9 ms·

Defense in depth is the reason.

by ReactiveJelly 3y ago

Gordonjcp 3y ago
Okay, but a single pass of /dev/zero will destroy all the data beyond hope of recovery.
- CoastalCoder 3y ago
  Perhaps one difference is verifiability, and the risk of being mistaken.
- netrus 3y ago
  But you can't see from the outside if the drive was wiped. How can I be sure that I do not mix up the to-be-wiped and the wiped drives with 99.999% accuracy? That I did not unplug the drive before the whipping was finished? It's much easier with physical destruction.
  - Gordonjcp 3y ago
    This is about the only valid objection in all the replies to my post. You're bang on - you might not know it's been wiped. 99.9999% of people will never need to care about it that much.
- d33 3y ago
  For that to work you have to trust the firmware. Overwriting with something random, saving what was fed and then cross-referencing that against the storage could work better, but there's still some non-zero chance that something you're looking for is in a buffer, unreachable part of the disk or the like. Encrypting the hard drive and then removing the key has a better chance of rendering the data unusable.
- treis 3y ago
  Only if you're sure 1 -> 0 is not detectably different from 0 -> 0. There's almost certainly secure ways to delete. But not worth it for a five year old drive that may have had sensitive information on it.
  - Gordonjcp 3y ago
    How could they possibly be detectably different? If you're saving stuff on old MFM drives today, you're probably not in the demographic that cares about wiping drives for disposal.
- linuxftw 3y ago
  For an actual HDD, maybe that would work. For any solid state drive, it would definitely not work. SSDs and similar spread writes across pools of blocks for 'endurance', so a 1TB drive might actually have 2TB worth of flash on it.
  - willcipriano 3y ago
    With ssds you only have to wipe the internal encryption key.
    - upofadown 3y ago
      ... and hope that the manufacturer has not managed to let that key leak to some other part of the drive... Since there is no commercial advantage to doing things right in this case, there is no reason to assume that they are actually done right.
  - ilyt 3y ago
    Flash drives have secure erase for that reason, but writing zeroes would most likely trigger TRIM so most data would be out. Still, only most >so a 1TB drive might actually have 2TB worth of flash on it. That's overly optimistic
  - JohnFen 3y ago
    > For an actual HDD, maybe that would work. It doesn't work as well as you'd think on spinning platters, either. Although it does increase the amount of effort needed to read the data on them.
    - Gordonjcp 3y ago
      Why do you think it doesn't work as well as you'd think?
      - JohnFen 3y ago
        A read/write head does not follow precisely the same path every time. It has a positioning error that makes subsequent reads/writes take place slightly offset from earlier ones. With the proper equipment and expertise (and helped out by the error correction mechanisms), you can recover a substantial amount of data that has been "overwritten" on an existing track. This is why "data shredding" applications erase the old data by overwriting it with random data multiple times. That increases the chances that one of those writes will also write over any older data that was shifted slightly to the side. But that's no guarantee. This problem is why organizations that need an extreme level of security require the complete physical destruction of the platters when decommissioning.
- zokier 3y ago
  /dev/urandom is far better option. One problem is that writing a full drive of data can take long time vs chucking it into shredder. For example this[1] 22TB drive can do 260MB/s, meaning that doing one full disk write pass would take almost 24h. [1] https://nascompares.com/2022/09/12/wd-red-pro-22tb-hard-drive-review-wd221kfgx/ https://nascompares.com/2022/09/12/wd-red-pro-22tb-hard-driv...
  - Gordonjcp 3y ago
    In the olden days hard disks wrote data on spinning platters the size of dinner plates with heads the size of Sharpie markers, and the controllers were a Z80 microprocessor on a card with a few kB of ROM and maybe as much as 16kB of RAM. Everything past those days though, the data is very thoroughly scrambled for spectral whitening before being written to disk so there's no practical difference between /dev/urandom and /dev/zero.
  - charcircuit 3y ago
    What makes it far better? When overwriting a full drive they are about the same.
    - pessimizer 3y ago
      Intuitively because if you're just writing zero bytes everywhere, and there's a lab that can detect the difference between a zero that used to be a one and a zero that was always a zero, they can get the entire drive. When I get a drive, I LUKS encrypt it and fill it with zeros before throwing a filesystem on it, which results in the drive looking entirely like random nothing. The privacy test that it definitely fails is that disks don't ever look like that unless they're encrypted, but I'm not worried about anybody finding old drives.
      - Bedon292 3y ago
        My current understanding is that it is no longer possible to detect those differences on modern drives. I believe it has come down to density. Where it was possible when density was much lower, and you could detect some residual information from the wide tracks. But things are so dense now those residuals aren't physically possible.
- manicdee 3y ago
  Falsehoods like this spreading through populations that consider themselves technically literate is one reason the NIST standard requires absolute destruction. There are methods available that will allow recovery of second, third or even fourth generation data to be recovered from magnetic disks. Writing /dev/zero "over" an SSD won't necessarily accomplish what you expect either.
  - rasz 3y ago
    No one has ever demonstrated those purely theoretical methods even on an ancient very low density drive, or even a floppy drive.
  - Gordonjcp 3y ago
    No, there isn't. The data is *gone*. There is no way to recover it. If you know anything about how hard disks work, you'll see why. There's this theoretical idea that you can get a kind of "latent image" of a mark or a space on the platter even if it's been overwritten, but hard disks haven't written things as literal north-to-south or south-to-north flips for 30 years or so. The data is written as changes of level and phase in a signal, and it's thoroughly scrambled to reduce the chances of a long run of patterns of all zeroes or all ones making the signal hard to recover. Essentially, you'd be taking a list of floating point numbers, multiplying them all by another much smaller floating point number, adding on another floating point number, and trying to imagine what the original was. It's not possible. No, the NSA does not have a big magic machine that does it.
- SkyPuncher 3y ago
  Not true at all. It’s ultimately very complex and device specific, which is why destruction is recommended.
  - rcxdude 3y ago
    There hasn't been a single public demonstration of this on a hard drive made after the 90s, nor any credible reports of private ones. So I wonder what your assertion is based on.
- rasz 3y ago
  It wont touch G-List (growing list of weak/defective sectors https://forum.hddguru.com/viewtopic.php?f=1&t=41352 https://forum.hddguru.com/viewtopic.php?f=1&t=41352) nor HPA (https://en.wikipedia.org/wiki/Host_protected_area https://en.wikipedia.org/wiki/Host_protected_area). While the second one relies on active attack hiding data for exfiltration, first poses statistically possible scenario where a sector containing sensitive data like password or part of mbox with "We are operating a fucking unlicensed securities exchange in the USA bro" becomes weak read (still fully completed, but slow) and gets remapped. Anyone with PC-3000 can recover this data.
- rhn_mk1 3y ago
  Will it though? What if you had some bad sectors which became unwriteable and now contain sensitive data forever?
  - Gordonjcp 3y ago
    They won't be readable either, if they're that bad.
    - rhn_mk1 3y ago
      Even if not all bits can be error corrected successfully, surely there's enough correct bits remaining to recover some secrets. A 512-byte sector with 100 bytes stuck is "unreadable", but I wouldn't want my secrets to be read out in some raw mode from the 412 good bytes.
HPsquared 3y ago
It's a lot easier to verify the process. It's a lot easier to check that all the drives leaving the building are physically destroyed, than it is to verify that they contain no sensitive data.
- ConcernedCoder 3y ago
  a little off topic but the mob has been operating this way for years when it comes to risk management... dead men don't talk, no matter how trustworthy the individual might be, it's easier to put a bullet in someones head and be done with it, than to worry about what could happen later.

