Hacker News new | ask | show | jobs
by Gordonjcp 1110 days ago
Okay, but a single pass of /dev/zero will destroy all the data beyond hope of recovery.
10 comments

For that to work you have to trust the firmware. Overwriting with something random, saving what was fed and then cross-referencing that against the storage could work better, but there's still some non-zero chance that something you're looking for is in a buffer, unreachable part of the disk or the like.

Encrypting the hard drive and then removing the key has a better chance of rendering the data unusable.

But you can't see from the outside if the drive was wiped. How can I be sure that I do not mix up the to-be-wiped and the wiped drives with 99.999% accuracy? That I did not unplug the drive before the whipping was finished? It's much easier with physical destruction.
This is about the only valid objection in all the replies to my post.

You're bang on - you might not know it's been wiped.

99.9999% of people will never need to care about it that much.

/dev/urandom is far better option. One problem is that writing a full drive of data can take long time vs chucking it into shredder. For example this[1] 22TB drive can do 260MB/s, meaning that doing one full disk write pass would take almost 24h.

[1] https://nascompares.com/2022/09/12/wd-red-pro-22tb-hard-driv...

What makes it far better? When overwriting a full drive they are about the same.
In the olden days hard disks wrote data on spinning platters the size of dinner plates with heads the size of Sharpie markers, and the controllers were a Z80 microprocessor on a card with a few kB of ROM and maybe as much as 16kB of RAM.

Everything past those days though, the data is very thoroughly scrambled for spectral whitening before being written to disk so there's no practical difference between /dev/urandom and /dev/zero.

For an actual HDD, maybe that would work. For any solid state drive, it would definitely not work. SSDs and similar spread writes across pools of blocks for 'endurance', so a 1TB drive might actually have 2TB worth of flash on it.
Flash drives have secure erase for that reason, but writing zeroes would most likely trigger TRIM so most data would be out. Still, only most

>so a 1TB drive might actually have 2TB worth of flash on it.

That's overly optimistic

With ssds you only have to wipe the internal encryption key.
> For an actual HDD, maybe that would work.

It doesn't work as well as you'd think on spinning platters, either. Although it does increase the amount of effort needed to read the data on them.

Why do you think it doesn't work as well as you'd think?
A read/write head does not follow precisely the same path every time. It has a positioning error that makes subsequent reads/writes take place slightly offset from earlier ones.

With the proper equipment and expertise (and helped out by the error correction mechanisms), you can recover a substantial amount of data that has been "overwritten" on an existing track.

This is why "data shredding" applications erase the old data by overwriting it with random data multiple times. That increases the chances that one of those writes will also write over any older data that was shifted slightly to the side.

But that's no guarantee. This problem is why organizations that need an extreme level of security require the complete physical destruction of the platters when decommissioning.

That's theoretical only. Nobody has ever demonstrated that since the theory started and now hdd complexity and density has increased dramatically.
I had to check with some experts on this that I know, to make sure that I wasn't talking nonsense.

I wasn't, exactly, but I also wasn't correct in the modern day. Retrieving erased information from hard drives like this was certainly a thing (a thing that I myself have seen done, so I know first-hand).

However, after hard drives moved beyond MFM it stopped really being possible.

So what I was saying isn't wrong, exactly, but certainly isn't relevant to today's hardware.

Okay, but how can you determine what the old value was, given that it's now a random value multiplied by a random value with yet another random value added on top?

Hard disks don't record zeros and ones...

> but how can you determine what the old value was, given that it's now a random value multiplied by a random value with yet another random value added on top?

It's an extremely difficult problem, and in the best case you won't get a complete copy of old data. That's why this isn't an avenue of attack that you're likely to ever encounter.

This is the sort of thing that would only be considered by very wealthy attackers (governments and corporations), and even then only if they're very certain that the drive contains data of unusually high value.

But it is possible, and has been done, to extract useful data that has been overwritten a single time with zeros.

It wont touch G-List (growing list of weak/defective sectors https://forum.hddguru.com/viewtopic.php?f=1&t=41352) nor HPA (https://en.wikipedia.org/wiki/Host_protected_area).

While the second one relies on active attack hiding data for exfiltration, first poses statistically possible scenario where a sector containing sensitive data like password or part of mbox with "We are operating a fucking unlicensed securities exchange in the USA bro" becomes weak read (still fully completed, but slow) and gets remapped. Anyone with PC-3000 can recover this data.

Only if you're sure 1 -> 0 is not detectably different from 0 -> 0.

There's almost certainly secure ways to delete. But not worth it for a five year old drive that may have had sensitive information on it.

How could they possibly be detectably different?

If you're saving stuff on old MFM drives today, you're probably not in the demographic that cares about wiping drives for disposal.

Not true at all. It’s ultimately very complex and device specific, which is why destruction is recommended.
There hasn't been a single public demonstration of this on a hard drive made after the 90s, nor any credible reports of private ones. So I wonder what your assertion is based on.
Perhaps one difference is verifiability, and the risk of being mistaken.
Will it though? What if you had some bad sectors which became unwriteable and now contain sensitive data forever?
They won't be readable either, if they're that bad.
Even if not all bits can be error corrected successfully, surely there's enough correct bits remaining to recover some secrets.

A 512-byte sector with 100 bytes stuck is "unreadable", but I wouldn't want my secrets to be read out in some raw mode from the 412 good bytes.

Falsehoods like this spreading through populations that consider themselves technically literate is one reason the NIST standard requires absolute destruction.

There are methods available that will allow recovery of second, third or even fourth generation data to be recovered from magnetic disks. Writing /dev/zero "over" an SSD won't necessarily accomplish what you expect either.

No, there isn't.

The data is *gone*.

There is no way to recover it. If you know anything about how hard disks work, you'll see why.

There's this theoretical idea that you can get a kind of "latent image" of a mark or a space on the platter even if it's been overwritten, but hard disks haven't written things as literal north-to-south or south-to-north flips for 30 years or so. The data is written as changes of level and phase in a signal, and it's thoroughly scrambled to reduce the chances of a long run of patterns of all zeroes or all ones making the signal hard to recover.

Essentially, you'd be taking a list of floating point numbers, multiplying them all by another much smaller floating point number, adding on another floating point number, and trying to imagine what the original was.

It's not possible.

No, the NSA does not have a big magic machine that does it.

No one has ever demonstrated those purely theoretical methods even on an ancient very low density drive, or even a floppy drive.