Erasing Hard Drive Data

Support, Discussion, Reviews
Post Reply
User avatar
Winnow
Super Poster!
Super Poster!
Posts: 27535
Joined: July 5, 2002, 1:56 pm
Location: A Special Place in Hell

Erasing Hard Drive Data

Post by Winnow »

I found this interesting while searching for an app that would more securely delete files when I sent them to the trash.

It looks like "Eraser 5.8" is the best option out there for erasing files and it's free:

http://www.heidi.ie/eraser/features.php

It's not needed for most things but for pr0n, personal info, etc., right clicking and selecting "erase" instead of delete", a shell extension, isn't that hard and the files are gone for good.

It can also create a nuke disk to erase an old hard drive.

From the app's help file:
Eraser is an advanced security tool, which allows you to completely remove sensitive data from your hard disk by overwriting it several times with carefully selected patterns.

You can drag and drop files and folders to the on-demand eraser, use the convenient Explorer shell extension or use the integrated scheduler to program overwriting of unused disk space or, for example, browser cache files to happen regularly, at night, during your lunch break, at weekends or whenever you like.

The patterns used for overwriting are based on Peter Gutmann's paper "Secure Deletion of Data from Magnetic and Solid-State Memory" and they are selected to effectively remove the magnetic remnants from the hard disk making it impossible to recover the data.

Other methods include the one defined in the National Industrial Security Program Operating Manual of the US Department of Defense and overwriting with pseudorandom data.

-----------------

Most people have some data that they would rather not share with others - passwords, personal information, classified documents from work, financial records, self-written poems, the list can be continued forever. (Editor's Note: Pr0n!) Perhaps you have saved some of this information on your computer where it is conveniently at your reach, but when the time comes to remove the data from your hard disk, things get a bit more complicated and maintaining your privacy is not as simple as it may have seemed at first.

Normal file deletion is insecure

Your first thought may be that when you delete a file, the data is gone. Not quite, when you delete a file, the operating system does not really remove the file from the disk; it only removes the reference of the file from the file system table. The file remains on the disk as long as another file is created over it, and even after that, it might be possible to recover data by studying the magnetic fields on the disk platter surface. Before the file is overwritten, anyone can easily retrieve it with a disk maintenance or an undelete utility.

For example, imagine that you have been surfing on the web for a while and afterwards wish to clear any traces revealing what sites you visited. You go to your browser’s preferences and select to clear the cache and the history file, the information is now gone you think to yourself - well think again. The browser cache files can easily be restored with an undelete utility and your privacy is once again compromised.

To be sure that a file is gone, its contents must be properly overwritten before deleting. As simple as it sounds, there are several problems in secure file removal, mostly caused by the construction of a hard disk and the use of data encoding. These problems have been taken into consideration when Eraser was designed and because this intuitive design you can safely and easily erase private data from your disk.

Deleted data can be easily recovered

You have most likely already insecurely deleted countless amount of files from your drive and every now and then applications create (and insecurely delete) temporary files on your drive containing some possibly sensitive data that you would rather not share with other people. This data remains on your drive until it gets overwritten and can be viewed with simple disk utility.

This is where the erasing of unused disk space comes in handy. The erasing of unused disk space means that all space available on your drive will be overwritten so that data previously saved on it cannot be restored. Eraser provides you a convenient way to erase the unused disk space regularly in order to remove the remains of temporary files and other sensitive information you possibly have had on your hard disk.

--------------
Some of the most commonly overlooked security holes are discussed below.


Paging (Swap) File

The virtual memory storage of the Windows operating system is called the paging file (or the swap file). The operating system may store any information from the memory to the disk whenever it wants. This means that the paging file may contain passwords, pieces of documents and other sensitive information.

Since the operating system locks the paging file while it is running, the file cannot be accessed using standard file operations. There are applications that claim to overwrite the paging file by allocating huge amounts of memory, but this method may freeze your computer and even then the space allocated by applications cannot be accessed and not all the available space on the paging file is necessarily overwritten.

