Feasibility Of Recovering Overwritten Data From Hard Drives.

In the last few years, I've read several papers on the subject of recovering overwritten data from hard disk platters including those by Dr. Peter Guttman, who first proposed an algorithm using 35 overwrite passes of specially designed patterns, designed in such as way to make the possibility of data recovery from drives using common encoding schemes (MFM and various flavors of RLL) statistically negligible. The storage density today is much higher, and I've never seen any evidence of this actually having been done successfully, either in a real forensic investigation, or in academics until recently.

Everything that I've read suggests that yes, it is theoretically possible to do so even after numerous overwrites of various patterns(recover previously written data) but the probability is very low. Under certain conditions a single bit can be recovered with a certainty somewhat close to 1.0, but this deteriorates quicky to being less certain than a coin toss even before you consider recovering an entire byte (which would amount to a single ASCII character). Recovering large amounts of data simply isn't possible, even for an attacker with unlimited financial capability that knows what was previously written to the disk (in which case, recovery would be unnecessary it seems)

I've attached the table from the paper: Wright, Kleiman, et al. 2008. Overwriting Hard Drive Data: The Great Wiping
Controversy.

Deleting files or formatting your hard drive doesn't remove data. The only way to remove data from a hard disk platter is to write new data to the same sector. This should be common knowledge, but lots of company secrets are leaked this way.

 

I've actually worked with magnetic core memory. The beauty of it was being able to restart in almost exactly the spot the system was running at before a power failure. But it had flaws. One was that since it was magnetic, it could be polluted by a strong magnetic field. Even running a drill near a memory console could screw things up. The other was that it was not exactly compact.

As magnetic drum gave way to magnetic disk, a common issue carried forth. That being latent data shadows. Simply disabling a file name didn't actually remove data. It just removed the markers that made the data valid. Then new markers came along for new data. The spaces in between were ignored by the mechanical aspects of the rotating magnetic disk/drum. Sooooo, if one really wanted, the magnetic media could be mass-dumped and then interpreted sequentially or by algorithm. This would reveal previously deleted data mixed with current crap.

The best plan is to simply toss the drive into the ocean. Or fill it with holes.

 

physical destruction of drive is a good measure but of course the drive cant be reused ...

different file systems keep track of files differently but most of them use something similar to a linked list of logical blocks. in ext file systems, the filesystem keeps a table of inodes that store the pointer to the head of the list. This allows fast lookup. deleting a file is basically like erasing the pointer to the head of the list, and modifying the metadata so that the file is no longer reachable to the file system which considers all blocks previously used by that file as free blocks. if you were to say, read every single block on disk you could eventually find all of the files (and fragments of files). it wouldnt be fast, but definitely feasible because most of the data hasnt actually been overwritten.

one thing that could prevent overwriting data is the fact that bad sectors are remapped by the disk controller, meaning once this has happened that sector can never be read from nor written to ever again so could not be overwritten. of course it still physicslly exists on disk, and some of the data in that sector could be actually be clean.

 

Quote from GJS....."The best plan is to simply toss the drive into the ocean. Or fill it with holes. "

Are we really going to start tossing these things into the oceans? I hope not....What is the plan of action for disposing of them? I still have my old ones here.....can they burned to melt or something....or set in a bucket of ocean water to ruin them?....and then we are just going to fill more of earth with these disposed things?

 

They can be incinerated. Microwave would probably be pretty effective as well due to the induced magnetic fields (so long as you remove the platters from the metal enclosure which would act as a faraday cage). Heating metals to the curie temperature destabilizes their magnetic field, effectively destroying any information stored on the platter. Shredding is often done in corporate environments, but I imagine that this may be less effective than an overwrite procedure since this just makes small pieces out of the disk platter. The density of modern drives is so high that even a small piece could contain a lot of data. An attacker could then use magnetic force microscopy to attempt to recover the data (this might be trivial if the data had not been overwritten at all due to the assumption that shredding was a sufficient measure on its own).

Everything I've read suggests that overwriting data will thwart any effort to recover previously written data. So, reuse them or send them for recycling. Drives that once stored highly classified information may need to be physically destroyed by incineration and or pulverization/shredding or exposed to a strong external magnetic field (degaussing) due to the possibility of latent data in bad sectors (which can't be read/written from with software since the drive controller doesn't make them visible externally). Degaussing will render the driver inoperable however, since low level track/sector positioning data will be destroyed as well.

Drives should be designed with a secure erase procedure as part of the disk controller firmware. Possibly the reason that this isn't implemented is probably due to the fact that verification that a sector has been overwritten successfully (by a readback of the written sector) would be impossible in the case of a bad sector (since it can't be read/written successfully from by the drives read/write heads).

It doesn't appear to make much difference in what pattern of overwrite is used, due to stochastic processes that skew prediction in unpredictable ways (things that were not considered in the papers by Dr. Gutmann, who was much more optimistic).

Failed drives should be physically destroyed, since obviously they can't be overwritten. Drilling holes through the drive platter will thwart the efforts of all but the most determined adversaries.

It might be worth mentioning that the number of bad sectors on a disk (even one with many bad sectors) pales in comparison to the total number of sectors by many orders of magnitude.