4 ms·

The file is still there. A regular delete just tells the disk that the segments of memory are available to be overwritten. Zeroing out (or /dev/urandom) the m

by desine 6y ago

The file is still there. A regular delete just tells the disk that the segments of memory are available to be overwritten. Zeroing out (or /dev/urandom) the memory is an option, but even that is not 100% safe, especially when it comes to forensic labs with the ability to read and analyze platters removed from a complete, sealed disk. Really safe deleters will overwrite the segments of memory multiple times to scramble magnetic signatures

noir_lord 6y ago
The world has moved on. You can’t transplant a platter into another reader, the old days of Guttman method don’t really apply anymore, density is so high that outside of research settings it’s just not practical. That said I still put a drill through mine before disposing of them, because close to zero isn’t zero.
- XorNot 6y ago
  The reality though is we have no idea what's possible here: we just know what's not commercially viable to offer as a service. HDD recovery research is almost certainly a well-funded area of intelligence services, so I imagine their are a few electron microscopes and STMs which can do it. There's certainly no military data destruction guide which doesn't start with "shred the platter to this grain size".
- layoutIfNeeded 6y ago
  >You can’t transplant a platter into another reader Then why do I get tons of results on YouTube of people doing exactly that, when searching for “HDD transplant”?
  - Judgmentality 6y ago
    I typed it into YouTube and every result (of the first dozen or so) is years old, including the most recent video citing an example where it's impossible. https://www.youtube.com/watch?v=bml8ovt4nfI https://www.youtube.com/watch?v=bml8ovt4nfI
    - Godel_unicode 6y ago
      From 2020 (it's about drive savers): https://youtu.be/v0QkafslnrM https://youtu.be/v0QkafslnrM https://drivesaversdatarecovery.com/data-recovery-services/devices-supported/ https://drivesaversdatarecovery.com/data-recovery-services/d...
      - Judgmentality 6y ago
        I wonder if they can recover the HD the other video says is impossible.
        gruez 6y ago
        If you actually watched the video that you've linked, you'll see that the platters in the drive has shattered. That's completely different from your initial claim of "You can’t transplant a (unshattered] platter into another reader"
        Judgmentality 6y ago
        ...in that case, can't you just shatter an HD platter to make it unrecoverable? If the goal is to prevent discovery, that seems pretty trivial. It's really unclear to me whether or not HDs are recoverable from the comments I'm seeing, and honestly I don't care that much so I'm going to stop commenting.
        gruez 6y ago
        > ...in that case, can't you just shatter an HD platter to make it unrecoverable? If the goal is to prevent discovery, that seems pretty trivial. ...only if the platters are glass. Many (most?) are made of metal. >It's really unclear to me whether or not HDs are recoverable from the comments I'm seeing, and honestly I don't care that much so I'm going to stop commenting. The same video also mentions him being able to salvage a hard drive that was in a multi-vehicle accident, because the platters haven't been shattered.
- Godel_unicode 6y ago
  It really hasn't, though. There are tons of data recovery services which will, for a fee, recover data from damaged hard drives. The process for recovering data forensically can be quite similar, depending on what the person did to "delete" it. https://www.ontrack.com/en-us/data-recovery/hard-drive https://www.ontrack.com/en-us/data-recovery/hard-drive https://www.gillware.com/hard-drive-data-recovery/scratched-platter-data-recovery/ https://www.gillware.com/hard-drive-data-recovery/scratched-...
