Re: [gentoo-user] "wiping" unused space and/or secure erasing of files/ Is this irrelevent?

[Rob]

Matthias Bethke wrote:
> Hi Hemmann,,
> on Sunday, 2005-10-30 at 19:05:20, you wrote:
>
>>>Oh, no doubt that they can recover from burned platters.
>>>But have you ever seen, that they can recover overwritten
>>>data?
>>
>>not seen, but read about it. They can recover overwritten data.
>
>
> Maybe those overwritten once with a simple pattern. Not after a dozen
> times with random bits, no way.
>
>
>>>I've only heard the opposite - that they CANNOT do that.
>>
>>maybe you should ask one of the forensic/data saving companies that do this
>>all day.
>
>
> They don't.
>
>
>>Recovering overwritten data is as easy as recovering from damaged drives.
>>
>>Basically, you need a very, very sensitive magnetic coil ;)
>
>
> If you've ever seen the noisy output of a regular coil reading regular
> data you start wondering how it comes out the same error-free sequence
> in the first place. Recovering data from damaged drives isn't exactly
> easy either, but they're still on the platters. Finding an overwritten
> signal under several others is magnitues harder.
>
> On the original question: for wiping free space, a repeated
> dd if=/dev/urandom of=/path/to/file bs=4096
> should be suffcicient, if slow.
> To just wipe unused data to reduce the sice of a compressed image, I do
> the same with /dev/zero. It fills the whole partition with a file full
> of zeroes that you can remove afterwards. It's not quite as efficient as
> really zeroing all free blocks but it works on every FS and should even
> be unaffected by journaling.
>
> regards
> 	Matthias
>
I am wondering if this discussion is irrelevent to anonymity and/or
security, as if the /tmp and swap partitions are not dealt with, then
what use is a secure erase?

Rob
-- 
gentoo-user@g.o mailing list