21 Mar 2008 11:46:57 -0600, "philo" put
finger to keyboard and composed: No one has *EVERY* given evidence of retrieving data from a properly zero-wiped drive. Here is the definitive answer: http://searchwincomputing.techtarget...246592,00.html I see that the author cites a paper by Peter Gutmann: http://www.cs.cornell.edu/people/cla...e_deletion.pdf Gutmann states that ... ================================================== =================== Most drives are capable of microstepping the heads for internal diagnostic and error recovery purposes (typical error recovery strategies consist of rereading tracks with slightly changed data threshold and window offsets and varying the head positioning by a few percent to either side of the track), but writing to the media while the head is off-track in order to erase the remnant signal carries too much risk of making neighbouring tracks unreadable to be useful (for this reason the microstepping capability is made very difficult to access by external means). ================================================== =================== In the 80s I used to service CDC SMD hard drives which supported track offsets and early/late data strobes for improving the reliability of data retrieval. These features were part of the documented command set. I still don't see how, by using a simple software approach, one could extract the remnant magnetisation at the track edges from the much more dominant primary data. - Franc Zabkar -- Please remove one 'i' from my address when replying by email. |
#52
|
|||
|
|||
destorying the hard drive
On Fri, 21 Mar 2008 02:38:55 -0300, John John
put finger to keyboard and composed: Lee wrote: Best advice yet is correct, but your advice on zero filled data is totally incorrect. No, his advice is totally correct! I challenge you, or anyone reading these groups, to offer concrete proof that they can recover zero written/wiped files or to give us the names of data recovery firms who can do it. It cannot be done, it has never been done, no one has ever been able to do it and no one has ever been able to offer a shred of evidence that they have successfully recovered files on securely wiped disks. John The following article was written by a company that is selling data wiping software, so actual data recovery may be less plausible than they make out, if not impossible: http://web.archive.org/web/200703070...com/art15.html The article states that "horizontal head alignment and vertical head placement is just a bit different every time data is written and rewritten to the same track". This results in horizontal and vertical magnetic "shadow data" which can be recovered by sensitive equipment. Curiously the article claims that "if you have an interest in researching and experimenting with shadow data, basic tools are available for free download over the Internet". However the authors qualify this statement by adding that "software solutions provide limited success because they rely upon the same mechanical flaws discussed above". I don't understand how software could do what the authors claim, although I expect that one could use undocumented commands (if they exist) to add track offsets and/or early/late data strobes to any read or seek command. But AFAICS this would only be useful in retrieving marginal primary data, not remnant data. - Franc Zabkar -- Please remove one 'i' from my address when replying by email. |
#53
|
|||
|
|||
destorying the hard drive
Format. There was no such thing as a format with adjectives. No "low
level", no "full", no "quick". Just plain format... "during which time the drive geometry - cylinders, tracks - is laid out, tracks are numbered, the entire drive is written with a byte pattern and verified." Except there were no cylinders on 5 1/4 floppies.. dadiOH ______________ Gary S. Terhune wrote: What did? "dadiOH" wrote in message ... Use to be just plain "format" (sans adjectives) dadiOH _____________ Gary S. Terhune wrote: What you describe is a "low-level" format, not a "full" format. "dadiOH" wrote in message ... Bill in Co. wrote: Even as I said, if you do a Full format, I think you'll be hard pressed to recover much, despite what Gary