"Orchid XP v8" <voi### [at] devnull> wrote in message
news:4863f9fb@news.povray.org...
> > news:4863db04$1@news.povray.org...
> >> I always thought this kind of service was only of use to intelligence
> >> agencies and people with poor backup procedures. ;-)
> >
> > Well, seeing as I lost data in the process, I guess that you'd put me in
> > category 2?
> > In limited defence, I had a fairly complete backup (DVD) a few months
old
> > and a partial backup a week or so old (flash drive). I only lost a few
> > things. Most were recreatable.
>
> Fact: When I was at uni, every single time assignment hand-in date came
> around, you would not *believe* how many 3.5" disks went faulty! ;-)

We had a simple solution to that problem. Faulty disk = 0%. Suddenly the
disks got more reliable. Must have been a faulty batch.

Post a reply to this message

Gail Shaw wrote:

>> Fact: When I was at uni, every single time assignment hand-in date came
>> around, you would not *believe* how many 3.5" disks went faulty! ;-)
> 
> We had a simple solution to that problem. Faulty disk = 0%. Suddenly the
> disks got more reliable. Must have been a faulty batch.

Even more interesting: At hand-in time, there was *always* at least one 
laser printer that was faulty.

[This was almost always traced back to some DILBERT putting the wrong 
kind of transparency into it. Do NOT do this!!]

-- 
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*

Post a reply to this message

gregjohn wrote:
> "Gail Shaw" <initialsurname@sentech sa dot com> wrote:
> 
>> Um, actually...
>> http://www.pcworld.com/article/id,108831-page,1/article.html
>> http://www.guard-privacy-and-online-security.com/how-clean-off-the-hard-driv
>> e.html
>>
>> Your boss is right. It may not be as easy as 'undelete' but the data's there
>> and it doesn't take a microscope to find it, and it could be worth a lot of
>> money.
> 
> 
> This has always bothered me.  Something does not hang right.
> 
> Could one just copy a couple of version of a linux distro (0.6 to 4 GB) on top
> of it?  Would THAT be enough to completely obfuscate what was originally on the
> disk?   If not, then why hasn't anyone yet made a commercial use of the ability
> of HDD's to remember everything that has ever been on them?
> 
> 
> 
> 

Because to go back through the information that used to be on the drive 
takes advantage of the flaws in the drive it self. The read/write head 
goes over the drive and writes a pattern, let's say 1111 overtop of what 
used to be 0101. While the drive it sending out digital data, the 
magnetic pattern on the disk doesn't exist in just a 0 or 1 state.

Think of it as just a bar refrigerator magnet, facing up/down | is one, 
sideways - is 0. but the bar could be oriented like / or \. Given that 
those don't appear to be past 45 degrees off vertical, I'd guess they 
would both read like 1 instead of 0. Now, you have a visual of a 
collection of bar magnets that aren't lined up perfectly. To write them 
all to 1s, you would just rotate each one to a more vertical position. 
Knowing the strength of the write head's magnet, you could guess how 
much that change would be. So, you read the drive head in a less digital 
and more analogue manner, and then remove the affect of the last write 
phase. The more accurate the initial reading and the knowledge of the 
write magnet's properties, the better you can guess past that first phase.

The drive it self just doesn't work that way. After a point, it's a 
statistical guess as to how accurate the data you get back is. But some 
people are willing to spend a lot of money on just a guess for certain data.

Post a reply to this message

> Even more interesting: At hand-in time, there was *always* at least one 
> laser printer that was faulty.

Imagine the date approaching for 300 of us to hand in our 4th year project 
reports.  Most reports were around 100 pages, and we needed to hand in two 
copies.  At the Engineering department we had 2 or 3 laser printers that 
were *free* to use (as opposed to college computer rooms where you had to 
pay).  You can imagine the total carnage that happened the days before, I'm 
sure they got in an extra pallet of A4 paper for that week.

Post a reply to this message

I can think of several ways you could "erase" the data on a hard drive:

1. Delete all the files. (E.g., delete C:\*.*)

2. Format every partition with, say, NTFS.

3. Delete all partitions.

4. Low-level format the drive (using, e.g., Maxtor PowerMax).

5. Write zeros to every byte. (E.g., dd if=/dev/zero of=/dev/sda)

6. Write random data to every byte. (...of=/dev/urandom)

7. Physically disassemble the drive, seperate the platters, magnetise 
them, scratch them, smash them to pieces, and melt the pieces in a vat 
of heated acid.

As I understand it, option #1 is fairly easy to reverse. (Especially if 
you just delete all the files and then throw away the disk. All file 
data is guaranteed to still be there, you just have to find it somehow.)

Option #2 destroys some of the filesystem metadata, but AFAIK the blocks 
holding file data will still be intact. (Formatting with, say, ext2 
takes a tiny fraction of the time that FAT or NTFS formatting takes, so 
I'm assuming that NTFS overwrites more data. But I don't *think* it 
overwrites everything.)

Option #3 should be pretty simple to reverse, AFAIK.

I am unsure as to whether #4 and #5 are different in any way. Both seem 
to take the same amount of time...

