> -----Original Message----- > From: tclug-list-bounces at mn-linux.org > [mailto:tclug-list-bounces at mn-linux.org]On Behalf Of Tony Yarusso > Sent: Friday, October 01, 2010 1:18 AM > To: TCLUG Mailing List > Subject: Re: [tclug-list] Hidden hard drive partitions > > > On Thu, Sep 30, 2010 at 9:04 AM, Jeremy <jeremy at lizakowski.com> wrote: > > There is also the issue of incomplete erasures. Even if you could > > wipe every sector, a slight ghost image remains. That's why many > > tools offer to rewrite each sector multiple times. But even that > > assumes it can move over the magnetic media in exactly the same > > position - physical media will always be impefect. > > This used to be a major issue, but with modern drives the bit density > is so high that all available evidence supports a single-pass > overwrite being sufficient to completely obscure data from any > possible recovery. So unless you're still using a drive from 1988 or > something, don't worry about it. > > - Tony Mostly true, but residual waveforms still exist, and a full forensic recovery would read waveforms from special heads and do a scientific version of PRML data recovery (adjacent bits interact and alter waveforms in predictable ways). That's more tedious than most can imagine, but pretty effective. Requires clean rooms and research quality lab equipment that is rare even within drive manufacturer's facilities. Expensive enough and difficult enough so it's something only the really bad guys need to worry about :-) Chuck