- gruez 6y ago
  A drill is pointless because it only damages a tiny part of the platter. That might deter commercial recovery companies, but probably not the feds (depending on how big of a target you have on your back).
  - noir_lord 6y ago
    Not when it shatters the glass/ceramic platters and shards fall out (which is nearly every drive I've put a drill through for the last while). Note: I do overwrite the drives (DBAN) then drill them and these are going to recycling anyway - it's quantifying the risk - I drill the drives because they usually have had customer or client data on them at some point so it's just good practice.
- dogma1138 6y ago
  I’ve done this a few months ago on a 6TB drive. You remove the cover, unscrew the platter, use sticky tape on the sides of the platters to remove them and place them in the donor drive... With an identical drive you don’t even need to worry about anything else the data will be there as nothing has happened. The “new” drive just worked it still does... Unless the plates are completely shattered you can recover the data. And I can guarantee you that the FBI has a data recovery lab that is much better than what I can do at home.
astrange 6y ago
> but even that is not 100% safe, especially when it comes to forensic labs with the ability to read and analyze platters removed from a complete, sealed disk. No, this is completely impossible and noone has ever done it. (An exception would be HDDs with bad block mapping because they might not actually erase some sector.) SSDs don't even have platters and you could probably recover things from the flash, but you can avoid this with disk encryption by simply losing the keys. > Really safe deleters will overwrite the segments of memory multiple times to scramble magnetic signatures Deletion programs do this because it looks cool. It's not necessary - literally noone has ever recovered anything from a zeroed out HD sector.
- desine 6y ago
  >No, this is completely impossible and noone has ever done it. Pedantic devil's advocate - nobody has claimed to do it. When dealing with international espionage and possibly the DoD or DHS examining the drive, I wouldn't bet on that assumption.
  - astrange 6y ago
    We do know that stuff too, there were HD firmware implants and such in the Snowden leaks and there wasn't anything about recovering things from a zeroed hard drive. I believe the government outsources to the same data recovery firms as everyone else; they can get things off drives with dead electronics or platters that haven't actually been erased, but that's it.
- Frost1x 6y ago
  >Deletion programs do this because it looks cool. It's not necessary - literally noone has ever recovered anything from a zeroed out HD sector. anything of value From what I recall, with an electron microscope you can detect polarity around the edges of bits for certain magnetic storage devices and I recall seeing a paper where this was stepped through a several bits were recovered with fairly good success rates. This is part of the reason behind the old rationale of overwriting multiple passes. With that said, given current data density for anything useful, reassembling anything remotely useful from such an approach would be nearly impossible and take a huge amount of time. With NAND based storage, none of this applies or at least has entirely different context to consider. Edit, was curious, here's a reference you could follow to the actual paper for empirical backup: https://www.sans.org/blog/overwriting-hard-drive-data/ https://www.sans.org/blog/overwriting-hard-drive-data/
notadev 6y ago
They probably copied the drive way before she ever realized she was under surveillance.