As far as I know, both option #5 and option #6 make it impossible to 
read any useful data from the drive just by plugging it in and asking 
the drive electronics to read the data off the disk surface. In either 
case, you would have to physically dismantle the drive and crawl over it 
with a microscope - which is damned expensive. Using random data (and 
multiple passes of it) reputedly makes this process harder - but not 
impossible. Non-sequential writes are supposed to make it harder still.

As far as I can tell, option #7 gives 100% guaranteed data destruction. 
But I don't have any star-drive screwdrivers. :-P [Or heated acid - 
unless you count my stomach. And I am *not* putting shards of shattered 
glass in there!]

-- 
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*

Post a reply to this message

On Fri, 27 Jun 2008 09:17:47 +0100, Invisible <voi### [at] devnull> wrote:

>I can think of several ways you could "erase" the data on a hard drive:

PGP shredder it is free
-- 

Regards
     Stephen

Post a reply to this message

> 1. Delete all the files. (E.g., delete C:\*.*)

I wonder if you actually asked many non-geeks, what they would say if you 
asked them how they would go about erasing all their data from their 
computer?  I guess if you try to select-all and delete the contents of drive 
C from within windows it's going to get stuck at some point.

> Option #2 destroys some of the filesystem metadata, but AFAIK the blocks 
> holding file data will still be intact.

Oh, I thought that "format" really went over every byte of the partition and 
wrote to it?  IIRC there is a "quick format" option, which I assumed just 
did the headers and stuff to make it look like it was formatted.

> I am unsure as to whether #4 and #5 are different in any way. Both seem to 
> take the same amount of time...

I think that writing zeros to the disk would make it easier to recover the 
data, but that's just a guess.

> As far as I can tell, option #7 gives 100% guaranteed data destruction. 
> But I don't have any star-drive screwdrivers. :-P [Or heated acid - unless 
> you count my stomach. And I am *not* putting shards of shattered glass in 
> there!]

Just chuck it on a hot fire.  Saw it in half first if you want things to go 
quicker.

Post a reply to this message

scott wrote:
>> 1. Delete all the files. (E.g., delete C:\*.*)
> 
> I wonder if you actually asked many non-geeks, what they would say if 
> you asked them how they would go about erasing all their data from their 
> computer?  I guess if you try to select-all and delete the contents of 
> drive C from within windows it's going to get stuck at some point.

If you just want to delete "your" files, you can certainly do this. If 
you want to delete the OS, you'll definitely have to do it while running 
under something else. (Obviously.) I have an external USB enclosure for 
this exact purpose. It's shiny. The company paid for it. :-D

>> Option #2 destroys some of the filesystem metadata, but AFAIK the 
>> blocks holding file data will still be intact.
> 
> Oh, I thought that "format" really went over every byte of the partition 
> and wrote to it?  IIRC there is a "quick format" option, which I assumed 
> just did the headers and stuff to make it look like it was formatted.

Formatting a drive with ext2 just rewrites the inode tables. (Or... 
something like that.) Doesn't touch most of the disk surface, and 
typically takes about 20 seconds for a large partition.

A "normal" format with FAT or NTFS seems to touch more of the disk 
surface, but I'm not 100% sure whether it rewrites every single block, 
or just the first block in each cluster. The "quick format" option just 
rewrites the file allocation table, AFAIK. (That's why it takes seconds.)

>> I am unsure as to whether #4 and #5 are different in any way. Both 
>> seem to take the same amount of time...
> 
> I think that writing zeros to the disk would make it easier to recover 
> the data, but that's just a guess.

Writing random data is theoretically best. But in either case, once data 
has been overwritten, the drive electronics can't read it back. You're 
into microscope territory. The question is whether a low-level format 
actually overwrites everything or not.

> Just chuck it on a hot fire.  Saw it in half first if you want things to 
> go quicker.

Have you ever *tried* to make a hot fire?

It's way harder than it sounds...

-- 
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*

Post a reply to this message

Stephen wrote:

> PGP shredder it is free

1. Is it still free? IIRC they changed the licence a while back.

2. Can it erase an entire drive? I know it could do individual files, 
one at a time, and I think there was a free space wipe too. But a whole 
drive?

Better yet, didn't PGP used to offer a whole-drive encryption option? If 
you keep your entire drive encrypted, all you need to do is delete the 
encryption key. ;-)

-- 
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*

Post a reply to this message

> Have you ever *tried* to make a hot fire?

Hot enough to melt aluminium or glass - no problem.

Post a reply to this message

On Fri, 27 Jun 2008 10:04:26 +0100, Invisible <voi### [at] devnull> wrote:

>Stephen wrote:
>
>> PGP shredder it is free
>
>1. Is it still free? IIRC they changed the licence a while back.

Shredding is free so is encrypting files and IM

>2. Can it erase an entire drive? I know it could do individual files, 
>one at a time, and I think there was a free space wipe too. But a whole 
>drive?