For information on how to erase the paging file, see Erasing Paging (Swap) File.

Filenames

Unless you name your files with arbitrary names, the name of a file can reveal information about the file contents. Eraser will overwrite the filename when erasing the rest of the file.

Names of the files you have previously deleted may also still be stored in the file system table; Eraser will overwrite them when you erase unused disk space.


Locked Files

An executable file cannot be accessed when it is running, the same goes for shared dynamic link libraries and all files that are opened without file sharing allowed. The cluster tip area of these files may contain sensitive data the same way as the unused area in any other file, but it cannot be overwritten because the file is locked.

To reduce the amount of these locked files into a minimum, you should close as many applications as possible before erasing the unused disk space. Closing the applications will also free memory allowing the operating system to reduce the size of the paging file making more free space available for overwriting.

The files loaded in memory by the operating system, such as the system libraries, cannot be accessed at all while the computer is running. The cluster tip area of these files may contain sensitive information, but it is not very probable because these files are locked all the time.

Bad Sectors

When an area on the disk gets damaged for some reason, the disk electronics mark this area to contain only bad sectors. These bad sectors cannot be accessed so the data still stored in them cannot be erased either. Peter Gutmann has discussed this subject further in chapter “
Further Problems with Magnetic Media“ of his paper “Secure Deletion of Data from Magnetic and Solid-State Memory“.

----------------

You can choose from three different built-in methods, these descriptions apply to all user interfaces.


The Default Method – Gutmann

Based on Peter Gutmann’s paper “Secure Deletion of Data from Magnetic and Solid-State Memory”, this method provides the best security. Data will be written 35 times with carefully selected patterns, which makes it unrecoverable. For more thorough description, see the Advanced Topics.

This method is used as the default for overwriting files, but has been proven to be very slow when erasing unused space on a hard disk (could be several gigabytes).

A Faster Method – US DoD 5220-22.M

Two methods based on United States Department of Defense recommendation 5220-22.M from January 1995. The data will be overwritten seven times making this method significantly faster than the default, but also less secure when it comes to hardware recovery. For a more thorough description, see the Advanced Topics.

Pseudorandom Data

All passes will be random data, which is highly incompressible. Therefore, this is the only method that should be used when erasing unused space or data on a compressed drive. The number of passes is user selectable from one to 65535. For a more thorough description, see the Advanced Topics.

Being the fastest method, this one is used as default for erasing unused disk space (one pass).

Based on the descriptions above you can choose the method most suitable for your purposes. If you really do not know what you are doing, settling for the default is your best choice. You can change the used method from the Erasing Preferences window, which can be opened differently depending on the user interface. As you may notice, you can use different methods for erasing files and unused disk space. You can also define your own, custom, overwriting methods.

On-Demand and Scheduler

To change the erasing method, open the preferences window by selecting Erasing from the Edit – Preferences submenu.

Shell Extension

To change the erasing methods, open the preferences window by clicking the Options button on the confirmation dialog box.

Notice that you do not need to select the method every time, it is usually enough to set the methods once and change them only in special cases. If you want to learn more about these special cases where only specific method should be used, you should read the instructions further.
Last edited by Winnow on October 15, 2006, 7:23 pm, edited 3 times in total.
sarlen
Almost 1337
Almost 1337
Posts: 532
Joined: October 16, 2002, 1:12 am
Location: Iowa

Post by sarlen »

Where I work we from time to time are asked by the legal department to recover anything that may or may not be on a persons hard drive. I can say with 100% confidence even a format and repartition does not remove the old data. We have recovered files from machines that have been formatted, and a reinstall of the OS, the machine went back into service for 4 months then we got the word to recover from the machine and we were still able to get some data back from the previous owner, and that’s with commercially available software ( http://www.restorer2000.com/ ) I cant imagine what the feds use.

