low level several times

[tshontikidis]

I have heard of programs that will low level format computers and write "0" some amount of times like 7 or 8 so the data can never be recovered. I was just wondering what some of thes apps where?

The reason i ask is because if a company leases computers when they return them they need to be wiped for liability issues and i know if you high or low level format you can still recover the data. I cant remember the number of times a disk has to be written over before the data can not be recovered but i think it is like 7.

Thank you

 

[StorageJoe]

You can write 0s to a drive about 100 times before the data become totally unrecoverable. 7 or 8 times is easily recoverable (nearly if not 100%) if you have access to the right equipment. (I know because I've seen it.)

Companies worries about old data are best to trash the drives and throw them out then try to turn them to cash.

 

[unhappy_mage]

Really? I thought 7 times was the DoD standard. It sounds reasonable. If the bits are set to 90% of nominal values (10% off), then 7 passes means the remaining signal is .001% of what it originally was. That seems like enough to me.

You can dump zeroes or random data to the drive with Linux really easily. Do this:
dd if=/dev/zero of=/dev/hda
or this:
dd if=/dev/urandom of=/dev/hda
and it'll overwrite everything with zeroes or random data, respectively. It should go close to the media transfer rate, too. Add "time " to the beginning of those and it'll show you how long it actually takes.

 

[Ice Czar]

its a misnomer to call that a low level format
a real low level format writes the cylinders, tracks and sectors
along with the distributed servo bursts and can only be done in the factory with the modern areal density we have on the platters

Real LLF
Zero Fill

call it zeroing the drive

DBAN (Darik's Boot & Nuke)
Autoclave
ect will zero the drive with multiple pattern passes
go get the Ultimate Boot CD for those and more (freeware)


the more passes you make the longer it takes and the more secure it is
but simply zeroing the drive once will exceed most peoples ability to recover the data
if youy simply reformat and then reinstall anything not overwritten in the reinstall is basically in plain sight for your run of the mill recovery ap

on the otherhand, if really sensitive data (network passwordsd) or identity info,( like SSN or CC#s are on it)
forensic recovery aps can read under data that is overwritten, hense why you write multiple patterns to a drives then zero it

(Forensic aps read the relative strength of each bit to determine a history of its probable previous states + or -, then it recompiles the data, its both expensive and time consuming, as far as how many patterns till its "truely" secure
well till its ground to dust,
even 42 patterns isnt actually secure it might take the NSA a decade and a half and a few million dollars in supercomputer time,
but theyd eventually get your ghey love letters to Osama

 

[StorageJoe]

I was touring one of Seagate's facilities with our rep and they have a machine that can recover an amazing amount of data that has been overwritten many many times. The thing was actually pretty cool. I gotta get me one of them.

 

[tshontikidis]

its a misnomer to call that a low level format
a real low level format writes the cylinders, tracks and sectors
along with the distributed servo bursts and can only be done in the factory with the modern areal density we have on the platters

Real LLF
Zero Fill

call it zeroing the drive

DBAN (Darik's Boot & Nuke)
Autoclave
ect will zero the drive with multiple pattern passes
go get the Ultimate Boot CD for those and more (freeware)

Yea while looking through the forums before i posted i saw the UBCD and downloaded it, i will take a look at it later.

As the reason why they do not trash the drives is because the company leases out computers and every time they get the computer back they just cant throw out the HD. I was asking just because they were high level formatting all the time and i was just curious.


Thanks everyone:0

 

[Ice Czar]

all a high level format does is rewrite the metadata (pointers to the data)
leaving anything written to the majority of the drive in plain sight to a direct sector scan
(most recovery aps)

given 5 minutes and a freeware ap, Id have access to most anything that wasnt encrypted originally

 

[unhappy_mage]

I was touring one of Seagate's facilities with our rep and they have a machine that can recover an amazing amount of data that has been overwritten many many times. The thing was actually pretty cool. I gotta get me one of them.