Yes it can but not with the free version, I think. I'm not going to
try it on my own HD :)

>Better yet, didn't PGP used to offer a whole-drive encryption option? If 
>you keep your entire drive encrypted, all you need to do is delete the 
>encryption key. ;-)

True
-- 

Regards
     Stephen

Post a reply to this message

>>> PGP shredder it is free
>> 1. Is it still free? IIRC they changed the licence a while back.
> 
> Shredding is free so is encrypting files and IM

It does IM now?

Heh, I used to like PGP. Before it became all commercial and 
closed-source and expensive and stuff...

I've experimented with GPG, but that only encrypts files. It doesn't 
offer any other functionality. Oh well! I don't have any sensitive data 
anyway, what do I need cryptography for?

>> 2. Can it erase an entire drive? I know it could do individual files, 
>> one at a time, and I think there was a free space wipe too. But a whole 
>> drive?
> 
> Yes it can but not with the free version, I think. I'm not going to
> try it on my own HD :)

You could see if the button's there or not. :-P

-- 
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*

Post a reply to this message

>> Have you ever *tried* to make a hot fire?
> 
> Hot enough to melt aluminium or glass - no problem.

Heh. I had enough trouble trying to burn through a tree stump!

Now if I had *thermite*... >:-D

-- 
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*

Post a reply to this message

"Invisible" <voi### [at] devnull> a écrit dans le message de news: 
4864acb4$1@news.povray.org...
> Have you ever *tried* to make a hot fire?
>
> It's way harder than it sounds...
>
good quality coke (not the drink), good air-flow, in one word  : a forge 
fire

Marc

Post a reply to this message

>> Hot enough to melt aluminium or glass - no problem.
>
> Heh. I had enough trouble trying to burn through a tree stump!

Most people in my street make fires daily in the winter that are hot enough 
to burn tree stumps.  You just need to start off with some paper, then thin 
bits of dry wood, then bigger bits of wood, until it gets hot enough to put 
on whole pieces of tree.

> Now if I had *thermite*... >:-D

And how do you plan to ignite the thermite?

Post a reply to this message

>>> Hot enough to melt aluminium or glass - no problem.
>>
>> Heh. I had enough trouble trying to burn through a tree stump!
> 
> Most people in my street make fires daily in the winter that are hot 
> enough to burn tree stumps.  You just need to start off with some paper, 
> then thin bits of dry wood, then bigger bits of wood, until it gets hot 
> enough to put on whole pieces of tree.

I wouldn't mind, but this way in the middle of a hot summer drought. The 
wood was dry as hell, the sun is beating down on us, and yet the fire 
keeps going out...

We never did get it to turn in the end. Burned a whole heap of paper and 
cardboard, but the tree never got more than mildly scorched.

>> Now if I had *thermite*... >:-D
> 
> And how do you plan to ignite the thermite?

By remote control from a distance of more than 3 km?

-- 
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*

Post a reply to this message

On Fri, 27 Jun 2008 10:52:03 +0100, Invisible <voi### [at] devnull> wrote:

>
>It does IM now?

It says it does AIM, AOL IM

>Heh, I used to like PGP. Before it became all commercial and 
>closed-source and expensive and stuff...

Me too but Dr John said that he would not drink with someone who did
not have it on their HD :)

>I've experimented with GPG, but that only encrypts files. It doesn't 
>offer any other functionality. Oh well! I don't have any sensitive data 
>anyway, what do I need cryptography for?

As Dr John ;)

>>> 2. Can it erase an entire drive? I know it could do individual files, 
>>> one at a time, and I think there was a free space wipe too. But a whole 
>>> drive?
>> 
>> Yes it can but not with the free version, I think. I'm not going to
>> try it on my own HD :)
>
>You could see if the button's there or not. :-P

OK there is a button but you need a licence :(
-- 

Regards
     Stephen

Post a reply to this message

Stephen wrote:
>> Heh, I used to like PGP. Before it became all commercial and 
>> closed-source and expensive and stuff...
> 
> Me too but Dr John said that he would not drink with someone who did
> not have it on their HD :)
> 

Not true! I said i wouldn't _buy_ a drink for someone etc.

>> I've experimented with GPG, but that only encrypts files. It doesn't 
>> offer any other functionality. Oh well! I don't have any sensitive data 
>> anyway, what do I need cryptography for?
> 
> As Dr John ;)

GPG shreds files on all my machines. It can also encrypt a whole
filesystem. What else do you need?

> 
>>>> 2. Can it erase an entire drive? I know it could do individual files, 
>>>> one at a time, and I think there was a free space wipe too. But a whole 
>>>> drive?
>>> Yes it can but not with the free version, I think. I'm not going to
>>> try it on my own HD :)
>> You could see if the button's there or not. :-P
> 
> OK there is a button but you need a licence :(

So install Linux :-) and use GPG

John

-- 
I will be brief but not nearly so brief as Salvador Dali, who gave the
world's shortest speech. He said, "I will be so brief I am already
finished," then he sat down.

Post a reply to this message

On Fri, 27 Jun 2008 11:42:20 +0100, Doctor John <doc### [at] gmailcom>
wrote:

>
>Not true! I said i wouldn't _buy_ a drink for someone etc.

