Is it possible to recover data on a zeroed hard drive?

Question

Let's assume that I have a modern magnetic (not SSD) hard drive, manufactured within the past ten years, and the hard drive is packed with the only copies of an unpublished paper about cheap cold fusion written by a scientist who died in the fire that burned down the only cold fusion lab in the world.

dd if=/dev/zero of=/dev/sdx

Whoops.

I've heard people say that if you want to be sure that the data is completely erased, you need to:

1. Use random data, not zeroes.

2. Zero the hard drive with multiple passes, either 7 ("standard" practice) or 35 (for the truly paranoid).

3. Erase using passes that have special alternating patters. Supposedly, this either degausses the original signal or adds enough extra noise that you can't pick it out.

4. Perform some kind of "low level" erase that causes the heads to move in different patterns, or causes the bit patterns to differ. This requires hardware support.

5. Raise the platters above their Curie temperature

My question is: is it actually possible to recover data from a zeroed drive? In other words, is it justifiable to use random data / multiple passes / etc. to bury your digital secrets?

I understand that "The Great Zero Challenge" (40 USD prize) has not been won, but hypothetically, if cost of such recovery is large or secret enough, then it's a moot point.

Answer 1

TL;DR: It seems that data densities on HDs have increased to the point where it's not feasible to recover data from zeroed drives.

The process of recovering data from a "zeroed" hard drive revolves around the concept of residual magnetism. Essentially, the idea is that if you examine the drive using a magnetic force microscope, there is some tiny difference between bits that were '1' before being overwritten, and bits that were '0'. ArchLinux's wiki has some interesting background info for those interested. Having said this, this process requires a clean-room disassembly of the drive, and expensive equipment to even attempt.

The situation is actually even worse, consider the NIST Guidelines for Media Sanitization [PDF], which states (emphasis mine):

Advancing technology has created a situation that has altered previously held best practices regarding magnetic disk type storage media. Basically the change in track density and the related changes in the storage medium have created a situation where the acts of clearing and purging the media have converged. That is, for ATA disk drives manufactured after 2001 (over 15 GB) clearing by overwriting the media once is adequate to protect the media from both keyboard and laboratory attack.

EDIT: Another study supporting the above is Overwriting Hard Drive Data: The Great Wiping Controversy (sadly behind a paywall), which concludes (emphasis mine):

This study has demonstrated that correctly wiped data cannot reasonably be retrieved even if it is of a small size or found only over small parts of the hard drive. Not even with the use of a MFM or other known methods. The belief that a tool can be developed to retrieve gigabytes or terabytes of information from a wiped drive is in error. Although there is a good chance of recovery for any individual bit from a drive, the chances of recovery of any amount of data from a drive using an electron microscope are negligible.

EDIT 2: It's actually not clear whether the above summary was referring to a "pristrine drive and 1 wipe", or a "pristine drive and 3 wipes". I'd lean towards "it doesn't matter", since they give the chance of recovering a single 32-bit number at around 1.16%, even with a single pass. The authors also assert that no meaningful amount of data can be recovered with confidence levels with are "beyond reasonable doubt", normally a legal requirement in the U.S.

To summarise, it seems that a single pass is sufficient to sanitise the drive to a point where it cannot be recovered with today's technology.