Re: [gentoo-user] {OT} Recovering data from a formatted hard disk

[Stroller]

On 2 Feb 2006, at 11:28, Alexander Skwar wrote:
>>
>> This is not what normally (or at least, _always_) happens when you
>> format a hard-drive.
>
> Well, depends on the definition of "format". If you
> define format as "overwrite partition table", than
> you're right. But that's hardly what I'd call "format".

I was referring to the definition of "format" generally used by the  
authors & suppliers of formatting utilities. If you format a disk in  
Windows, or certainly if you "quick format" it, it doesn't run a  
quick call to `dd if=/dev/zero of=/de/hdX`; it merely overwrites the  
partition table so the data IS often recoverable after a format.

If you were merely formatting a disk for your own use, had no  
expectation that it would fall into anyone else's hands, and were in  
a hurry to use the disk with its new filesystem on it, you would  
surely be wasting time were you to insist on blanking every single  
bit on the device - it's simply not necessary.

I am not qualified to comment on recovery of data from a disk that  
has been wiped with zeros in the way you describe, nor from one which  
has been shredded properly with repeated iterations of random & non- 
random bits, but there certainly does seem to be a lot of hearsay on  
the subject. I would consider the a disk that's been comprehensively  
overwritten once to be unrecoverable from the practical perspective  
of the original discussion (a mate in the pub) but do consider a disk  
that's been over-written with shred to be unrecoverable as far as my  
customers' commercial data is concerned.

Whilst writing this I looked up `info shred` which claims:

    If you have sensitive data, you may want to be sure that recovery
    is not possible by actually overwriting the file with non-sensitive
    data. However, even after doing that, it is possible to take the
    disk back to a laboratory and use a lot of sensitive (and expensive)
    equipment to look for the faint "echoes" of the original data
    underneath the overwritten data.  If the data has only been  
overwritten
    once, it's not even that hard.

    The best way to remove something irretrievably is to destroy the
    media it's on with acid, melt it down, or the like.

The info page references Peter Gutmann's paper `Secure Deletion of  
Data from Magnetic and Solid-State Memory'. I'm not qualified to  
assess this paper fully, and hard-drives have progressed considerably  
in the last decade, but my naive reading of the conclusion seems to  
support the suggestion that a single write may not be sufficient to  
thwart a determined attacker:

    Data overwritten once or twice may be recovered by subtracting what
    is expected to be read from a storage location from what is actually
    read... it is effectively impossible to sanitise storage locations
    by simple overwriting them, no matter how many overwrite passes are
    made or what data patterns are written. However by using the
    relatively simple methods presented in this paper the task of an
    attacker can be made significantly more difficult, if not  
prohibitively
    expensive.
    http://www.cs.auckland.ac.nz/~pgut001/pubs/secure_del.html which  
concludes:

I state once again that I'm not really qualified to comment on the  
subject to this depth, so I offer these references merely for your  
perusal. I would be grateful if you refrained in any future responses  
from the sneering manner you have employed in those to date.

Stroller.



-- 
gentoo-user@g.o mailing list