On Thu, 14 Nov 2002, Matt Thoren wrote:

> I was wondering about this subject after the local news station here got 
> hold of a few used state government machines.

This is the basis for the project I'm doing, finding out if our method is
good enough.  We use a closed source program for wiping the data off, I
don't know exactly how it works.  So far I've found that it works pretty
good, but there's room for improvement.

> Couldn't you achieve the same thing if:
> 1. use fdisk and repartion the drive into  1 or more partitions.

Most software can recover data from this method.  In fact, I think this is
the method the state is currently using. There's a HOWTO on recovering an
fdisk'd partition with linux, using a couple fs snooping tools you can
easily refind the partitions and recover the complete file system.

> 2. create a large file(2MB+ size determined by memory and disk 
> geometry?) with a null characters repeated as contents for the file.

dd if=/dev/zero of=/dev/hda seems to be fairly effective.  Usually one
pass with 0s makes the drive immune to software recovery.

> Wouldn't this overwrite everything on the disk?  Where else could the 
> old data be hiding?

That's what I don't know.  Somehow data slips through occasionally even
after a wipe from /dev/zero.  Doing a quick wipe using the wipe utility
for *nix seems to be more effective (slower) than /dev/zero, and as far as
I can tell data is unrecoverable by software.

DoD/NSA claim that if you write 7 layers of random bits on the disk, even
they can't recover it using MRI type tools (probably far superior to what
Ontrack uses).  Peter Gutmann claims that it's still recoverable at that
point.  He has a well written paper on how certain bit patterns make
different magnetic signatures that mask better than others.  Wipe for *nix
uses 19 of his patterns and 16 random ones, making a total of 35 passes of
random bits.  While that should be sufficient, even Peter feels that it
may not be enough.

What I'd like to do is to run wipe on a disk and send it to Ontrack to see
if they can recover it.  Unfortunately there's a huge cost to that, but
then I'd know for sure that 35 passes of random bits is truly good enough.

-Brian