That's true 
-- 

Regards
     Stephen

Post a reply to this message

That you give me no Soooooul,
I hear you call-innng.
Oh baby pleeeease,
give a little respeeect,
toooooououo meeeeee.

-- 
Phil Cook

--
I once tried to be apathetic, but I just couldn't be bothered
http://flipc.blogspot.com

Post a reply to this message

> We never did get it to turn in the end. Burned a whole heap of paper and 
> cardboard, but the tree never got more than mildly scorched.

Looks like you needed some smaller bits of wood first, don't expect to light 
a tree with cardboard and paper.

>>> Now if I had *thermite*... >:-D
>>
>> And how do you plan to ignite the thermite?
>
> By remote control from a distance of more than 3 km?

If you had that sort of kit, you'd probably find easier ways to destroy a 
mere hard drive.

Post a reply to this message

Phil Cook wrote:
> That you give me no Soooooul,
> I hear you call-innng.
> Oh baby pleeeease,
> give a little respeeect,
> toooooououo meeeeee.

...who let HIM out?!? o_O

-- 
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*

Post a reply to this message

*facepalms*

Damn it Phil, it's too early on a Friday!! >_<

-- 
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*

Post a reply to this message

And lo on Fri, 27 Jun 2008 12:03:36 +0100, Invisible <voi### [at] devnull> did  
spake, saying:

> Phil Cook wrote:
>> That you give me no Soooooul,
>> I hear you call-innng.
>> Oh baby pleeeease,
>> give a little respeeect,
>> toooooououo meeeeee.
>
> ...who let HIM out?!? o_O

You wound me little one, you wound me to the quick :-P

The annoying thing is that this reminded me that I was going to look up a  
song I heard last night and both this and hearing Living on the Ceiling by  
Blancmange just on the radio has wiped it; damn now I'm stuck with the  
image of people treadmill dancing.

-- 
Phil Cook

--
I once tried to be apathetic, but I just couldn't be bothered
http://flipc.blogspot.com

Post a reply to this message

m_a_r_c wrote:
> good quality coke

Snort! :-D

John

-- 
I will be brief but not nearly so brief as Salvador Dali, who gave the
world's shortest speech. He said, "I will be so brief I am already
finished," then he sat down.

Post a reply to this message

scott wrote:
> 
> Most people in my street make fires daily in the winter that are hot 
> enough to burn tree stumps.  You just need to start off with some paper, 

No you don't, the cover of right wood (what's koivu in English?) is 
usually a lot easier to use than paper (it starts to burn as easily, but 
it burns with higher temperature). Or...

> then thin bits of dry wood, then bigger bits of wood, until it gets hot 
> enough to put on whole pieces of tree.

...if you have thin enough bits of really dry wood, just use them. 
They'll ignite pretty nicely and have warm enough flame to ignite 
another bits of dry wood.

-- 
Eero "Aero" Ahonen
    http://www.zbxt.net
       aer### [at] removethiszbxtnetinvalid

Post a reply to this message

get one of these:

http://www.youtube.com/watch?v=sQYPCPB1g3o

This is sad:

http://www.youtube.com/watch?v=uQs5hchKCAM

:(

Post a reply to this message

>> Most people in my street make fires daily in the winter that are hot 
>> enough to burn tree stumps.  You just need to start off with some paper,
>
> No you don't, the cover of right wood (what's koivu in English?) is 
> usually a lot easier to use than paper (it starts to burn as easily, but 
> it burns with higher temperature). Or...
>
>> then thin bits of dry wood, then bigger bits of wood, until it gets hot 
>> enough to put on whole pieces of tree.
>
> ...if you have thin enough bits of really dry wood, just use them.

Maybe you misunderstood, I start with paper just because it's easy to ignite 
with a match (plus it saves filling up the paper bin!).  I make a nice 
stack, starting with paper and cardboard at the bottom, then gradually 
bigger and bigger bits of wood on the stack.  Then all I need to do is 
ignite the paper at the bottom with a match for 2 seconds, and 5 minutes 
later the whole lot is always burning very well.

Post a reply to this message

scott wrote:
> 
> Maybe you misunderstood, I start with paper just because it's easy to 
> ignite with a match (plus it saves filling up the paper bin!).  I make a 
> nice stack, starting with paper and cardboard at the bottom, then 
> gradually bigger and bigger bits of wood on the stack.  Then all I need 
> to do is ignite the paper at the bottom with a match for 2 seconds, and 
> 5 minutes later the whole lot is always burning very well.

Ah yes, I missed the one-pile -idea, but basically all the other 
arguments stay the same - certain trees have a cover that's better 
igniter than paper and really dry and thin bits of wood have no problem 
there either.

The point of filling paper bin is naturally true ;).

-- 
Eero "Aero" Ahonen
    http://www.zbxt.net
       aer### [at] removethiszbxtnetinvalid

Post a reply to this message

Kyle wrote:
> get one of these:
> 
> http://www.youtube.com/watch?v=sQYPCPB1g3o

I could identify at least 2 (IBM?) server discs (SCA sleds), 1 Deathstar 
and 1 Fireball. I also think I saw a second fireball going in, but due 
to crappy image I can't be sure.

