{"id":3068,"date":"2019-07-18T07:00:02","date_gmt":"2019-07-18T11:00:02","guid":{"rendered":"https:\/\/langa.com\/?p=3068"},"modified":"2019-07-17T11:33:05","modified_gmt":"2019-07-17T15:33:05","slug":"more-on-the-recoverability-of-overwritten-data","status":"publish","type":"post","link":"https:\/\/langa.com\/index.php\/2019\/07\/18\/more-on-the-recoverability-of-overwritten-data\/","title":{"rendered":"More on the recoverability of overwritten data"},"content":{"rendered":"\n

The recent post,\u201cIs it possible to retrieve data from an HDD that\u2019s been zeroed out?<\/a>\u201d generated some interesting mail arguing the technical merits of single vs. multipass, and random vs nonrandom, overwrites.<\/p>\n\n\n\n

For example, Miles Wolbe sent in this excellent note:<\/p>\n\n\n\n

Hi Fred,<\/em><\/p>

This is a topic that has interested me for some time:<\/em><\/p>

Is it possible to recover data from a drive overwritten with zeros once?
<\/em>https:\/\/tinyapps.org\/blog\/201107170700_once_is_enough.html<\/em><\/a><\/p>

The wide consensus is no, even for three letter agencies armed with magnetic force microscopes.<\/em><\/p>

As for the origin of the theory that such recovery might be possible (Gutmann\u2019s 1996 paper \u201cSecure Deletion of Data from Magnetic and Solid-State Memory\u201d) Daniel Feenberg (in <\/em>Can Intelligence Agencies Read Overwritten Data?<\/em><\/a>) concludes that \u201cGutmann\u2019s claim belongs in the category of urban legend.\u201d <\/em><\/p>

A later comment attributed to Gutmann on the <\/em>Bugtraq mailing list<\/em><\/a> stated \u201ceven if you\u2019ve got 10KB of sensitive data on a drive and can\u2019t erase it with 100% certainty, the chances of an adversary being able to find the erased traces of that 10KB in 80GB of other erased traces are close to zero.\u201d<\/em><\/p>

I can say this for certain: I tried hiring all three Western Digital Platinum Data Recovery Partners in the Americas (namely, Datarecovery.com, DriveSavers Data Recovery, and Ontrack) to recover data from a hard drive following a single pass of zeroes:<\/em><\/p>

It was not possible.<\/em><\/p>

Aloha,<\/em><\/p>

Miles<\/em><\/p>

<\/p>

PS – More info:<\/p>

Can data be recovered from a zero-filled hard drive? https:\/\/tinyapps.org\/docs\/recovering_data_from_zero_filled_hard_drive.html<\/a><\/p>

Guidelines for Media Sanitization, NIST Special Publication 800-88, September 2006 (https:\/\/nvlpubs.nist.gov\/nistpubs\/Legacy\/SP\/nistspecialpublication800-88.pdf<\/a>) \u201c[F]or ATA disk drives manufactured after 2001 (over 15 GB) clearing by overwriting the media once is adequate to protect the media from both keyboard and laboratory attack.\u201d<\/p>

Guidelines for Media Sanitization, NIST Special Publication 800-88, Revision 1, Decemeber 2014 (https:\/\/nvlpubs.nist.gov\/nistpubs\/specialpublications\/nist.sp.800-88r1.pdf<\/a>) \u201cFor storage devices containing magnetic media, a single overwrite pass with a fixed pattern such as binary zeros typically hinders recovery of data even if state of the art laboratory techniques are applied to attempt to retrieve the data.\u201d<\/p><\/blockquote>\n\n\n\n

Outstanding note, Miles, thanks!<\/p>\n\n\n\n

Permalink: https:\/\/langa.com\/?p=3068<\/a><\/strong><\/em><\/p>\n\n\n\n

\"[seperator]\"<\/figure><\/div>\n\n\n\n

COMMENT \/ QUESTION<\/strong> on THIS ITEM?<\/strong> See the<\/em> Comment box<\/strong> at bottom of this page!<\/em>

<\/em>NEW QUESTION? <\/b>Ask<\/em> here<\/a><\/font><\/u><\/b>!

(Want free notification of new content? Click<\/em> <\/strong>here<\/a><\/b>!)<\/p>\n","protected":false},"excerpt":{"rendered":"