said. But I think Gary was thinking of the Quick Format (and I don't consider that a real format). There is no longer such a thing as a true "full format" of a hard drive except the one done by the manufacturer originally. Certainly, not one by Windows...a full format of even a smallish hard drive would take many hours during which time the drive geometry - cylinders, tracks - is laid out, tracks are numbered, the entire drive is written with a byte pattern and verified. If the OP wants to destroy everything on the drive - including all intersector bytes - passing a magnet over it should do it. ...a help file of info about MP3s, recording from LP/cassette and tips & tricks on this and that. Get it at http://mysite.verizon.net/xico |
#54
|
|||
|
|||
destorying the hard drive
Franc Zabkar wrote:
I suspect that the difference in the treatment of FDs and HDs may be due to the fact that diskettes can be magnetically blank, ie they may have no prerecorded sector IDs, in which case they need to be low level formatted. HDs, OTOH, are already low level formatted at the factory. - Franc Zabkar Bingo. -- dadiOH ____________________________ dadiOH's dandies v3.06... ....a help file of info about MP3s, recording from LP/cassette and tips & tricks on this and that. Get it at http://mysite.verizon.net/xico |
#55
|
|||
|
|||
destorying the hard drive
On Fri, 21 Mar 2008 13:41:24 +1100, Franc Zabkar
put finger to keyboard and composed: Typing "help format" at the DOS prompt documents the function of several switches, including /U, which is supposed to "destroy all existing data": I now recall doing some pertinent testing (on an NTFS volume from a Win98SE box) in this group over a year ago. Here is what I found at that time: http://groups.google.com/group/micro...b?dmode=source "I was able to confirm that an Fdisk does write F6 data patterns to those sectors identified in a previous post, but I was surprised to find that neither Format /u nor Format /c (in real DOS mode) appeared to write anything at all to the disc ... A Windows full format appears to write the boot block, initialise the FATs with zeroes, and create a new root directory containing a volume name and the Recycled folder. It appears that nothing else is written to the disc - all the original NTFS data are still there." Sorry for my original disinformation. - Franc Zabkar -- Please remove one 'i' from my address when replying by email. |
#56
|
|||
|
|||
destorying the hard drive
Ancient days, well before the technology that is the topic here.
-- Gary S. Terhune MS-MVP Shell/User www.grystmill.com \ "dadiOH" wrote in message ... Format. There was no such thing as a format with adjectives. No "low level", no "full", no "quick". Just plain format... "during which time the drive geometry - cylinders, tracks - is laid out, tracks are numbered, the entire drive is written with a byte pattern and verified." Except there were no cylinders on 5 1/4 floppies.. dadiOH ______________ Gary S. Terhune wrote: What did? "dadiOH" wrote in message ... Use to be just plain "format" (sans adjectives) dadiOH _____________ Gary S. Terhune wrote: What you describe is a "low-level" format, not a "full" format. "dadiOH" wrote in message ... Bill in Co. wrote: Even as I said, if you do a Full format, I think you'll be hard pressed to recover much, despite what Gary said. But I think Gary was thinking of the Quick Format (and I don't consider that a real format). There is no longer such a thing as a true "full format" of a hard drive except the one done by the manufacturer originally. Certainly, not one by Windows...a full format of even a smallish hard drive would take many hours during which time the drive geometry - cylinders, tracks - is laid out, tracks are numbered, the entire drive is written with a byte pattern and verified. If the OP wants to destroy everything on the drive - including all intersector bytes - passing a magnet over it should do it. ...a help file of info about MP3s, recording from LP/cassette and tips & tricks on this and that. Get it at http://mysite.verizon.net/xico |
#57
|
|||
|
|||
destorying the hard drive
I don't know that floppies are treated the same but I think so.