Note to self: never try to put your hand in there.

> This is sad:
> 
> http://www.youtube.com/watch?v=uQs5hchKCAM
> 
> :(
> 

Yes :(.

-- 
Eero "Aero" Ahonen
    http://www.zbxt.net
       aer### [at] removethiszbxtnetinvalid

Post a reply to this message

scott wrote:
> Imagine the date approaching for 300 of us to hand in our 4th year 
> project reports.  Most reports were around 100 pages, and we needed to 
> hand in two copies.  At the Engineering department we had 2 or 3 laser 
> printers that were *free* to use (as opposed to college computer rooms 
> where you had to pay).  You can imagine the total carnage that happened 
> the days before, I'm sure they got in an extra pallet of A4 paper for 
> that week.
> 
> 

With that kind of load, I'd be willing to believe they really *were* 
having printer problems :)

...Chambers

Post a reply to this message

On Thu, 26 Jun 2008 16:45:38 +0100, Invisible wrote:

> Uh... like, WTF?
> 
> I mean, sure, if you take the drive apart and crawl over it with a
> microscope, you can recover data. But who the **** is going to bother?
> It's not like you could recover any particularly valuable data.

There are some very good forensic tools available to the general public 
that make it possible to recover a fair amount of data from a wiped drive.

Jim

Post a reply to this message

On Thu, 26 Jun 2008 17:02:14 +0100, Invisible wrote:

> Right. Well I'll tell you what, you show me an actual technique that
> allows you to recover data from a harddrive after every individual block
> has been written with zeros, without the use of a microscope. ;-)

Send it here:  http://www.ontrack.com

Or maybe here:  http://salvagedata.com

Or use something like this: http://freshmeat.net/projects/mobiusft/

Or maybe http://freshmeat.net/projects/fccubootcd/

(The latter is reportedly used by the Belgian Federal Computer Crime Unit)

Forensic data recovery is a booming business at the moment (got a friend 
who does it, in fact).  Just wiping a drive is absolutely not sufficient 
- people have been convicted using evidence recovered from a drive 
without using "a microscope" (and BTW, how would that help?  The data is 
encoded in a magnetic field, a microscope won't see that).

Jim

Post a reply to this message

Invisible wrote:
> Damn it Phil, it's too early on a Friday!! >_<

Phillip, do you realise that you were directly responsible for me 
spending my entire afternoon looking up the Wikipedia entries for 
Erasure, Depeche Mode, Shamen, Orbital, The Chemical Brothers, Beth 
Orton, William Orbit, house, acid house, trance, rave, and two dozen 
other articles?!

-- 
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*

Post a reply to this message

Jim Henderson wrote:

> Send it here:  http://www.ontrack.com

I see lots of talk of *boken* hard drives, but not much about 
deliberately erased media.

> Or maybe here:  http://salvagedata.com

Ditto.

> Or use something like this: http://freshmeat.net/projects/mobiusft/

I can't even find any documentation explaining what this *is*...

> Or maybe http://freshmeat.net/projects/fccubootcd/
> 
> (The latter is reportedly used by the Belgian Federal Computer Crime Unit)

Seems to contain a bunch of tools for undeleting files, and recovering 
deleted partition tables. The main "data aquisition" tool is listed as 
being "dd". On the drives in question, all this will give you is a giant 
image file full of zeros - useless for analysis perposes.

> Forensic data recovery is a booming business at the moment (got a friend 
> who does it, in fact).  Just wiping a drive is absolutely not sufficient

The DSS appears to disagree:

https://www.dss.mil/GW/ShowBinary/DSS/isp/odaa/documents/clear_n_san_matrix_06282007_rev_11122007.pdf

The NIST concludes

http://csrc.nist.gov/publications/nistpubs/800-88/NISTSP800-88_rev1.pdf

that "for ATA disks of 15 GB or more", clearing prevents a "laboratory 
attack".

> - people have been convicted using evidence recovered from a drive 
> without using "a microscope" (and BTW, how would that help?  The data is 
> encoded in a magnetic field, a microscope won't see that).

I didn't mean a light microscope - I was actually thinking of a Magnetic 
Force Microscope...

-- 
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*

Post a reply to this message

Jim Henderson wrote:

> There are some very good forensic tools available to the general public 
> that make it possible to recover a fair amount of data from a wiped drive.

*sigh*

Clearly I am going to have to undertake some scientific experiments...

-- 
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*

Post a reply to this message

On Fri, 27 Jun 2008 20:00:50 +0100, Orchid XP v8 wrote:

> Jim Henderson wrote:
> 
>> Send it here:  http://www.ontrack.com
> 
> I see lots of talk of *boken* hard drives, but not much about
> deliberately erased media.

They've got the equipment for that.  I used to talk with them 
occasionally, and they did do forensic analysis for law enforcement back 
then.  Don't know if they still do.

>> Or maybe here:  http://salvagedata.com
> 
> Ditto.
> 
>> Or use something like this: http://freshmeat.net/projects/mobiusft/
> 
> I can't even find any documentation explaining what this *is*...

