Take the 2-minute tour ×
Skeptics Stack Exchange is a question and answer site for scientific skepticism. It's 100% free, no registration required.

Let's assume that I have a modern magnetic (not SSD) hard drive, manufactured within the past ten years, and the hard drive is packed with the only copies of an unpublished paper about cheap cold fusion written by a scientist who died in the fire that burned down the only cold fusion lab in the world.

dd if=/dev/zero of=/dev/sdx

Whoops.

I've heard people say that if you want to be sure that the data is completely erased, you need to:

  1. Use random data, not zeroes.

  2. Zero the hard drive with multiple passes, either 7 ("standard" practice) or 35 (for the truly paranoid).

  3. Erase using passes that have special alternating patters. Supposedly, this either degausses the original signal or adds enough extra noise that you can't pick it out.

  4. Perform some kind of "low level" erase that causes the heads to move in different patterns, or causes the bit patterns to differ. This requires hardware support.

  5. Raise the platters above their Curie temperature

My question is: is it actually possible to recover data from a zeroed drive? In other words, is it justifiable to use random data / multiple passes / etc. to bury your digital secrets?

I understand that "The Great Zero Challange" has not been won, but hypothetically, if cost of such recovery is large or secret enough, then it's a moot point.

share|improve this question
    
unless you know chich exact sectors you are writing to it can be the disk controller leaves some blocks unaltered –  ratchet freak Nov 15 '12 at 8:42
    
It is possible to scan for residual magnetization as far as 5-7 writes. It requires sophisticated equipment however and it's not guaranteed to be 100% success. –  vartec Nov 15 '12 at 9:19
    
I'm unclear. The claim you want us to look at is that "To safely erase data, it is necessary to use write random data OR write out zero multiple times OR use special hardware techniques." You think it might be sufficient to do a single pass of zeroing out data. Is that correct? –  Oddthinking Nov 15 '12 at 10:14
    
The old eraser programs actually wrote 0's then over wrote them with 1's and repeated the process several times. After 1 pass it was difficult to recover a file. But sometimes possible. After 2 passes the chances of being able to recover the data were slim and results were unreliable. You could find a few fragments but rarely the entire file. After 3+ passes the fragments were so small as to be worthless in piecing together a file. And this was on a 50mb drive. The bigger the drives got the harder it was to recover data that had been over written. –  Chad Nov 15 '12 at 17:59
add comment

1 Answer

up vote 21 down vote accepted

TL;DR: It seems that data densities on HDs have increased to the point where it's not feasible to recover data from zeroed drives.

The process of recovering data from a "zeroed" hard drive revolves around the concept of residual magnetism. Essentially, the idea is that if you examine the drive using a magnetic force microscope, there is some tiny difference between bits that were '1' before being overwritten, and bits that were '0'. ArchLinux's wiki has some interesting background info for those interested. Having said this, this process requires a clean-room disassembly of the drive, and expensive equipment to even attempt.

The situation is actually even worse, consider the NIST Guidelines for Media Sanitization [PDF], which states (emphasis mine):

Advancing technology has created a situation that has altered previously held best practices regarding magnetic disk type storage media. Basically the change in track density and the related changes in the storage medium have created a situation where the acts of clearing and purging the media have converged. That is, for ATA disk drives manufactured after 2001 (over 15 GB) clearing by overwriting the media once is adequate to protect the media from both keyboard and laboratory attack.

EDIT: Another study supporting the above is Overwriting Hard Drive Data: The Great Wiping Controversy (sadly behind a paywall), which concludes (emphasis mine):

This study has demonstrated that correctly wiped data cannot reasonably be retrieved even if it is of a small size or found only over small parts of the hard drive. Not even with the use of a MFM or other known methods. The belief that a tool can be developed to retrieve gigabytes or terabytes of information from a wiped drive is in error. Although there is a good chance of recovery for any individual bit from a drive, the chances of recovery of any amount of data from a drive using an electron microscope are negligible.

EDIT 2: It's actually not clear whether the above summary was referring to a "pristrine drive and 1 wipe", or a "pristine drive and 3 wipes". I'd lean towards "it doesn't matter", since they give the chance of recovering a single 32-bit number at around 1.16%, even with a single pass. The authors also assert that no meaningful amount of data can be recovered with confidence levels with are "beyond reasonable doubt", normally a legal requirement in the U.S.

To summarise, it seems that a single pass is sufficient to sanitise the drive to a point where it cannot be recovered with today's technology.

share|improve this answer
2  
And “negligible chances” is an understatement. Recovering a single 32-bit word correctly has a 1.6% chance. Consequently, the chances of recovering a 8-character password would be 0.0265% (if you knew where exactly it was!). Recovering a 1kb file (a love letter, say) has a chance of exactly 0 (according to Google calculator). Or, if you want to be exact, 0.0…256%, where “…” corresponds to almost 2000 zeroes. –  Konrad Rudolph Nov 15 '12 at 15:44
    
@KonradRudolph Indeed, and the password would also have to be in plain text for that to work. To be 100% correct though, I think those probabilities represent getting a completely error-free version back; so it's possible that the info could be used to narrow down an attack probabilistically. It's still a ridiculously unlikely scenario, especially if you consider that the numbers I've quoted are for a "pristine" drive, and according to the authors: a “used” drive has only a marginally better chance of any recovery than tossing a coin. –  Daniel B Nov 15 '12 at 16:46
1  
I like this answer, but the Arch Linux wiki seems like an out-of-place citation, since it offers no reasoning to support its claim nor provides references to further reading on the topic. –  Dietrich Epp Nov 15 '12 at 19:04
    
@DietrichEpp good point, it was intended as a background link, but actually didn't add much. I've removed the quote, but left the link for background info. –  Daniel B Nov 16 '12 at 6:17
    
@KonradRudolph I consider 1.16% for a 32 bit word huge, not negligible. That's a 87% chance of recovering a single bit (assuming independence), so even small redundancies in the message can lead to complete recovery. –  CodesInChaos Sep 25 '13 at 13:08
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.