However, Multiple writes over the sector does blur the data enough that it’s hard at best to get anything out of it. This sounds like one of the better utilities out there.
Image
User avatar
Truant
Way too much time!
Way too much time!
Posts: 4440
Joined: July 4, 2002, 12:37 am
Location: Trumania
Contact:

Post by Truant »

an electromagnet works wonders. and is pretty cheap and easy to use.
User avatar
Winnow
Super Poster!
Super Poster!
Posts: 27535
Joined: July 5, 2002, 1:56 pm
Location: A Special Place in Hell

Post by Winnow »

Truant wrote:an electromagnet works wonders. and is pretty cheap and easy to use.
For an old drive yes, but not for one you want to keep using : )

I'm still not 100% sure how it all works but they way it's written, it seems like you can use the same hard drive multiple times and all of the data could be recovered...like write 400 MB on a 100MB drive and you could see it all.

If that's the case, you'd think the HD companies would take advantage of that and make HDs that used 4X's the storage on the same platter.

It looks like the best mode overwrites the same sectors 35 times. I used the 4th best mode "Pseudorandom Data", one pass, to erase the free space on my 300GB hard drive and it took a few hours just to do the ~20GB of free space. That 35 pass must take forever.

It looks like even the simplest mode when using this app will defeat the recovery apps that are commercially available because it erases the Cluster Tips.

While erasing free space takes a long time, if you use mode 3 (the three pass US DoD standard procedure), only on files that are questionable and not everything, it doesn't take too long. Just like my paper shredder...I don't shred everything, just the envelopes, and papers with personal info. If I shredded all the junk mail as well it would take forever.
User avatar
Hoarmurath
Star Farmer
Star Farmer
Posts: 477
Joined: October 16, 2002, 12:46 pm
Gender: Male
Location: Florida
Contact:

Post by Hoarmurath »

Just zero-fill the damn thing, it's not rocket science.
User avatar
Winnow
Super Poster!
Super Poster!
Posts: 27535
Joined: July 5, 2002, 1:56 pm
Location: A Special Place in Hell

Post by Winnow »

Hoarmurath wrote:Just zero-fill the damn thing, it's not rocket science.
According to the above that doesn't work. Do you have some info showing that single write, zero filling defeats any attempts to recover data?

According to the above, that wouldn't do it.

I see a note on another website saying zero filling seven times which isnt much different thatn the above methods of writing random data multiple times.
Truant wrote:an electromagnet works wonders. and is pretty cheap and easy to use.
It's a common recommendation to use a big heavy magnet to really erase a hard disk. My advice: forget it. Any magnets you're likely to have around the house, even your big speaker magnets, are unlikely to affect your hard disk in any significant way.
I guess make sure it's electro magnetic!

Or this suggestion:
I want to agree with leo it is all about how paranoid you are. If you know that you have something on there you shouldn't. Or are worried about someone finding it out. Then my advice is just get a 5 pound sledge hammer from home depot and beat the living crap out of it on the side walk.
In a recent study, a research team purchased roughly 100 hard disks off eBay and found half of them to contain sensitive information, including insurance records, biographical information about children, and even blackmailable material such as evidence of an affair.
...this will write 3 passes of random data to your hard disk, followed by a 4th pass of zeros. It takes some time, so if you don’t mind random (suspiciously random) data on the drive, you can skip the zeroing pass by omitting the z flag.

Why only three passes? It comes down to a matter of time versus diminishing returns. There are actually some non-random patterns that can be written to certain types of hard disks that ‘saturate’ the media more effectively and can be used in-between random passes to further destroy any memory that your disk had of your scandalous data.

Here’s what Peter Gutmann has to say on the subject:

In the time since this paper was published, some people have treated the 35-pass overwrite technique described in it more as a kind of voodoo incantation to banish evil spirits than the result of a technical analysis of drive encoding techniques.