So why don't hard disk storage companies use this to their advantage and sell (for example) a 400gb drive as a 4tb drive, and just overwrite 10 copies of the data and count on their machine to recover it? For $5k, I bet you could get a lot of interested individuals. That's not a bad price for 4tb of storage.

My thought: it isn't accurate enough to do that. Entropy kicks in at some point. And, for that matter, it's tricky to tell the difference between random bits and encrypted files. How would you know when you hit a "layer" of random bits versus an encrypted filesystem?

 

[StorageJoe]

It's all error correction that's built into the drive. You have a platter spinning at 7,200 rpm and a head has to follow and read a track that is thinner than a human hair. It's gonna miss some. Data recovery is kinda the same thing. The computer catches some of it and guesses at the rest.

 

[Tiny]

I downloaded the exe for UBCD....I clicked on it and it gave me a zip file....what do I do now?

(sorry for the thread jack, but you started a thread that I was going to start today, so I thought I would piggy back)

 

[unhappy_mage]

Depends, what's in the zip file? Might need 7z to uncompress it.

 

[Tiny]

This is what I have:

 

[Ice Czar]

UBCD FAQ


Question: What is an ISO image file?
(which is what that is, you'll navigate to its location and its named ubcd33-basic.iso)

An ISO image file is a platform-independent way to describe the contents of a CD. There are tools on every operating system to recreate a CD from a given ISO image file. Hence it is a good way to distribute CDs over the Internet without having to snail mail the physical disc.

Question: How do I create the Ultimate Boot CD from the ISO image file?

Here is some software you can use to burn ISO image files under Windows:

Using Nero Express 5
Using Nero Express 6
Using Nero Burning ROM
Using Easy CD Creator
Using Easy Media Creator
Using WinOnCD

BurnCDCC is a small dedicated Windows app for burning an ISO image to a CD/DVD disc. Use it if you do not have a CD burning app, or you are not sure how to use one for burning an ISO image.

Using Burnatonce - Free for non-commercial use burning software (Contributed by Michael Ireland)

1. Load burnatonce software.
2. Let it associate to all ISO files.
3. Open desktop icon.
4. Click on "File" >> "Load New Image ..."
5. Search for the ISO image and select.
6. Click on the "Write" button.
7. From memory, it takes about 20 minutes to do a full copy (of Ultimate Boot CD).

This list is by no means exhaustive, and there are similar tools available on other platforms to burn an ISO image file.

 

[Ice Czar]

keep in mind the CDROM needs to be in your boot order
so access the BIOS and set the boot order to CDROM first
and then your HDDs if it isnt already



now that your an ISO pro

do it again > http://www.knoppix.org/

http://www.oreillynet.com/pub/wlg/5938
http://www.linuxdevcenter.com/pub/a/linux/2004/12/02/knpxhks_1.html
http://www.knoppix.net/wiki/Rescue_FAQ
http://greenfly.org/talks/knoppix_hacks/rescue.html

though you might have more fun just running Knoppix to surf the underworld and laugh at malware, it cant corrupt the OS as its just in RAM and on the CD anything that does take hold is dead with a reboot

 

[BossNoodleKaboodle]

its a misnomer to call that a low level format
a real low level format writes the cylinders, tracks and sectors
along with the distributed servo bursts and can only be done in the factory with the modern areal density we have on the platters

Real LLF
Zero Fill

call it zeroing the drive

DBAN (Darik's Boot & Nuke)
Autoclave
ect will zero the drive with multiple pattern passes
go get the Ultimate Boot CD for those and more (freeware)


the more passes you make the longer it takes and the more secure it is
but simply zeroing the drive once will exceed most peoples ability to recover the data
if youy simply reformat and then reinstall anything not overwritten in the reinstall is basically in plain sight for your run of the mill recovery ap

on the otherhand, if really sensitive data (network passwordsd) or identity info,( like SSN or CC#s are on it)
forensic recovery aps can read under data that is overwritten, hense why you write multiple patterns to a drives then zero it

(Forensic aps read the relative strength of each bit to determine a history of its probable previous states + or -, then it recompiles the data, its both expensive and time consuming, as far as how many patterns till its "truely" secure
well till its ground to dust,
even 42 patterns isnt actually secure it might take the NSA a decade and a half and a few million dollars in supercomputer time,
but theyd eventually get your ghey love letters to Osama

how can the computer guess complicated patterns of magnetic strength enough to grab credit card number thats been overwritten a bunch of times?

