Single drive wipe protects data, research finds

Single drive wipe protects data, research finds
Robert Lemos, 2009-01-16

Might want to read the source report. 2009-01-16
Anonymous (1 replies)

I'm not sure what report you've read, but Wright's SANS report shows that reading 32-bits off a pristine PMRL drive that had been wiped once had a 0.011604223, or about 1.1%, probability of success. That's not "7 in a million" it is 11,604 in a million.

He had slightly under 0.7 in a million for...

[ more ] [ reply ]

Re: Might want to read the source report. 2009-01-19
Robert Lemos (1 replies)

You are using Wright's numbers for a pristine drive, not a used drive. The article explicitly states that the used drive numbers are being cited, as that is a more realistic scenario.

-R

Robert Lemos

Managing Editor, SecurityFocus...

[ more ] [ reply ]

Re: Re: Might want to read the source report. 2009-01-19
Anonymous (1 replies)

(I'm not the original poster above, FWIW)

Used drives or not - worst-case was a pristine drive, which is a valid test. Still, look at the numbers: about 1% of 32-bits is recoverable. In other words, 32-bits is about 1 complete four-letter word in a text document, and you get one complete word in a ...

[ more ] [ reply ]

Re: Re: Re: Might want to read the source report. 2009-01-19
Anonymous

This analysis depends on the assumption that the person looking at the drive is not looking for the erasure of a particular file. For instance, suppose I stole a Big Secret, copied to my flash drive then overwrote the file on the hard drive. Owner of Big Secret suspects me and gets my hard drive. A ...

[ more ] [ reply ]

Single drive wipe protects data, research finds 2009-01-17
Commentor

"In many instances, using a MFM (magnetic force microscope) to determine the prior value written to the hard drive was less successful than a simple coin toss."

Surely if the estimate is *less* successful than a coin toss, then just flip the output of the estimation and it will be *more* successf...

[ more ] [ reply ]

Single drive wipe protects data, research finds 2009-01-17
Anonymous

He is a fed having a hard time recovering lost data by overwriting it many times and comes here and creates a false reality.

Go home buddy, we don't buy it ;)...

[ more ] [ reply ]

Single drive wipe protects data, research finds 2009-01-18
brl

I'm happy to see any attempts at all to finally put the myth to bed that you can recover overwritten data with exotic tools and techniques but nobody ever seriously believed that you could pull this off with MF microscopy, even assuming the magnetic artifacts which would make this possible existed i...

[ more ] [ reply ]

This is hogwash... 2009-01-19
Anonymouse (4 replies)

On a bet with my boss at work, just to prove him wrong... I had to take a hard drive, wipe it with one pass. It was a "Quick Erase", single pass. Done with DBAN.

I then used, Ontrack EasyRecovery Professional, to run a full scan on the hard drive.

Now, the data above is partially correct ac...

[ more ] [ reply ]

Re: This is hogwash... 2009-01-19
Anonymous (2 replies)

Your reply makes no sense. Ontrack uses windows to recover files, so if you did a single wipe, then it's GONE. Ontrack won't get it back. I imagine what you saw were a few temp files, swap-files, or the like... nothing real. Did you check to see what files were found, and if they were relevant? Also...

[ more ] [ reply ]

Re: Re: This is hogwash... 2009-01-19
Anonymous

Who ever wrote this article didn't present it properly as it was misleading, in that one might think that the article is speaking about a quick erase using windows or even a full format. In such a case of a quick erase it would be possible to to recover some data. However, thankfully, they updated t...

[ more ] [ reply ]

Re: Re: This is hogwash... 2009-01-19
Anonymous

My suspicion is that he used 'quick format', which wipes the file allocation table, and nothing else....

[ more ] [ reply ]

Re: This is hogwash... 2009-01-19
Anonymous

A quick erase doesn't actually overwrite anydata, it merely unlinks it from the file system. In theory Data erased with Quick Erase is almost all recoverable...

[ more ] [ reply ]

Re: This is hogwash... 2009-01-20
Anonymous

What, are you kidding? The "Quick Erase" only deletes the File Allocation Table, so that you can write over the files. It deletes and over-writes nothing....

[ more ] [ reply ]

And you are mistaken about your "recovery" 2009-01-20
Anonymous

And you are mistaken about your "recovery".

That's because "quick erase" only removes the first and last 20 Megabytes of data on the disk.

So of course there was data to be recovered....

[ more ] [ reply ]

Single drive wipe protects data, research finds 2009-01-19
Anonymous

WHERE was this 'published' on Thursday?

is it peer reviewed research?

is Mr. Wright's research methodology and data available for independent researchers to try to duplicate his findings and conclusion?...

[ more ] [ reply ]

Single drive wipe protects data, research finds 2009-01-19
Anonymous

If it is less successful than a coin toss, then invert the results and it will be more successful than a coin toss lol...

[ more ] [ reply ]

Single drive wipe protects data, research finds 2009-01-19
Anonymous

In addition, 16 Systems (tm) had the "Great Zero Challenge" which on january 1st 2009, remained unaccepted. This callenge is "A challenge to confirm whether or not a professional, established data recovery firm can recover data from a hard drive that has been overwritten with zeros once."...

[ more ] [ reply ]

Single drive wipe protects data, research finds 2009-01-19
Chris

The original paper is, of course, behind a paywall at http://www.springerlink.com/content/408263ql11460147/ .

I note that the author didn't answer commenter 'simsong', whom I suspect is a well-known infosec academic, when he asked where to find the original paper. This is decidedly uncollegial...

[ more ] [ reply ]

1) It is not an electron microscope 2) It is definitely possible to see bits 2009-01-19
Colby Boles (1 replies)

The MFM is a specialized version of an atomic force microscope (AFM), and has no relationship to the electron microscope (SEM). I used to design and operate some of the first high sensitivity MFMs in the 90's, and we looked at many hard disks sent to us by all of the major HDD manufacturers. Bottom ...

[ more ] [ reply ]

Re: 1) It is not an electron microscope 2) It is definitely possible to see bits 2009-01-21
Demagnetized Magnetician

Last time I looked, this isn't the 90's. It was possible to easily resolve magnetization in the 90's. It isn't now.

Present generation PMR HDDs linear density is about 1.5 million bits/inch, about 18 nm. Probably 10x the linear density in the 90's. Ferromagnetically coated MFM tips typically have...

[ more ] [ reply ]

Less successful than a coin toss? INVERT! 2009-01-20
Anonymous (1 replies)

If one's binary (1/0) results are CONSISTENTLY worse than a coin toss, simply invert your results and you will be consistently BETTER than a coin toss....

[ more ] [ reply ]

Re: Less successful than a coin toss? INVERT! 2009-01-21
Anonymous

oh my God.

I've seen reports from theb est people around in the field for years with docuemntation,etc. And then this guy comes out of the nothing without any proper do. and say s these things?! I say it's FUD...

you know. just trying to divert things...

...

[ more ] [ reply ]