It's a forensic data toolkit.  Used for investigating criminal activity 
that's been stored on hard drives and then wiped/erased/whatever.  Often 
times, you don't recover a file, but you recover data on individual 
blocks (think like chkdsk).

> 
>> Or maybe http://freshmeat.net/projects/fccubootcd/
>> 
>> (The latter is reportedly used by the Belgian Federal Computer Crime
>> Unit)
> 
> Seems to contain a bunch of tools for undeleting files, and recovering
> deleted partition tables. The main "data aquisition" tool is listed as
> being "dd". On the drives in question, all this will give you is a giant
> image file full of zeros - useless for analysis perposes.
> 
>> Forensic data recovery is a booming business at the moment (got a
>> friend who does it, in fact).  Just wiping a drive is absolutely not
>> sufficient
> 
> The DSS appears to disagree:
> 
> https://www.dss.mil/GW/ShowBinary/DSS/isp/odaa/documents/
clear_n_san_matrix_06282007_rev_11122007.pdf
> 
> The NIST concludes
> 
> http://csrc.nist.gov/publications/nistpubs/800-88/NISTSP800-88_rev1.pdf
> 
> that "for ATA disks of 15 GB or more", clearing prevents a "laboratory
> attack".
> 
>> - people have been convicted using evidence recovered from a drive
>> without using "a microscope" (and BTW, how would that help?  The data
>> is encoded in a magnetic field, a microscope won't see that).
> 
> I didn't mean a light microscope - I was actually thinking of a Magnetic
> Force Microscope...

Well, all I know is that I know people who actually *do* this kind of 
work on a regular basis.

Doing a DoD style wipe is generally sufficient, but as others pointed 
out, the point from a data security standpoint is to make the cost of 
recovery more than the value of the data when recovered.  In *most* 
cases, a wipe is sufficient, but it really depends on how valuable the 
data is to your competition.

Jim

Post a reply to this message

On Fri, 27 Jun 2008 20:01:39 +0100, Orchid XP v8 wrote:

> Jim Henderson wrote:
> 
>> There are some very good forensic tools available to the general public
>> that make it possible to recover a fair amount of data from a wiped
>> drive.
> 
> *sigh*
> 
> Clearly I am going to have to undertake some scientific experiments...

First rule in data security:  Never assume any data is unrecoverable.

Second rule in data security:  Never assume nobody is watching.

Jim

Post a reply to this message

Invisible wrote:
> holding file data will still be intact. (Formatting with, say, ext2 
> takes a tiny fraction of the time that FAT or NTFS formatting takes,

D'oh?  Hardly.   I've never had an NTFS format take more than a half a 
minute or so, and formatting a 750G drive with ext3 on the same machine 
takes 10 or 15 minutes.

All NTFS has to write is about 5 blocks of file data and the free space 
bitmap (which isn't stored as a bitmap anyway). I'd be surprised if it 
writes more than a hundred K regardless of the size of the disk. NTFS 
doesn't preallocate i-nodes, nor are the i-nodes spread all over the 
disk, so it's generally way, way faster. In other words, an NTFS format 
formats two or three superblocks, one boot record, two copies of the 
first sixteen "i-nodes", and writes out an empty root directory, an 
almost-empty free space map, and an almost-empty ACL table. I wouldn't 
be surprised if FAT32 on a big drive took more writing than NTFS to format.

Ext2/3 stores i-nodes all over the disk, preformatting them. This takes 
time when you have a couple gig of i-nodes to fill out.

(The difference between ext3 and ext2 is a few seconds of creating the 
journal, so that's not the problem.)

> I am unsure as to whether #4 and #5 are different in any way. Both seem 
> to take the same amount of time...

On my drives, at least one of the maxtor "format back to factory-fresh" 
only wrote the first sector on each track or something. It finished way 
too fast to be writing the whole drive. Unless the drive had a command 
built in that wiped the entire track in one rotation or something, 
rather than actually having to transfer the data from memory to the 
drive for the whole thing.

-- 
Darren New / San Diego, CA, USA (PST)
  Helpful housekeeping hints:
   Check your feather pillows for holes
    before putting them in the washing machine.

Post a reply to this message

scott wrote:
> Oh, I thought that "format" really went over every byte of the partition 
> and wrote to it?  IIRC there is a "quick format" option, which I assumed 
> just did the headers and stuff to make it look like it was formatted.

Format *used* to write to the whole drive, way back in DOS 3/4 days or 
so. Now quick-format writes only the file system (first few tracks, 
basically) assuming all sectors are good, and non-quick format writes 
the first few tracks after *reading* all the sectors to make sure 
they're good.

-- 
Darren New / San Diego, CA, USA (PST)
  Helpful housekeeping hints:
   Check your feather pillows for holes
    before putting them in the washing machine.