 

[Tiny]

I read every FAQ on the UBCD page.

I know how to make an ISO image. I have several ISO linux discs.

What I haven't found is the every-lovin' ISO image for the UBCD.

See my post with the pics....that is what I get every time I download the Basic UBCD.

 

[Ice Czar]

hmmm.....
the traditional answer is raw computing horsepower to compare and reassemble the previous states based on their feild strength, and when you consider what even a run if the mill cluster can do......

however

in researching this deeper I came across indicators that this is actually a myth that has grown up around both older tech no longer applicable at modern areal density and the The Defense Security Service (DSS) of the Department of Defense (DoD) standards of media destruction.

so while it was once true it appears to now largely be an old storm in a teacup

http://fullcoverage.yahoo.com/s/prweb/20050707/bs_prweb/prweb259081/nc:1440
http://www.actionfront.com/ts_dataremoval.asp

Overwriting of the Data

Overwriting of the data means replacing previously stored data on a drive or disk with a predetermined pattern of meaningless information. This is an accepted and effective means of rendering data unrecoverable but the process must be correctly understood and carefully implemented.

If data is "successfully" overwritten, even a single time, it can be considered as unrecoverable for all practical purposes.

Data is recorded onto magnetic media by writing a pattern of fluxes (or pole changes) that represent binary ones (1) and zeros (0). These patterns can then be read back and interpreted as individual bits, 8 of which are used to represent a byte or character. For example, the letter "A" is written in a binary pattern as "01000001", the letter "B" is "01000010", the letter "C" as "01000011", etc... If the data is overwritten with a random pattern (let's say "11111111" followed by "00000000") the magnetic fluxes have been physically changed and the drives read/write heads will only detect the new pattern and for all intents the data has been effectively "erased".
CAN OVERWRITTEN DATA BE RECOVERED?

Good Question!

During the past few years I have been questioned on numerous occasions (by technicians from Revenue Canada, the R.C.M.P., the Department of National Defense and several Universities) about the availability of technologies to read trace magnetic signals that have been overwritten. It is commonly quoted that data can be recovered if it has been only overwritten once or twice and that it actually takes up to ten overwrites to securely protect previous data.

If a head positioning system is not exact enough, new data written to a drive may indeed not be written back to the precise location of the original data. Due to this track misalignment, it is possible to identify traces of data from earlier magnetic patterns alongside the current track. (At least that was the case with high capacity floppy diskette drives, which have a rudimentary position mechanism. Due to the embedded positioning systems and extreme high densities of new drive technologies, it has yet to be proven if the same can be said for the latest high speed, high capacity disk drives.)

It has been suggested that an electron microscope could be used to read and interpret any patterns that were not fully overwritten by the process. Theoretically this can be done - but in practice it is little more than a myth.

Electron microscopes have been used to detect and identify magnetic regions smaller than the fluxes used to represent data on a 200 megabyte disk drive. Unfortunately, at best, this type of process could be accomplished at a rate of perhaps 1 bit per second. Furthermore, since virtually every drive in production today records two or more magnetic fluxes (due to R.L.L. recording) to represent each bit the actual rate could be considerably slower.

The number of bits in a single 512 byte (character) sector is 4096 and there are over 200,000 sectors on a one hundred megabyte hard drive. This represents almost 820 million bits to be read back.

If data could be recovered at the rate of 1 bit per second - this process would take 9,259 days (or over 25 years) to recover 100 MB of information. This is assuming that you could read back and interpret each bit correctly, for example on data that has never been overwritten. If you are trying to read "traces" of data that were previously written there, in the most likely scenario you may be able to correctly recover, interpret and identify 30-40 percent of the signals.

