Datawiping a Hard Drive question.

[Kippa]

I am thining of doing a fresh OS install. Before doing that I am contemplating doing a 7pass data wipe on an 2TB internal SATA II hard drive. I reckon doing it will take somewhere in the region of 30hours+. Would hammering the hard drive constantly for that length of time realistically damage it? Or will it be fine more than likely be fine? The hard drive in quesiton is a Western Digital 2TB 2TB Western Digital WD2003FYYS RE4 Enterprise.

 

[Charles Kozierok]

Probably not necessary, but isn't going to damage it as long as it is properly installed and cooled.

 

[Elixer]

Why in the world would you want to do a 7 pass wipe ?
I see no advantage at all at doing that, unless your selling the drive ?

 

[hhhd1]

1 pass is more than enough.

 

[Kippa]

I am thinking of selling it and getting a 512gb ssd. Doing the extra passes just to make sure.

 

[Revolution 11]

Realistically, you could just get TrueCrypt, encrypt your whole drive after reformatting and installing some dinky small OS, and lose the key. If you are really paranoid, use all 3 of TrueCrypt's encryption ciphers (AES, Serpent, and some other) and then lose the key. The data is good as gone. Format it again and if any data does remain, it will be encrypted.

If you are going to stick with data wiping, only wipe sensitive data with this method.

 

[Kippa]

Thanks for the advice. What I will do is do a 1 pass with the new os install. If and when I do sell it, then I will do a multipass then possibly a 3 pass just to make sure.

 

[corkyg]

Unless you are engaged in something shady or ilicit, it is overkill.

 

[Evadman]

To the best of my knowledge, no one has ever been able to recover even a single pass of zeros to a drive. Isn't there an outstanding prize from a group for that?

 

[Kippa]

I'm not doing anything shady. I always do a 1pass datawipe before I do an os install. As for multipass that is extra precausion if I want to sell the hard drive just to make sure.

 

[Elixer]

I'm not doing anything shady. I always do a 1pass datawipe before I do an os install. As for multipass that is extra precausion if I want to sell the hard drive just to make sure.

Hmm, just how many people do you think have dedicated hard drive diagnostics gear capable of retrieving data from a formatted HD ? Then out of those, how many have the gear capable to retrieve data from a HD that has been written with multiple passes ? :ninja:

It is more than enough just to do a full format (not quick format) on non shady material.

But I guess you like using dban

 

[Carson Dyle]

Hmm, just how many people do you think have dedicated hard drive diagnostics gear capable of retrieving data from a formatted HD ? Then out of those, how many have the gear capable to retrieve data from a HD that has been written with multiple passes?

And the most important question of all to ask: How many people really a give a hoot about YOUR data? Are you a CIA agent, or the ambassador to Germany?

 

[BrightCandle]

To the best of my knowledge, no one has ever been able to recover even a single pass of zeros to a drive. Isn't there an outstanding prize from a group for that?

Yes there was a prize available for any data recovery company able to recover a single 1KB file from an otherwise empty 80GB hard drive (very common model) for about 10 years. Not a single company was willing to take up the prize on offer because they couldn't do it.

The guy running contacted pretty much every data recovery company asking if they could recover that file from the drive having done a 1 pass of 0's written to the disk and they couldn't do it.

Its a myth that you need to more than 1 pass over a drive. In theory you can get at the data with appropriate technology, in practice no one has developed the capability and certainly any subsequent users of a second hand drive will not be able to recover the data after a single pass of 0's. You don't need to do anything interesting, a basic dd pass over the disk will do the job every bit as well as fancy software.

 

[blastingcap]

If it doesn't hurt why not do it? Before I sell hard drives I usually use Eraser and give it 2-3 passes with any of the military listed methods like DoD (2 for huge drives, 3 for smaller drives). I feel safer knowing there is no chance that my bank records or something like that, are still on the drive.

If you are not selling the drive, though, and are planning to install an OS on it right away, then why bother wiping the drive at all?

 

[hhhd1]

Hmm, just how many people do you think have dedicated hard drive diagnostics gear capable of retrieving data from a formatted HD ? Then out of those, how many have the gear capable to retrieve data from a HD that has been written with multiple passes ? :ninja:

It is more than enough just to do a full format (not quick format) on non shady material.

But I guess you like using dban

Full format does not wipe the drive, you need to overwrite the data to erase them.

 

[kleinkinstein]

DBAN using DOD-5220.22-M, one pass and toss it on ebay.

 

[KingFatty]

Is there any particular reason to wipe a drive before a fresh install? I don't understand why you'd do that, as a waste of time/effort/electricity?

 

[AnitaPeterson]

Overkill.

But if you're so inclined, CrapCleaner has some excellent drive wiping tools which conform to the most stringent DOD security specifications.

 

[Revolution 11]

Its a myth that you need to more than 1 pass over a drive. In theory you can get at the data with appropriate technology, in practice no one has developed the capability and certainly any subsequent users of a second hand drive will not be able to recover the data after a single pass of 0's. You don't need to do anything interesting, a basic dd pass over the disk will do the job every bit as well as fancy software.

If this is the case, why does the DoD require at least 3 passes? Why do some of the security researchers out there have their own custom wipe protocols which can easily go to 10 passes? Are they all just crazy?

 

[hhhd1]

Is there any particular reason to wipe a drive before a fresh install? I don't understand why you'd do that, as a waste of time/effort/electricity?

It could be useful to overheat the drive, to test if there is adequate cooling.

 

[jimmybgood9]

If this is the case, why does the DoD require at least 3 passes? Why do some of the security researchers out there have their own custom wipe protocols which can easily go to 10 passes? Are they all just crazy?

