Is one pass enough?

[her209]

I'm going to be selling some old hard drives on Craigslist. I already have a buyer lined up, I just need to copy and perform a low level format. Do you guys think one pass is good enough? I'm using the Western Digital Corp software named WinDLG to do the low level format by writing 0's to the entire disk. There's no option for writing 1's.

What do you guys think?

 

[Gillbot]

I just use dban and let it use whatever recommended settings.

 

[MarkLuvsCS]

I just use dban and let it use whatever recommended settings.

another vote for dban i think their "fast" run is 3 passes. dban will allow you to just start the process then you don't have to worry about it. I would suggest just starting it one night and the next morning you will have a freshly formatted drive.

 

[Red Squirrel]

Depends how critical private your data was (random word docs, vs personal info). 1 pass is good enough for a typical data recovery program to not be able to find, but if you are concerned about someone using special techniques then just do like 25ish passes. This could take a few days so use a machine that you wont need to use for a while. I usually just do it on my server. Plug the drive in and run the shred command from the OS.

 

[jjmIII]

Depends how critical private your data was ...

LOL, sounds like me. There isn't anything that is earth shaking on my hdds.
I delete the partition, reformat, and ship!

 

[Gillbot]

LOL, sounds like me. There isn't anything that is earth shaking on my hdds.
I delete the partition, reformat, and ship!

I usually do the same, if they want to take the time to dig up all my old Pr0n files, have at it!

 

[tcsenter]

One pass zero write is enough, unless you think a government entity might be interested in spending thousands of dollars to find out what's on your hard drive.

 

[Russwinters]

There is nothing in "known" existence that can reliably recover data from a hard drive that has been written with even one pass of any pattern.

Signal trace, developed by Action-front (now I365) was the closest technology, but it doesn't even work, it's a novelty, works on drives made in early 90s, and thats about it. It cannot work on the highly advanced, high BPI drives in use today.


The Government acquired the rights to use signal trace at some point, so who knows they may have some secret project they spent millions/billions on to make a device using alien technology that could do it, but i doubt it.


There is a scientific theory to why you MAY be able to get some data after a single pass, or even a multi pass wipe, and while actually being true, real world application is not likely.

 

[her209]

I just use dban and let it use whatever recommended settings.

From dban's website:

Darik's Boot and Nuke ("DBAN") is a self-contained boot disk that securely wipes the hard disks of most computers. DBAN will automatically and completely delete the contents of any hard disk that it can detect, which makes it an appropriate utility for bulk or emergency data destruction.

 

[Gillbot]

I pull my main OS drive always to be safe.

 

[Emulex]

sdelete.exe

 

[hanspeter]

Russwinters is right. Everybody doing research in this field all say the same thing: they cannot recover data from just a single overwrite.

 

[Dubb]

any tools simailar to DBAN That I can run from windows? I have a bunch of drives to sell and would like to just stick them all in my ESATA enclosure and avoid having to take my computer out of commission to wipe them.

eraser looks good, but it looks like it doesn't have a drive wipe setting, just a "erase free space" option. I suppose I could format drives from windows and then do that.

http://eraser.heidi.ie/index.php

 

[razel]

You're doing everything correctly! Using the drive manufacturer's software to wipe the drive is exactly what'd I do. While you're running WinWLG do the SMART tests too to 100% certify that the drive is good.

As other's have mentioned one pass write is plenty. There is a recent article about that here: http://www.extremetech.com/article2/0,2845,2361328,00.asp

'A single properly executed overwrite is sufficient to wipe out data beyond any reasonable expectation of recovery. The equipment to analyze a drive and recover overwritten data would cost millions, and, as a DriveSavers technician put it, might recover nothing but the letter "a."'

Hopefully that letter 'a' is that missing piece in the p0rn file that won't play.

 

[taltamir]

some theorize it might be possible to retrieve data from a drive that had "only" one pass... but in reality it has never been done. So yes, one pass is more then enough.

 

[blackangst1]

Russwinters is right. Everybody doing research in this field all say the same thing: they cannot recover data from just a single overwrite.

This. I posted a white paper last year (unfortunately its been taken down, but if you search for my posts in the security section I posted pieces of the paper in my post) about this very thing, and the long and short of it is...with one pass of either one's or zeros, data was unrecoverable with an electron microscope. What does that mean in laymen's terms? One pass of zeros and not even the NSA can recover it.

It needs to be mentioned this is only true of drives made in the last 10 years or so when platter structure changed. When Gutmann created the famed 35 pass erase, hard drives were not as dense as they are now. Those days are long gone. More than one pass might make you feel better, but all youre doing is shortening the life of the drive.

 

[Dubb]

so does formatting from windows qualify as one pass of zeros or is that only possible from a boot disk?

 

[blackangst1]

so does formatting from windows qualify as one pass of zeros or is that only possible from a boot disk?

Vista and 7 both write zeros on a normal (full) format. A quick format simply erases the MFT file (thus "telling" the OS those parts of the drive are free, without actually writing to them).

edit: also a quick format doesnt check for bad sectors, and a full format does.

 

[razel]

Vista and 7 both write zeros on a normal (full) format.

edit: also a quick format doesnt check for bad sectors, and a full format does.

Whoa... Vista/7 writing zero's on full format? Really? First I heard of this. Seriously. Is this the same format program you can get to by right clicking the drive letter, then 'format'.

I just saw the format command and there is a /P option. Is that option automatically invoked when 'quick format' is unchecked?

Previously, the only way I was able to get windows to write zeros is through the 'clean all' command in diskpart.

 

[blackangst1]

Ive read the same about 7, but quickly all I could find is the MS KB article for Vista...the same scheme is in place for 7:

http://support.microsoft.com/kb/941961/en-us

The format command behavior has changed in Windows Vista. By default in Windows Vista, the format command writes zeros to the whole disk when a full format is performed. In Windows XP and in earlier versions of the Windows operating system, the format command does not write zeros to the whole disk when a full format is performed.