disk shredder

[Paddy]

I think I understand:

In conventional terms, when a one is written to disk the media records a one, and when a zero is written the media records a zero. However the actual effect is closer to obtaining a 0.95 when a zero is overwritten with a one, and a 1.05 when a one is overwritten with a one. Normal disk circuitry is set up so that both these values are read as ones, but using specialised circuitry it is possible to work out what previous "layers" contained. The recovery of at least one or two layers of overwritten data isn't too hard to perform by reading the signal from the analog head electronics with a high-quality digital sampling oscilloscope, downloading the sampled waveform to a PC, and analysing it in software to recover the previously recorded signal. What the software does is generate an "ideal" read signal and subtract it from what was actually read, leaving as the difference the remnant of the previous signal. Since the analog circuitry in a commercial hard drive is nowhere near the quality of the circuitry in the oscilloscope used to sample the signal, the ability exists to recover a lot of extra information which isn't exploited by the hard drive electronics (although with newer channel coding techniques such as PRML (explained further on) which require extensive amounts of signal processing, the use of simple tools such as an oscilloscope to directly recover the data is no longer possible).

[Helevitia]

Originally posted by Paddy
From Wombat's link:

haha, well there's the safe answer

[Paddy]

indeed!

[Wombat]

Originally posted by Paddy
I can understand the if you simply zero the 'TOC', then all the data will still be on the disk. But if you overwrite the entire disk then how can this be undone? I take it that there is no 'memory effect'?

Just curious!

There is indeed a memory effect. Also, data is written in tracks, but if you know how to interface with (or in some cases rewrite) the controller software, you can move the heads out of the track, and read the margins. Also, data isn't just a 0 or 1, you can often reconstruct partial or overwritten values.

[bibble]

Blimey.....

I think the data in question is not top secret. Basically a friend of mines parent wants his computer back but as parents go does not have her best interests at heart (he's not very nice basically). So she asked me to wipe it - he works in IT so will have access to data recovery tools and her idea was to stop him recoverying her mail and pictures.

I think the smash the disks with a hammer/grinding disk/furnace option is out as she wants to return the computer working - it would be too much hassle not to.

I dont have access to gdisk; the linux eraser - does it need linux installed? edit - just rtfm'd the page and will have a go later

[degrub]

a little more expensive, but....how about buying a replacement, repaired drive for cheap and installing it. THen she gets to keep her stuff. She can always add it to another box.

[Paddy]

Cheers Wombat for the explanation!

[bibble]

I used the gpl eraser after deleting anything identifiable - defragged and upon doing a recovery it comes up with a load of files with no location size and a date of 1991. Should this still show?

[rugger]

Seriously, I'd just zero wipe the drive and leave it at that.

Sure, the data might still be retievable using extremely exotic methods, but it is also horrendously expensive. I'd start at 6 figures and work your way up. Also, data is packed so densely on a modern hard drive that it pretty much a crapshot as to whether is possible or not.

[bibble]

ok ill stop worrying then