Because it is possible to recover data after writing over it with zeros or a random collection of zeros and ones. This is for the same reason that hard drives can recover data from failing sectors by passing over it repeatedly. On a spinning disk, with heads vibrating and being buffeted by air turbulence generated by the spinning platters, the magnetization is not applied uniformly to the data segment.

It is not, however practical or feasible in any sense. Hey, we designed and built A-bombs and H-bombs and put men on the moon, surely we can recover a little data from disks. I bet the NSA has done it, but it must have been a massive project and now they know how to do it.

But, if the NSA wanted something from you, they wouldn't bother trying to recover data from your wiped drive, they'd put you in isolation and blast you with music you hated while you were naked and freezing under the spotlights. On the other hand, if wiping your drive repeatedly hurts it, then it is either going bad anyway, or it is improperly mounted or cooled.

I just recently bought a HDD that was going bad and I think the seller knew it. First thing I noticed was that the drive seek error rate was marginal. So I performed a 30 second seek test on it and the scaled value dropped a notch. Then I tried to install Windows and before it was done, I got the message that the drive would fail within 24 hours. I wish that seller had wiped it seven times.

 

[Auric]

If this is the case, why does the DoD require at least 3 passes? Why do some of the security researchers out there have their own custom wipe protocols which can easily go to 10 passes? Are they all just crazy?

Governments do horrible horrible things and thus endevour to keep secrets until at least those responsible can no longer be held to account (i.e. dead), hence sealing files for fifty years. So by the same token, it must be supposed that a single pass may be recoverable in the future. However, beyond that wipe standard, actual practice is presumably to incinerate or melt them.

 

[BrightCandle]

If this is the case, why does the DoD require at least 3 passes? Why do some of the security researchers out there have their own custom wipe protocols which can easily go to 10 passes? Are they all just crazy?

They also require that the secret network cables never come within 3 metres of the restricted network so that any interference from one can't be picked up on the other. Theoretically someone on the restricted network could reconstruct data from the interference pattern, but in practice the noise is so high you actually can't read any amount of useful data that way.

The DOD has standards like these because the amount of effort a spy will apply to get national secrets is high. Said spy also would have significant resources behind it such that if he could get hold of old hard drives that had been single pass wiped then given the theoretical underpinnings any small amount of recovered data but be worth the considerable cost.

But you and I are not the DOD, we don't have one of the only few agencies in the world using spies to capture our data and use significant measures to get at it. No police force around the world could recover from a single zero wipe let alone a random source wipe so you are really in no danger whatsoever given a single wipe.

In practice the DOD doesn't do a multipass wipe of a HDD, they melt it like most other national defence firms around the world, because well there is nothing quite like destroying it for ensuring that there is never any possibility that it could be read.

 

[Mark R]

If this is the case, why does the DoD require at least 3 passes? Why do some of the security researchers out there have their own custom wipe protocols which can easily go to 10 passes? Are they all just crazy?

It's because the protocols are out of date.

In the 70s, the drive heads were moved by stepper motors and drive belts. Over time, the heads would go out of alignment, so that writing over a track, might actually only overwrite half of the track, because the alignment was off.

A skilled engineer, could realign the drive heads, and use modified firmware to try and recover un-overwritten data.

Using multiple passes, would gradually weaken the magnetic remnants to the side of the track where the head was actually tracking.

In reality, it's not clear whether this technique would ever have worked, or was ever used - even if it was a theoretical possibility.

By the time IDE drives were invented, hard drives had gone from stepper-motor control to servo control. This ensured that the heads always tracked precisely regardless of temperature, aging, impact/shock, etc. and that overwriting data, would always overwrite it completely with no hope of recovery.

--

Things are more complicated these days, and simply running a piece of free software like "eraser" or DBAN can't guarantee that your drives are wiped. For example, when drives self-heal "bad" sectors, they actually move the data to a new area, and abandon the old sector. Unfortunately, this means that the data in the old sector, although corrupted, is still on the platter and cannot be removed by most software as the drive has silently remapped the sector to point somewhere else on the platter.

One government that has actually kept up with the times is the UK, and they have a list of specific criteria that disk wiping software must meet, before they can be approved for government use (if a software package has received a government certificate, they can also be used by private citizens and businesses for destruction of confidential data, and the user of the software has a defence in court, if they are accused of negligence in their data destruction protocol).

Such approved software must check the drive for bad sectors before and after wiping, and if bad sectors have been remapped during the wiping operation, the wipe must be aborted and the user informed that the drive is damaged and wiping cannot continue, and that the drive must be physically destroyed.

Additionally, the software needs to perform a search for "secret" partitions on the drive. Normally, these "secret" partitions are used by the BIOS for OEM system recovery, and the BIOS blocks access to them. Approved software must detect and remove any BIOS blocks, and any locks on the HD which are restricting access to these "secret" partitions.

There are many other requirements for approved software which cover all sorts of other corner cases, work around known bugs in various drive firmwares, etc. as well as general quality control, code inspection, etc.

 

[murphyc]

NIST 800-88 2006 says:

Advancing technology has created a situation that has altered previously held best practices regarding magnetic disk type storage media. Basically the change in track density and the related changes in the storage medium have created a situation where the acts of clearing and purging the media have converged. That is, for ATA disk drives manufactured after 2001 (over 15 GB) clearing by overwriting the media once is adequate to protect the media from both keyboard and laboratory attack.

If you just write zeros, the addressable data is gone. There is unaddressable data on hard drives (HPA, DCO and includes bad sectors that have been reallocated and thus don't have a corresponding LBA), and there is a lot of unaddressable data on SSDs. For that you should use ATA Secure Erase or ATA Enhance Secure Erase, although the command works for SSDs and HDDs (PATA and SATA).

ATA Secure Erase is faster than writing zeros.