If you’re using a drive which uses encoding technology X, you only need to perform the passes specific to X, and you never need to perform all 35 passes. For any modern PRML/EPRML drive, a few passes of random scrubbing is the best you can do.

As the paper says, “A good scrubbing with random data will do about as well as can be expected”. This was true in 1996, and is still true now.
So it looks like three passes of random data is the best you can do reasonably and the Eraser App I linked in the first thread does that pretty quick and easy with a shell (right click) option to erase instead of delete data so it seems to make sense to do that on just the data you deem questionable and just delete the rest normally. Of course, you'd have to use the "erase unused space" the first time to catch up on stuff you hadn't erased properly.
User avatar
Kilmoll the Sexy
Super Poster!
Super Poster!
Posts: 5295
Joined: July 3, 2002, 3:31 pm
Gender: Male
XBL Gamertag: bunkeru2k
Location: Ohio

Post by Kilmoll the Sexy »

We have used a similar tool to do secure erases on drives going back. But yes, we used to have a piece of software that would recover from formatted drives, drives that went from FAT32 to NTFS and then back to FAT 32, etc.

Hey Sarlen.....you don't happen to have a spare copy of that program that you need to have stored offsite as part of your disaster recovery plan do ya? :-)
User avatar
Aabidano
Way too much time!
Way too much time!
Posts: 4861
Joined: July 19, 2002, 2:23 pm
Gender: Male
Location: Florida

Post by Aabidano »

The real scoop if you're interested:
http://csrc.nist.gov/publications/nistp ... 8_rev1.pdf

Lots of good references at the bottom.

For demagnetizing you need a degausing table or wand, plain old magnets and electromagnets won't really do it as the field doesn't reverse properly to do the job. On multi platter disks you have to take them apart to do it, they're fairly well shielded.

Unless you use a low level erase utility there's no gaurantee that overwriting will actually get rid of all traces of whatever you're trying to get rid of. Many (most?) on the market are just there to make people feel better. They list this one:
http://cmrr.ucsd.edu/hughes/subpgset.htm

Kind of neat that on chip-based devices the longer the data stays on there the more permanent it becomes. You've basically got to destroy them or allow your overwrite to stay on there longer than the original data was to make sure it's really gone.
sarlen wrote:I cant imagine what the feds use.
These folks provide equipment and training at a level that the feds use:
http://www.vogon-international.com/
"Life is what happens while you're making plans for later."
User avatar
Winnow
Super Poster!
Super Poster!
Posts: 27535
Joined: July 5, 2002, 1:56 pm
Location: A Special Place in Hell

Post by Winnow »

I opened one of my old 250GB hard drives yesterday to take a look around. I had to drill out the screws as it was the same torx #8 screw heads that I had trouble with inside the Xbox 360.

It was interesting to see the platters stacked up and heads that read them. I ended up taking out the three platters and put the two magnets from inside on my fridge.

The platters did look kinda neat...basically just like very clear mirrors. I drilled a line across the top of one and then drilled a hole through all three platters and then took some pliers and went to town warping them.

That particular 250GB wasn't formatted before it went bad so I suppose the NSA could still get some data off it if I was worth the effort. If they look hard, they might find some gossip on EQers back in the day from chat logs!

It was kind of a pain in the ass to open so I suppose using a hammer to smash the drive would work well. Anything that bends the platters will make it much harder to recover data.
User avatar
cid
Way too much time!
Way too much time!
Posts: 1098
Joined: August 28, 2002, 10:17 pm
Location: Lost in my avatar
Contact:

Post by cid »

BitLocker in Vista will fix all your data encryption needs. Vista will break everything else tho :)
User avatar
Boogahz
Super Poster!
Super Poster!
Posts: 9438
Joined: July 6, 2002, 2:00 pm
Gender: Male
XBL Gamertag: corin12
PSN ID: boog144
Location: Austin, TX
Contact:

Post by Boogahz »

Or you could just try this!

http://www.youtube.com/watch?v=oOIf0JmZfrQ
Post Reply