Why are there so many data wipe/erase methods for HDD?

rambomhtri · 03 Jul 2020

Hi, I was recovering the data of an old HDD and I noticed in the software a section to wipe all the data from an HDD. I saw fill all with 0's, fill all with 1's, fill all with 0's then with 1's, then you could select the number of times the wiping was performed...

I was thinking, if you fill all the HDD with 0's, how in heavens one person could recover data from there?
What am I missing?

I've read that HDD have tracks with bumps and holes, meaning 1's and 0's. If you make all of those bumps, it's impossible to know the previous state of the track.

Macboatmaster · 03 Jul 2020

storage - Why is writing zeros (or random data) over a hard drive used when writing all ones is more beneficial? - Information Security Stack Exchange
The in depth explanation is on the link
I suspect the whatever you read referred to the tracks and space between them as the bumps and holes.
PRESUMING you are asking from the aspect of wiping it before disposing of it, there is no more effective wipe than a nail hammered through the drive.

SoFine409 · 03 Jul 2020

Macboatmaster said:

storage - Why is writing zeros (or random data) over a hard drive used when writing all ones is more beneficial? - Information Security Stack Exchange
The in depth explanation is on the link
I suspect the whatever you read referred to the tracks and space between them as the bumps and holes.
PRESUMING you are asking from the aspect of wiping it before disposing of it, there is no more effective wipe than a nail hammered through the drive.

I don’t waist a nail, I just remove the cover and apply the hammer, liberally, until parts start flying in all directions.

rambomhtri · 03 Jul 2020

I wasn't asking how to properly destroy for good a hard drive and make it unusable. I was asking why or how, after you fill with zeros a modern HDD, you can still recover some data. According to what I read, HDDs consist in magnetic tracks that have little sections that can be 0 or 1. If you make all of them 0, or 1, it's impossible to recover any data. But clearly there's something wrong in my idea of how the HDD works. I wanted someone to point out where I'm wrong.

I've given personal HDD's to friends, family and also sold them. In all of the cases I did a full "0" wipe, just one pass, thinking it was 100% safe. I'm not worried at all about "discovering" that my old data could be recoverable by a stranger, but simply I can't understand how, that's what made me open this thread.

Compumind · 03 Jul 2020

rambomhtri said:

I've given personal HDD's to friends, family and also sold them. In all of the cases I did a full "0" wipe, just one pass, thinking it was 100% safe. I'm not worried at all about "discovering" that my old data could be recoverable by a stranger, but simply I can't understand how, that's what made me open this thread.

Hi!

When you wipe a disk with differing patterns of 0's and 1's it would appear the the HDD is truly wiped. However, the DOD has ways of recovering it if the drive is not damaged.
What they do is amplify the signals recorded on the tracks - and filter out the wiped data pass. This is quite complex and needs very special hardware and software to do.

The process is not guaranteed and may only yield fragments of data - the more passes of 1's and 0's - the better!

If you want to truly destroy a HDD, use heat - and lot's of it. Burn the recording platters! You can also grind the HDD into oblivion.

Hope this helps!

Here's a good program (free) to give you a nice feeling of comfort. Let it run for 24 hours.

Eraser – Secure Erase Files from Hard Drives

LMiller7 · 03 Jul 2020

Concerns about the possibility of recovering erased data are based on a paper written by Peter Gutmann in 1996. The method relies on detection of residual magnetism in the data tracks. The process was verified as a proof of concept. Note that this was academic research, much of which never becomes practical. How much real world data, if any, has been recovered by this method is unknown.

That research paper was published more than 20 years ago. Modern drives use a different recording method and data densities are much higher. Would that method work on modern drives? Peter Gutmann himself has expressed doubts. The organizations that might have this capability aren't talking.

In any event the method would require very advanced knowledge and hardware that is not commercially available. It would be far beyond the abilities of any home user.

Advanced erasing methods are used "just in case", and when very high levels of security are required.