THAT DOES NOT MEAN YOU WOULD RECOVER 30-40% OF THE DATA - BUT ONLY 30-40% OF THE INDIVIDUAL BITS IN EVERY CHARACTER.

A "10101011" pattern may come back as "?010?01?" and every single character on the drive would be scrambled in a similar manner. The mathematical probability of decrypting such a puzzle into usable data is infinitesimal.

It could be claimed that data can be recovered from any drive in the world with a guaranteed success rate of 50% "at the bit level". This sounds interesting until you consider that if you overwrote the entire surface of the drive with either all "0" or all "1" and since the original drive contained nothing but patterns of binary ones and zeros - half the bits would be correct - but obviously no data could be recovered.

In conclusion, overwritten data cannot be read back or recovered by any current disk drive technology or laboratory technique.
Problems with Overwriting Data

Even if successfully overwritten data is not recoverable in the real world, there are still a number of complicating factors that may prevent successful erasure of the information:

* Identifying and using the correct physical parameters of a drive to ensure that every sector on the surface is in fact overwritten.
* Dealing with write errors on the surface. If for some reason the write command is rejected, any previous data in that sector or track is still available and accessible by low level techniques.
* Selection of appropriate software that will work at a hardware level, independent of the operating system and overwrite data on the entire surface, not just for a single partition.

Notwithstanding any of these concerns, the process of overwriting data, if correctly implemented, is by far the most secure and economical method of erasing data from a hard disk drive.

Glad you asked that question

 

[Ice Czar]

I read every FAQ on the UBCD page.

I know how to make an ISO image. I have several ISO linux discs.

What I haven't found is the every-lovin' ISO image for the UBCD.

See my post with the pics....that is what I get every time I download the Basic UBCD.

LOL
look at your pic again


on the desktop it says ubcd33-basic
but at the top of your pic the .iso is revealed


"ubcd33-basic.iso - ISO9660 archive, unpackedsize 121,269,082 bytes"
point the burner to that file on your desktop

 

[Tiny]

The file that the Winrar is seeing is the zipfile on my desk top....the zipfile that I get when I double click the 7z.

 

[Ice Czar]

extract it

use winrar its likely integrated into the shell just

RClick (the file) > Extract Here (or wherever you want it)

 

[Tiny]

I did.

I don't get any ISO image from the extraction, I just get a folder with everything you see in the WINRAR pic in it.

 

[Ice Czar]

I thought that might be the case

delete that

just point your burning ap to the ISO archive
the one with the WinRAR logo on your desktop

an iso image is an archive
one that WinRAR is associating

 

[Tiny]

What the monkey!?

So I burn the file with the Winrar icon as an Image?

Weird.

I just finished downloading the Full version (has INSERT) from Mr.Bass, I unzipped it and it came as a zipfile with an ISO extention.

Thanks for the help ICE!!

 

[OldMX]

The file extracted from the 7zip file is a .ISO using WinRAR icon, just hit Nero / recorder / burn image and you should be OK

oldmx

 

[Milenko]

You aren't getting it.

That winrar file is an .iso file.

Winrar reads ISOs.

edit - see what happens when you leave a thread open and go fix something, you come back and its answered.

 

[BossNoodleKaboodle]

so much conflicting information: one thing says that its impossible to get wiped data on a modern hard drive, the guy says Seagate has a machine that does it easy as pie. what is the dealy yo?

 

[Ice Czar]

well often you need to bust out the platters from a drive and read them directly to recover data
the overwitten part might be the exaggeration, or at least the depth of overwriting

Secure Deletion of Data from Magnetic and Solid-State Memory
(old tech in the post above\previous page) dates back to 1996 which in the areal density of HDDs is something like the Cambrian Age

I'll endevor to find out some more specific information but as of right now Id say the folks at actionfront are correct and that when properly overwritten on a modern HDD recovery is damn near impossible