Post a reply to this message

"Darren New" <dne### [at] sanrrcom> wrote in message
news:48654c14@news.povray.org...
>
> On my drives, at least one of the maxtor "format back to factory-fresh"
> only wrote the first sector on each track or something. It finished way
> too fast to be writing the whole drive. Unless the drive had a command
> built in that wiped the entire track in one rotation or something,
> rather than actually having to transfer the data from memory to the
> drive for the whole thing.
>

One the subject of format, what does Low-level format actually do? I
remember years ago disks had to be low level formatted by the user. Now a
low level format will render a drive useless (or so documentation says)

Post a reply to this message

>> holding file data will still be intact. (Formatting with, say, ext2 
>> takes a tiny fraction of the time that FAT or NTFS formatting takes,
> 
> D'oh?  Hardly.   I've never had an NTFS format take more than a half a 
> minute or so, and formatting a 750G drive with ext3 on the same machine 
> takes 10 or 15 minutes.

For me, it typically takes about 20 minutes to do a full NTFS format on 
a large partition. (Doesn't seem to matter how big the drive is - 
presumably because larger drives are also newer and hence faster.)

> Ext2/3 stores i-nodes all over the disk, preformatting them. This takes 
> time when you have a couple gig of i-nodes to fill out.

For me, ext2 takes about 15 seconds or so - very much faster. Comparable 
to an NTFS "quick format".

>> I am unsure as to whether #4 and #5 are different in any way. Both 
>> seem to take the same amount of time...
> 
> On my drives, at least one of the maxtor "format back to factory-fresh" 
> only wrote the first sector on each track or something. It finished way 
> too fast to be writing the whole drive. Unless the drive had a command 
> built in that wiped the entire track in one rotation or something, 
> rather than actually having to transfer the data from memory to the 
> drive for the whole thing.

On the Maxtor tool I have, there are two options: "low-level format 
(quick)" and "low-level format (full)". The former erases the beginning 
and end of the drive. The latter erases everything. (And takes a 
ridiculous amount of time to complete.)

Clearly I'm going to have to actually do some experiments. :-P

-- 
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*

Post a reply to this message

Jim Henderson wrote:

> First rule in data security:  Never assume any data is unrecoverable.
> 
> Second rule in data security:  Never assume nobody is watching.

Third rule in data security: There's no point in overkill. :-P

-- 
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*

Post a reply to this message

>> I see lots of talk of *boken* hard drives, but not much about
>> deliberately erased media.
> 
> They've got the equipment for that.  I used to talk with them 
> occasionally, and they did do forensic analysis for law enforcement back 
> then.  Don't know if they still do.

Forensic analysis isn't too hard if the person didn't get a change to 
destroy their data before the PC was ceased. ;-)

>>> Or use something like this: http://freshmeat.net/projects/mobiusft/
>> I can't even find any documentation explaining what this *is*...
> 
> It's a forensic data toolkit.  Used for investigating criminal activity 
> that's been stored on hard drives and then wiped/erased/whatever.  Often 
> times, you don't recover a file, but you recover data on individual 
> blocks (think like chkdsk).

Right. But if I've erased every individual block on the drive (rather 
than just, say, reinstalling Windows on it) then it won't find anything.

>>> - people have been convicted using evidence recovered from a drive
>>> without using "a microscope" (and BTW, how would that help?  The data
>>> is encoded in a magnetic field, a microscope won't see that).
>> I didn't mean a light microscope - I was actually thinking of a Magnetic
>> Force Microscope...
> 
> Well, all I know is that I know people who actually *do* this kind of 
> work on a regular basis.
> 
> Doing a DoD style wipe is generally sufficient, but as others pointed 
> out, the point from a data security standpoint is to make the cost of 
> recovery more than the value of the data when recovered.  In *most* 
> cases, a wipe is sufficient, but it really depends on how valuable the 
> data is to your competition.

1. These drives probably never contained any live data in the first 
place. ("Live data" as in data generated in our lab.)

2. Any such data they did contain is going to consist of a huge chunk of 
numbers, with little or nothing to identify what the hell they relate to.

3. Any such data will be at least 5 years old.

Really, it would be far, *far* easier to just have somebody come work 
for us and secretly spy on our activities... Much cheaper than James 
Bond data recovery techniques.

-- 
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*

Post a reply to this message

Gail Shaw wrote:
> One the subject of format, what does Low-level format actually do? 

Nowadays, it means many different things, depending on the drive.

On old floppies, you used to have to do a low-level format by writing a 
pattern of bits to the track as it spun. Basically, since floppies don't 
spin exactly the same speed all the time, you need to first write a lead 
in, then a bunch of sectors, then enough of a lead-out that you are sure 
you overwrote the lead-in without overwriting the first sector. Each 
sector consisted of a set of bits that said "here comes a sector", then 
the track and sector number and sector length, then some mungable bits 
that gave the read/write head time to switch from reading to writing, 
then bytes that said "here comes the sector data", then the bytes of the 
sector, then the flag that said "here comes the end of the sector". The 
byte pattern for "the body of the sector" when you formatted it was 
traditionally E5 (hex), which is why when you delete files on FAT (or 
CP/M) file systems, it overwrites the first byte of the directory entry 
with E5.

So that was the low-level format - taking a completely erased disk and 
writing out all the header information that said which bytes were 
included in which sectors.