Many organizations require physical destruction of a drive before disposal. This is not because normal erasing procedures are not sufficiently secure but because of the difficulties of verification. How do you determine if the erase procedure was actually done (assuming you did not do yourself), that it was allowed to run to completion, and that nothing went wrong during the procedure? Physical destruction requires little technical knowledge or skill and the results are easily verified.

Helmut · 03 Jul 2020

Information that is missing is the accuracy with which those 0 and 1 s are written to the drive.
Because it is basically mechanical positioning of the read/write heads, they never go back to precisely the same position.
Therefore some residual old data still exists on the platter sufaces. I think that is of the order of 6 levels.

So to be absolutely sure of no data recovery you need to overwrite data something more than 6 times.

To recover those ~6 old levels of data would require a very expensive professional data recovery service.
1 pass is suitable for your scenario, but it would be better to do that 10 times.

Personally I won't sell old drives, or even give them away. They do have a limited life so you are basically giving away/selling an old drive with little life left in it.

rambomhtri · 04 Jul 2020

Then the HDD technology is not well designed from the security point of view. I mean, if you create a track that is way wider than the head writing "mountains or valleys", then when you pass through the same track, the head might not be perfectly aligned with the already written data, and you could left some old data there.

Why they didn't do a bigger head than a track, either making the head bigger or the track smaller, so no matter what, even if the head is not perfectly aligned, since it's way bigger than the track itself, it would overwrite everything?

Why are there so many data wipe/erase methods for HDD?-untitled.png

Green color means 0's, plains, or south pointing magnetic field. Red color means 1's, mountains, or north pointing magnetic field.

In the first case, and what I understand actually is the real model, the head is slightly smaller than the track. As you can see, when erasing data and making everything a 0, if the head doesn't pass through the exact same way, which is almost impossible in a microscopic view, it will leave a trace of the data. Not only that, which is a huge security risk, but also it will leave noise that you have to cancel out when reading.

However, in my design, which I'm sure someone must had came with when they were designing this, if the head is bigger than the track, not matter if the head passes slightly moved from the previous pass, all content will be overwritten. Even if the tracks are touching each other, imagine a green track right next to the top and bottom, the head will slightly overlap a tiny bit on the other tracks, but the noise would be just "as bad" as in the first case scenario. Besides, when you do a 0 pass, since the head is bigger and overlaps, it would make sure absolutely every thing is 0.

In the second case, if you simply do a 0 pass, once, and a 1 pass later, once, to fix possible "stuck 1 little zones from the 0 pass", it would be scientifically and mathematically impossible to recover any data, and you wouldn't need any destructive method to correctly delete it, neither do incredibly time consuming passes and passes hoping the head will cover all the area in all of those passes.

What am I missing? Why the head was/is smaller?

LMiller7 · 04 Jul 2020

For practical reasons the drive uses the same head for both recording and reading the data. Thus the track will be the same width as the head. Of course when reading the head will not be exactly aligned with the track as written and it will pick up some data that previously existed. You would need to read the raw data from the head, analyze it, and hopefully find enough to extract the data. There is no commercially available equipment to do this. Is that practical with modern drives? And if you are lucky enough to get this data you have to search through potentially terabytes of data to find something of interest. And the data may well be encrypted. Is your data worth that kind of effort to recover?

Macboatmaster · 05 Jul 2020

What is puzzling me a little is - I cannot decide if the thread is started for the purposes of advice regarding wiping a drive to make the recovery of the data - impossible for the general use or if the question is posed for some manner of technical discussion.
In simple terms the more writes you make to a drive, after deleting the data, the harder it is to recover the original original data.
The format of a drive in general terms does not WIPE the whole drive and write anything to it.

It in basic terms wipes the MFT and that is why the data that is on the drive, can still be recovered, as all that has been
deleted is the MFT - the index to the drive.

When a file is opened from a drive, the search for the file is not on the entire contents of the drive, it searches the MFT (index) and that tells it where to locate the requested file.

3 Methods to Completely Wipe a Hard Drive on Windows 10/8/7/XP

Formatting works in a similar way, as it does not actually wipe data. Formatting disk or partition looks like tearing the contents of a book without disturbing actual chapters of the book.