by desine 6y ago

noir_lord 6y ago

The world has moved on. You can’t transplant a platter into another reader, the old days of Guttman method don’t really apply anymore, density is so high that outside of research settings it’s just not practical. That said I still put a drill through mine before disposing of them, because close to zero isn’t zero.

XorNot 6y ago
The reality though is we have no idea what's possible here: we just know what's not commercially viable to offer as a service. HDD recovery research is almost certainly a well-funded area of intelligence services, so I imagine their are a few electron microscopes and STMs which can do it. There's certainly no military data destruction guide which doesn't start with "shred the platter to this grain size".
layoutIfNeeded 6y ago
>You can’t transplant a platter into another reader Then why do I get tons of results on YouTube of people doing exactly that, when searching for “HDD transplant”?
- Judgmentality 6y ago
  I typed it into YouTube and every result (of the first dozen or so) is years old, including the most recent video citing an example where it's impossible. https://www.youtube.com/watch?v=bml8ovt4nfI https://www.youtube.com/watch?v=bml8ovt4nfI
  - Godel_unicode 6y ago
    From 2020 (it's about drive savers): https://youtu.be/v0QkafslnrM https://youtu.be/v0QkafslnrM https://drivesaversdatarecovery.com/data-recovery-services/devices-supported/ https://drivesaversdatarecovery.com/data-recovery-services/d...
    - Judgmentality 6y ago
      I wonder if they can recover the HD the other video says is impossible.
      - gruez 6y ago
        If you actually watched the video that you've linked, you'll see that the platters in the drive has shattered. That's completely different from your initial claim of "You can’t transplant a (unshattered] platter into another reader"
        Judgmentality 6y ago
        ...in that case, can't you just shatter an HD platter to make it unrecoverable? If the goal is to prevent discovery, that seems pretty trivial. It's really unclear to me whether or not HDs are recoverable from the comments I'm seeing, and honestly I don't care that much so I'm going to stop commenting.
        gruez 6y ago
        > ...in that case, can't you just shatter an HD platter to make it unrecoverable? If the goal is to prevent discovery, that seems pretty trivial. ...only if the platters are glass. Many (most?) are made of metal. >It's really unclear to me whether or not HDs are recoverable from the comments I'm seeing, and honestly I don't care that much so I'm going to stop commenting. The same video also mentions him being able to salvage a hard drive that was in a multi-vehicle accident, because the platters haven't been shattered.
Godel_unicode 6y ago
It really hasn't, though. There are tons of data recovery services which will, for a fee, recover data from damaged hard drives. The process for recovering data forensically can be quite similar, depending on what the person did to "delete" it. https://www.ontrack.com/en-us/data-recovery/hard-drive https://www.ontrack.com/en-us/data-recovery/hard-drive https://www.gillware.com/hard-drive-data-recovery/scratched-platter-data-recovery/ https://www.gillware.com/hard-drive-data-recovery/scratched-...
gruez 6y ago
A drill is pointless because it only damages a tiny part of the platter. That might deter commercial recovery companies, but probably not the feds (depending on how big of a target you have on your back).
- noir_lord 6y ago
  Not when it shatters the glass/ceramic platters and shards fall out (which is nearly every drive I've put a drill through for the last while). Note: I do overwrite the drives (DBAN) then drill them and these are going to recycling anyway - it's quantifying the risk - I drill the drives because they usually have had customer or client data on them at some point so it's just good practice.
dogma1138 6y ago
I’ve done this a few months ago on a 6TB drive. You remove the cover, unscrew the platter, use sticky tape on the sides of the platters to remove them and place them in the donor drive... With an identical drive you don’t even need to worry about anything else the data will be there as nothing has happened. The “new” drive just worked it still does... Unless the plates are completely shattered you can recover the data. And I can guarantee you that the FBI has a data recovery lab that is much better than what I can do at home.

astrange 6y ago

> but even that is not 100% safe, especially when it comes to forensic labs with the ability to read and analyze platters removed from a complete, sealed disk. No, this is completely impossible and noone has ever done it. (An exception would be HDDs with bad block mapping because they might not actually erase some sector.) SSDs don't even have platters and you could probably recover things from the flash, but you can avoid this with disk encryption by simply losing the keys. > Really safe deleters will overwrite the segments of memory multiple times to scramble magnetic signatures Deletion programs do this because it looks cool. It's not necessary - literally noone has ever recovered anything from a zeroed out HD sector.

desine 6y ago
>No, this is completely impossible and noone has ever done it. Pedantic devil's advocate - nobody has claimed to do it. When dealing with international espionage and possibly the DoD or DHS examining the drive, I wouldn't bet on that assumption.
- astrange 6y ago
  We do know that stuff too, there were HD firmware implants and such in the Snowden leaks and there wasn't anything about recovering things from a zeroed hard drive. I believe the government outsources to the same data recovery firms as everyone else; they can get things off drives with dead electronics or platters that haven't actually been erased, but that's it.
Frost1x 6y ago
>Deletion programs do this because it looks cool. It's not necessary - literally noone has ever recovered anything from a zeroed out HD sector. anything of value From what I recall, with an electron microscope you can detect polarity around the edges of bits for certain magnetic storage devices and I recall seeing a paper where this was stepped through a several bits were recovered with fairly good success rates. This is part of the reason behind the old rationale of overwriting multiple passes. With that said, given current data density for anything useful, reassembling anything remotely useful from such an approach would be nearly impossible and take a huge amount of time. With NAND based storage, none of this applies or at least has entirely different context to consider. Edit, was curious, here's a reference you could follow to the actual paper for empirical backup: https://www.sans.org/blog/overwriting-hard-drive-data/ https://www.sans.org/blog/overwriting-hard-drive-data/

notadev 6y ago

They probably copied the drive way before she ever realized she was under surveillance.