(The Amiga stored more on the disks by basically rewriting the entire 
track each time the sectors were written. Just as fast, and you didn't 
need to be switching between read and write every time.)

Note that floppies are actually serial devices. So to store more than (I 
think) three or four bits of 1's or 0's in a row, you have to inject 
differences between. (So you have to encode 00001111 as 00101101, or 
something. MFM is one such common encoding.) Kind of the same reason a 
slow modem has clean tones and anything over 2400 has a "noisy" tone - 
it's doing the same sort of randomized bit stuffing. The Amiga DMA 
hardware could do that sort of stuffing without CPU intervention, so it 
wasn't a lot of overhead to rewrite an entire track when you changed one 
sector.

Nowadays, floppies come pre-low-level-formatted. I think if you put in a 
"raw" floppy (i.e., one with a file system the OS doesn't recognise), it 
will do the low-level format. Otherwise, you couldn't erase a floppy 
with a magnet and then have it work.

With a hard-drive, it used to be the same sort of thing. Some hard 
drives, however, now have one platter dedicated to nothing but 
synchronization information, basically. So all the information about bit 
timing and such is on one platter. In other words, instead of a serial 
stream, there's a parallel stream. Doing a "low level format" means 
rewriting that platter, which is much more sensitive to problems of 
rotational speed and such. In other words, they do they low-level format 
on a machine with much higher precision than the motor they put in the 
drive they sell to you, so it's very hard to recreate the patterns.

Nowadays, a "low-level format" on a hard drive means to write some 
constant pattern over all the bytes you can write to.

-- 
Darren New / San Diego, CA, USA (PST)
  Helpful housekeeping hints:
   Check your feather pillows for holes
    before putting them in the washing machine.

Post a reply to this message

Orchid XP v8 wrote:
> For me, it typically takes about 20 minutes to do a full NTFS format on 
> a large partition. (Doesn't seem to matter how big the drive is - 
> presumably because larger drives are also newer and hence faster.)

Oh, are you doing a quick format, or a full format? A "full format" 
actually does read the entire drive. Ext apparently won't do a "full 
format". You have to do a quick format, then scan the disk for errors.

>> Ext2/3 stores i-nodes all over the disk, preformatting them. This 
>> takes time when you have a couple gig of i-nodes to fill out.
> 
> For me, ext2 takes about 15 seconds or so - very much faster. Comparable 
> to an NTFS "quick format".

Try doing a "quick format" with NTFS. The difference between a 15-second 
ext format and a 20-minute NTFS format gives me the impression that your 
NTFS format is actually looking for flawed sectors to map out.

> Clearly I'm going to have to actually do some experiments. :-P

Either cipher /w:x: on Windows (or at least Windows recent enough to 
actually have that functionality) or dd if=/dev/urandom should do the 
trick.

I'll try formatting a spare partition I have here with NTFS and ext2 and 
see what I get in timings.

-- 
Darren New / San Diego, CA, USA (PST)
  Helpful housekeeping hints:
   Check your feather pillows for holes
    before putting them in the washing machine.

Post a reply to this message

Doctor John wrote:
> 
> GPG shreds files on all my machines. It can also encrypt a whole
> filesystem. What else do you need?
> 

Deniability and perfect forward secrecy?

Post a reply to this message

Doctor John wrote:
> m_a_r_c wrote:
>> good quality coke
> 
> Snort! :-D
> 
> John
> 

Yeah, why burn it when that's still an option?

Post a reply to this message

Darren New wrote:
> I'll try formatting a spare partition I have here with NTFS and ext2 and 
> see what I get in timings.

OK, on a 40 gig partition,
ntfs /q - 5 seconds
ntfs full scan - about 20 minutes. (I stopped 10% in)

ext2 - 23 seconds
ext2 -c (full scan) - about 20 minutes.

ext3 - 27 seconds.
(Note the extra 4 seconds is roughly a constant, independent of disk size.)

An ext3 format of a 750G drive at work took something like six to ten 
minutes, but I might have had other layers in there (raid or encryption 
or something) that I don't recall.  I do recall doing the equivalent of 
chkdsk /f /r on the ext3 drive went about 36 hours for the first pass, 
and then said "starting second pass" without even any indication of how 
many passes it was planning to do, so I killed it at that point. :-)

-- 
Darren New / San Diego, CA, USA (PST)
  Helpful housekeeping hints:
   Check your feather pillows for holes
    before putting them in the washing machine.

Post a reply to this message

Invisible wrote:
> As far as I know, both option #5 and option #6 make it impossible to 
> read any useful data from the drive just by plugging it in and asking 
> the drive electronics to read the data off the disk surface. In either 
> case, you would have to physically dismantle the drive and crawl over it 
> with a microscope - which is damned expensive. Using random data (and 
> multiple passes of it) reputedly makes this process harder - but not 
> impossible. Non-sequential writes are supposed to make it harder still.

The US military overwrites (with pseudorandom data) five times before a 
classified drive becomes unclassified.

I suppose a drive could be designed so that a single pass is good 
enough, but if you're in that big a hurry, thermite is your friend.

Regards,
John

Post a reply to this message