-- Gary S. Terhune MS-MVP Shell/User www.grystmill.com "Bill in Co." wrote in message ... OK, but I apparently stand corrected in assuming that it was as "thorough" on a hard disk as it was on a floppy - overwriting everything on the disk (or at least I'm pretty sure that assumption is still true for a floppy using full format). Hmmm. Perhaps I should have known better in at least one way, because I once tried one of those disk overwriting programs and it seemed it took forever. Gary S. Terhune wrote: FORMAT C: takes a while because the default action is a Thorough scan by Scandisk after formatting. To avoid this, use the /q (quick) switch. -- Gary S. Terhune MS-MVP Shell/User www.grystmill.com "Bill in Co." wrote in message ... That's it, for a hard drive??? OK, then I stand corrected. Must be only for floppies that it can do the whole shebang. I had thought, though, in the past, when I did a format c:/s, for preping a hard drive for Win9x, it was overwriting all the hard disk, as it took awhile (at least as I recall). Guess not. Gary S. Terhune wrote: You're wrong. Full format has no effect on the data. Full format is Quick format followed by a cluster integrity check, no more. -- Gary S. Terhune MS-MVP Shell/User www.grystmill.com "Bill in Co." wrote in message ... Even as I said, if you do a Full format, I think you'll be hard pressed to recover much, despite what Gary said. But I think Gary was thinking of the Quick Format (and I don't consider that a real format). John John wrote: Lee wrote: Best advice yet is correct, but your advice on zero filled data is totally incorrect. No, his advice is totally correct! I challenge you, or anyone reading these groups, to offer concrete proof that they can recover zero written/wiped files or to give us the names of data recovery firms who can do it. It cannot be done, it has never been done, no one has ever been able to do it and no one has ever been able to offer a shred of evidence that they have successfully recovered files on securely wiped disks. John |
#58
|
|||
|
|||
destorying the hard drive
Sounds about right. I realize, too, that I've been restricting my
considerations to HDs, not floppies. -- Gary S. Terhune MS-MVP Shell/User www.grystmill.com "Franc Zabkar" wrote in message ... On Fri, 21 Mar 2008 05:32:07 -0700, "Gary S. Terhune" none put finger to keyboard and composed: You're wrong. Full format has no effect on the data. Full format is Quick format followed by a cluster integrity check, no more. I think you're right. Maybe the confusion, at least in my case, is due to the different way the Format command appears to treat floppy diskettes as opposed to hard drives. Anyway, after "full" formatting a 320GB USB HD from within Explorer, I used a disc editor to view the HD and found that all the data appeared to be intact. I suspect that a "format /u" from within DOS would produce the same result but I don't have a spare HD to reliably test this (my USB HD stalls at 0%). OTOH, a full format of a floppy diskette writes F6 bytes to every sector in the data area. The same thing happens when I type ... format a: /u ... at a DOS prompt. A "quick" GUI format or a plain DOS format both leave the diskette's data area intact. Here are two of the FD images: http://www.users.on.net/~fzabkar/frmt_img.zip (4.2KB) I suspect that the difference in the treatment of FDs and HDs may be due to the fact that diskettes can be magnetically blank, ie they may have no prerecorded sector IDs, in which case they need to be low level formatted. HDs, OTOH, are already low level formatted at the factory. - Franc Zabkar -- Please remove one 'i' from my address when replying by email. |
#59
|
|||
|
|||
destorying the hard drive
Franc Zabkar wrote:
On Fri, 21 Mar 2008 02:38:55 -0300, John John put finger to keyboard and composed: Lee wrote: Best advice yet is correct, but your advice on zero filled data is totally incorrect. No, his advice is totally correct! I challenge you, or anyone reading these groups, to offer concrete proof that they can recover zero written/wiped files or to give us the names of data recovery firms who can do it. It cannot be done, it has never been done, no one has ever been able to do it and no one has ever been able to offer a shred of evidence that they have successfully recovered files on securely wiped disks. John The following article was written by a company that is selling data wiping software, so actual data recovery may be less plausible than they make out, if not impossible: http://web.archive.org/web/200703070...com/art15.html The article states that "horizontal head alignment and vertical head placement is just a bit different every time data is written and rewritten to the same track". This results in horizontal and vertical magnetic "shadow data" which can be recovered by sensitive equipment. Curiously the article claims that "if you have an interest in researching and experimenting with shadow data, basic tools are available for free download over the Internet". However the authors qualify this statement by adding that "software solutions provide limited success because they rely upon the same mechanical flaws discussed above". I don't understand how software could do what the authors claim, although I expect that one could use undocumented commands (if they exist) to add track offsets and/or early/late data strobes to any read or seek command. But AFAICS this would only be useful in retrieving marginal primary data, not remnant data. The perpetuation of the myth that data can be recovered on wiped drive is a self serving exercise that sellers of drive wiping software have long engaged in. No one has ever been able to recover files on securely wiped drives. The notion that this *might* be possible was only advanced by Peter Gutmann as background material for his paper on Secure Deletion of Data on drives. Furthermore, Dr. Gutmann's research was done on an old class of drives that is practically out of use today, the techniques described in his paper are hardly applicable to modern hard drives, which is a moot point anyway because they didn't even work on the old class of hard drives! John |
#60
|
|||
|
|||
destorying the hard drive
Mike Y wrote:
"John John" wrote in message ... Mike Y wrote: "John John" wrote in message ... Lee wrote: Best advice yet is correct, but your advice on zero filled data is totally incorrect. No, his advice is totally correct! I challenge you, or anyone reading these groups, to offer concrete proof that they can recover zero written/wiped files or to give us the names of data recovery firms who can do it. It cannot be done, it has never been done, no one has ever been able to do it and no one has ever been able to offer a shred of evidence that they have successfully recovered files on securely wiped disks. John Special hardware can could overwritten data. Either with an analog analysis or looking for bit shifts. Don't get confused in thinking that digital is digital, it's still an analog media... That is not true, there is no such magical machine available at any cost that can recover data on securely wiped (zero filed) drives. No one can recover data on properly wiped drives, the notion that it can be done is nothing more than a myth. John Well, when you say securely wiped, by that meaning multiple wipes, I agree. (The most secure is to wipe multiple times with multiple and DIFFERENT data) Also, if you imply that there exists no machine that interfaces to the IDE, then I also agree. At least, I've not heard of any. And I don't know of any manufacturer that has backdoor hooks to allow the capabilities needed to be implemented. (I'm not sure, but reasonably confident that most, if not all, drives out there don't have the capability, even if a hacker had ability to reprogram the firmware to do his bidding.) However, there are TWO methods that will extract 'overwritten' info from media. Both have strong points and caveats, and both involve being able to access the drive other than through the 'user' interface. Neither are 100% or secure, and neither can work through multiple wipes. Or at least none that I know of can. But then... It is NOT a myth. The myth is telling people that it cannot be done. Granted, it's beyond the abilities of almost any hacker I've heard of, but it's NOT beyond the capabilities of manufacturers or certain organizations. Risk to the consumer? Almost zilch. But please don't come out with your blatant statement that it's a myth or that it can't be done. You are just plain wrong, and either ignorant of the technologies involved (I'll grant you that much) or are spouting a 'company line'. Which is it? It is you who is ignorant of the facts! Please substantiate your claims! The notion that data can be recovered on wiped drives is a myth, plain and simple. Data cannot be recovered on a zero filled drive, even if it was only written once! This is not a blatant statement, it's the truth. If you think it can be done please supply reference material, sources and names of companies who can do this. You can use Magnetic Force Microscopy (MFM) or Scanning Tunneling Microscopy (STM) and examine hard drive platters all that you want and you will not be able to recover any data whatsoever on a wiped hard drive, it can't be done, period! John And by the way, I do not work for any company that is in anyway involved in the sale or development of anything to do with computer technology or software. |
Thread Tools | |
Display Modes | |
|
|
Similar Threads | ||||
Thread | Thread Starter | Forum | Replies | Last Post |
Assigning a Drive letter to External USB connected Hard Drive | Frog | General | 85 | October 16th 07 07:32 PM |
Bootable hard drive and two hard drives and two OSs? | DJW | Setup & Installation | 5 | November 21st 06 01:43 AM |
reformating hard drive without floppy drive | mkskyflyer | Disk Drives | 6 | April 4th 05 12:07 AM |
Reinstallation on new SATA hard drive after old IDE66 hard drive c | rdy423 | General | 1 | December 6th 04 04:45 PM |
Windows Accesses Floppy Drive When Deleting Files From Hard Drive | Bryan | General | 0 | August 7th 04 11:54 PM |