On 2 Feb 2006, at 11:28, Alexander Skwar wrote:
This is not what normally (or at least, _always_) happens when you
format a hard-drive.
Well, depends on the definition of "format". If you
define format as "overwrite partition table", than
you're right. But that's hardly what I'd call "format".
I was referring to the definition of "format" generally used by the
authors & suppliers of formatting utilities. If you format a disk in
Windows, or certainly if you "quick format" it, it doesn't run a
quick call to `dd if=/dev/zero of=/de/hdX`; it merely overwrites the
partition table so the data IS often recoverable after a format.
If you were merely formatting a disk for your own use, had no
expectation that it would fall into anyone else's hands, and were in
a hurry to use the disk with its new filesystem on it, you would
surely be wasting time were you to insist on blanking every single
bit on the device - it's simply not necessary.
I am not qualified to comment on recovery of data from a disk that
has been wiped with zeros in the way you describe, nor from one which
has been shredded properly with repeated iterations of random & non-
random bits, but there certainly does seem to be a lot of hearsay on
the subject. I would consider the a disk that's been comprehensively
overwritten once to be unrecoverable from the practical perspective
of the original discussion (a mate in the pub) but do consider a disk
that's been over-written with shred to be unrecoverable as far as my
customers' commercial data is concerned.
Whilst writing this I looked up `info shred` which claims:
If you have sensitive data, you may want to be sure that recovery
is not possible by actually overwriting the file with non-sensitive
data. However, even after doing that, it is possible to take the
disk back to a laboratory and use a lot of sensitive (and expensive)
equipment to look for the faint "echoes" of the original data
underneath the overwritten data. If the data has only been
overwritten
once, it's not even that hard.
The best way to remove something irretrievably is to destroy the
media it's on with acid, melt it down, or the like.
The info page references Peter Gutmann's paper `Secure Deletion of
Data from Magnetic and Solid-State Memory'. I'm not qualified to
assess this paper fully, and hard-drives have progressed considerably
in the last decade, but my naive reading of the conclusion seems to
support the suggestion that a single write may not be sufficient to
thwart a determined attacker:
Data overwritten once or twice may be recovered by subtracting what
is expected to be read from a storage location from what is actually
read... it is effectively impossible to sanitise storage locations
by simple overwriting them, no matter how many overwrite passes are
made or what data patterns are written. However by using the
relatively simple methods presented in this paper the task of an
attacker can be made significantly more difficult, if not
prohibitively
expensive.
http://www.cs.auckland.ac.nz/~pgut001/pubs/secure_del.html which
concludes:
I state once again that I'm not really qualified to comment on the
subject to this depth, so I offer these references merely for your
perusal. I would be grateful if you refrained in any future responses
from the sneering manner you have employed in those to date.
Stroller.
--
gentoo-user@gentoo.org mailing list