The recent post,\u201cIs it possible to retrieve data from an HDD that\u2019s been zeroed out?\u201d generated some interesting mail arguing the technical merits of single vs. multipass, and random vs nonrandom, overwrites. For example, Miles Wolbe sent in this excellent note: Hi Fred, This is a topic that has interested me for some time: Is…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[24,10,5],"tags":[],"class_list":["post-3068","post","type-post","status-publish","format-standard","hentry","category-reader-comment","category-science-and-tech","category-windows"],"aioseo_notices":[],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/paaiox-Nu","jetpack-related-posts":[{"id":1772,"url":"https:\/\/langa.com\/index.php\/2019\/01\/30\/a-reader-asks-is-it-true-that-none-of-your-data-gets-permanently-deleted-from-your-hard-drive\/","url_meta":{"origin":3068,"position":0},"title":"A reader asks: “Is it true that none of your data gets permanently deleted from your hard drive?”","author":"Fred Langa","date":"2019-01-30","format":false,"excerpt":"(Question asked by reader Tevin Gotti*.) No, it's not true. Lots of data gets permanently deleted all the time. Data that\u2019s been fully and completely overwritten is beyond recovery. But it takes extra steps to \"fully and completely\" overwrite data. When that's not done, all bets are off: It might\u2026","rel":"","context":"In "A reader asks..."","block_context":{"text":"A reader asks...","link":"https:\/\/langa.com\/index.php\/category\/a-reader-asks\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":1923,"url":"https:\/\/langa.com\/index.php\/2019\/02\/06\/a-reader-asks-is-there-any-way-to-recover-data-from-a-computer-that-has-been-factory-reset\/","url_meta":{"origin":3068,"position":1},"title":"A reader asks: “Is there any way to recover data from a computer that has been factory reset?”","author":"Fred Langa","date":"2019-02-06","format":false,"excerpt":"Reader Troy Marcotte* asks: \"Is there any way to recover data from a computer that has been factory reset?\" If the device was simply reset using an ordinary factory recovery DVD\/flash drive, or the like, then yes, some data may still be available. With a standard factory reset, the drive\u2026","rel":"","context":"In "A reader asks..."","block_context":{"text":"A reader asks...","link":"https:\/\/langa.com\/index.php\/category\/a-reader-asks\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":3088,"url":"https:\/\/langa.com\/index.php\/2019\/07\/16\/how-should-you-destroy-old-usb-flash-drives-so-that-sensitive-information-cannot-be-recovered-from-them\/","url_meta":{"origin":3068,"position":2},"title":"“How should you destroy old USB flash drives so that sensitive information cannot be recovered from them?”","author":"Fred Langa","date":"2019-07-16","format":false,"excerpt":"It depends on what level of snooping you want to guard against. But in all cases, it\u2019s smart to start by reformatting and data-wiping any kind of drive\/memory that you\u2019re discarding. So, that\u2019s the first step. Next, you can deter casual snoops simply by destroying the physical USB package: Use\u2026","rel":"","context":"In "A reader asks..."","block_context":{"text":"A reader asks...","link":"https:\/\/langa.com\/index.php\/category\/a-reader-asks\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":2828,"url":"https:\/\/langa.com\/index.php\/2019\/05\/21\/ive-installed-a-1tb-hard-drive-from-my-old-pc-it-has-files-but-no-operating-system-how-can-i-fully-wipe-it-to-use-its-full-storage\/","url_meta":{"origin":3068,"position":3},"title":"“I’ve installed a 1TB hard drive from my old PC. It has files but no operating system. How can I wipe it to use its full storage?”","author":"Fred Langa","date":"2019-05-21","format":false,"excerpt":"You don't need to wipe it. Simple re-partitioning and reformatting will make the drive fully available to you. And that\u2019s a very good thing, because wiping a drive involves overwriting every spot on the disk \u2014 in your case, a trillion bytes\u2019 worth. On an average system and HDD, that\u2019d\u2026","rel":"","context":"In "A reader asks..."","block_context":{"text":"A reader asks...","link":"https:\/\/langa.com\/index.php\/category\/a-reader-asks\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":2722,"url":"https:\/\/langa.com\/index.php\/2019\/05\/07\/is-there-any-way-to-charge-a-phone-faster\/","url_meta":{"origin":3068,"position":4},"title":"“Is there any way to charge a phone faster?”","author":"Fred Langa","date":"2019-05-07","format":false,"excerpt":"Sure, turn it off! Seriously, your phone will charge fastest when it\u2019s fully powered off and connected to an active charger. If a full power-off charge isn't possible, power down as much you can. Some things you can do: Turn the screen brightness down to the lowest level you can\u2026","rel":"","context":"In "A reader asks..."","block_context":{"text":"A reader asks...","link":"https:\/\/langa.com\/index.php\/category\/a-reader-asks\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":4659,"url":"https:\/\/langa.com\/index.php\/2020\/03\/31\/is-it-possible-for-laptop-heat-sinks-to-stop-working\/","url_meta":{"origin":3068,"position":5},"title":"“Is it possible for laptop heat sinks to stop working?”","author":"Fred Langa","date":"2020-03-31","format":false,"excerpt":"(Answer requested by Sameer Chakma.) No, if you mean your question literally: At its heart, a computer's heat sink is usually just a piece of inert metal. There\u2019s nothing to break or stop working. But I suspect you mean: \u201cIs it possible for a PC\u2019s heat-removal system to malfunction?\u201d and\u2026","rel":"","context":"In "A reader asks..."","block_context":{"text":"A reader asks...","link":"https:\/\/langa.com\/index.php\/category\/a-reader-asks\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/langa.com\/wp-content\/uploads\/2020\/03\/heatsink-rf.jpg?fit=848%2C565&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/langa.com\/wp-content\/uploads\/2020\/03\/heatsink-rf.jpg?fit=848%2C565&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/langa.com\/wp-content\/uploads\/2020\/03\/heatsink-rf.jpg?fit=848%2C565&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/langa.com\/wp-content\/uploads\/2020\/03\/heatsink-rf.jpg?fit=848%2C565&ssl=1&resize=700%2C400 2x"},"classes":[]}],"jetpack_likes_enabled":false,"_links":{"self":[{"href":"https:\/\/langa.com\/index.php\/wp-json\/wp\/v2\/posts\/3068","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/langa.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/langa.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/langa.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/langa.com\/index.php\/wp-json\/wp\/v2\/comments?post=3068"}],"version-history":[{"count":3,"href":"https:\/\/langa.com\/index.php\/wp-json\/wp\/v2\/posts\/3068\/revisions"}],"predecessor-version":[{"id":3111,"href":"https:\/\/langa.com\/index.php\/wp-json\/wp\/v2\/posts\/3068\/revisions\/3111"}],"wp:attachment":[{"href":"https:\/\/langa.com\/index.php\/wp-json\/wp\/v2\/media?parent=3068"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/langa.com\/index.php\/wp-json\/wp\/v2\/categories?post=3068"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/langa.com\/index.php\/wp-json\/wp\/v2\/tags?post=3068"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}