They say when you delete a file, it isn't actually deleted....

Forums › Desktop computing › They say when you delete a file, it isn't actually deleted....

1 | 2 | 3

1543 posts

Uber Geek

ID Verified

Trusted

#617396 30-Apr-2012 12:37

If you have a Mac you can just use Disk Utility, and do a zero all data, or if you're really keen, a 7 times random overwrite format.

Cheers,
Joseph

Batman

Mad Scientist
29763 posts

Uber Geek

Trusted

Lifetime subscriber

#617400 30-Apr-2012 12:45

an analogy is if you have a white paper you draw something wrong and then paste another piece of white paper over it with glue. you recover your white space. but some clever people can carefully get the paper off and all your data on the underneath is still there, sometimes more faded, sometimes in broken pieces, but nevertheless sense can be made out of them

Batman

Mad Scientist
29763 posts

Uber Geek

Trusted

Lifetime subscriber

#617404 30-Apr-2012 12:47

formatting is the best - buy another big (same size) paper and put it over it. everything is still there, no glue has been used.

when you draw on the top paper sometimes your water colours penetrate through and the data below gets harder and harder to decipher but nevertheless still there

hashbrown

463 posts

Ultimate Geek

#617761 1-May-2012 06:57

Data recovery has never been demonstrated against a modern hard-drive after even a one pass overwrite. Unless you wear a tinfoil hat and believe the CIA are after your data, one pass of all 0's will do.

Things people should note.

1. This applies to pretty much everything with a file-system. That includes your phone, USB keys, digital cameras and all the storage cards you use.
2. Data on solid state disks may still persist due to the way they reallocate storage to distribute writes and extend the life of the disk. This could mean a "secure" wipe of a single file may overwrite a completely different section of the drive leaving the original file intact. Of course a full disk wipe would still be successful.

networkn

Networkn
32351 posts

Uber Geek

ID Verified

Trusted

Lifetime subscriber

#617769 1-May-2012 08:05

freitasm: I use Acronis Drive Cleanser. The US DoD algorythm takes about five hours to clean a 500GB drive with four passes.

Has anyone here actually used something like this and then sent the drive to Data Forensics or another recovery centre to see how they fare in recovery?

freitasm

BDFL - Memuneh
79270 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#617789 1-May-2012 09:02

I doubt it. But seeing I have the tool and I wanted all data gone, it's a safer bet than running a format or just hitting the DEL key.

dclegg

2806 posts

Uber Geek

Trusted

#617820 1-May-2012 09:55

hashbrown: Data recovery has never been demonstrated against a modern hard-drive after even a one pass overwrite. Unless you wear a tinfoil hat and believe the CIA are after your data, one pass of all 0's will do.

I'd love to hear the reasoning behind requiring multiple writes too. Surely if you are filling all sectors with 0's that would be sufficient. How could the previous data be reconstructed after that?

Samsung

Shop now on Samsung phones, tablets, TVs and more (affiliate link).

kyhwana2

2566 posts

Uber Geek

#617838 1-May-2012 11:05

hashbrown: 2. Data on solid state disks may still persist due to the way they reallocate storage to distribute writes and extend the life of the disk. ?This could mean a "secure" wipe of a single file may overwrite a completely different section of the drive leaving the original file intact. Of course a full disk wipe would still be?successful.

A proper SATA secure erase will erase all the data. (In the drives with AES built in, it just throws away the old key and generates a new one)

hashbrown

463 posts

Ultimate Geek

#617842 1-May-2012 11:18

dclegg: I'd love to hear the reasoning behind requiring multiple writes too. Surely if you are filling all sectors with 0's that would be sufficient. How could the previous data be reconstructed after that?

The theory is covered here.

http://www.cs.auckland.ac.nz/~pgut001/pubs/secure_del.html

freitasm

BDFL - Memuneh
79270 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#617844 1-May-2012 11:19

Also note that Peter Gutmann's suggested algorythm is one of the many implemented in the Acronis Drive Cleanser. It does take longer than the DoD standard though.

dclegg

2806 posts

Uber Geek

Trusted

#617847 1-May-2012 11:24

hashbrown:

The theory is covered here.

http://www.cs.auckland.ac.nz/~pgut001/pubs/secure_del.html

Thanks. Looks like its an interesting read.

gzt

17122 posts

Uber Geek

Lifetime subscriber

#617863 1-May-2012 11:58

dclegg: I'd love to hear the reasoning behind requiring multiple writes too. Surely if you are filling all sectors with 0's that would be sufficient. How could the previous data be reconstructed after that?

hashbrown: The theory is covered here. http://www.cs.auckland.ac.nz/~pgut001/pubs/secure_del.html

Theory. AFAIK, there has been no public demonstration of data reconstruction after even a single pass 00 erase. Of course, the secure protocol is still best practice. Just sayin'.

kyhwana2

2566 posts

Uber Geek

#618015 1-May-2012 18:40

kyhwana2:
A proper SATA secure erase will erase all the data. (In the drives with AES built in, it just throws away the old key and generates a new one)

Durp, a secure erase on an SSD.

It'll work on a normal spinning disk, too, just it'll take longer

Athlonite

1828 posts

Uber Geek
Inactive user

#618168 2-May-2012 01:31

dclegg:
hashbrown: Data recovery has never been demonstrated against a modern?hard-drive after even a one pass overwrite. ?Unless you wear a tinfoil hat and?believe?the CIA are after your data, one pass of all 0's will do.

I'd love to hear the reasoning behind requiring multiple writes too. Surely if you are filling all sectors with 0's that would be sufficient. How could the previous data be reconstructed after that?

It's been done before where data has been recovered after upto 7 overwrites has occurred so an single zero fill isn't as secure as you think

I recently recovered data from a laptop that had the zero fill done on it by someone not on friendly terms with it's owner

hashbrown

463 posts

Ultimate Geek

#618174 2-May-2012 06:27

Athlonite: It's been done before where data has been recovered after upto 7 overwrites has occurred so an single zero fill isn't as secure as you think

Reference?

Athlonite: I recently recovered data from a laptop that had the zero fill done on it by someone not on friendly terms with it's owner

Would you mind sharing the basic technique you used?

1 | 2 | 3