Defense in depth is the reason.

Gordonjcp 3y ago

Okay, but a single pass of /dev/zero will destroy all the data beyond hope of recovery.

CoastalCoder 3y ago
Perhaps one difference is verifiability, and the risk of being mistaken.
netrus 3y ago
But you can't see from the outside if the drive was wiped. How can I be sure that I do not mix up the to-be-wiped and the wiped drives with 99.999% accuracy? That I did not unplug the drive before the whipping was finished? It's much easier with physical destruction.
- Gordonjcp 3y ago
  This is about the only valid objection in all the replies to my post. You're bang on - you might not know it's been wiped. 99.9999% of people will never need to care about it that much.
d33 3y ago
For that to work you have to trust the firmware. Overwriting with something random, saving what was fed and then cross-referencing that against the storage could work better, but there's still some non-zero chance that something you're looking for is in a buffer, unreachable part of the disk or the like. Encrypting the hard drive and then removing the key has a better chance of rendering the data unusable.
treis 3y ago
Only if you're sure 1 -> 0 is not detectably different from 0 -> 0. There's almost certainly secure ways to delete. But not worth it for a five year old drive that may have had sensitive information on it.
- Gordonjcp 3y ago
  How could they possibly be detectably different? If you're saving stuff on old MFM drives today, you're probably not in the demographic that cares about wiping drives for disposal.
linuxftw 3y ago
For an actual HDD, maybe that would work. For any solid state drive, it would definitely not work. SSDs and similar spread writes across pools of blocks for 'endurance', so a 1TB drive might actually have 2TB worth of flash on it.
- willcipriano 3y ago
  With ssds you only have to wipe the internal encryption key.
  - upofadown 3y ago
    ... and hope that the manufacturer has not managed to let that key leak to some other part of the drive... Since there is no commercial advantage to doing things right in this case, there is no reason to assume that they are actually done right.
- ilyt 3y ago
  Flash drives have secure erase for that reason, but writing zeroes would most likely trigger TRIM so most data would be out. Still, only most >so a 1TB drive might actually have 2TB worth of flash on it. That's overly optimistic
- JohnFen 3y ago
  > For an actual HDD, maybe that would work. It doesn't work as well as you'd think on spinning platters, either. Although it does increase the amount of effort needed to read the data on them.
  - Gordonjcp 3y ago
    Why do you think it doesn't work as well as you'd think?
    - JohnFen 3y ago
      A read/write head does not follow precisely the same path every time. It has a positioning error that makes subsequent reads/writes take place slightly offset from earlier ones. With the proper equipment and expertise (and helped out by the error correction mechanisms), you can recover a substantial amount of data that has been "overwritten" on an existing track. This is why "data shredding" applications erase the old data by overwriting it with random data multiple times. That increases the chances that one of those writes will also write over any older data that was shifted slightly to the side. But that's no guarantee. This problem is why organizations that need an extreme level of security require the complete physical destruction of the platters when decommissioning.
zokier 3y ago
/dev/urandom is far better option. One problem is that writing a full drive of data can take long time vs chucking it into shredder. For example this[1] 22TB drive can do 260MB/s, meaning that doing one full disk write pass would take almost 24h. [1] https://nascompares.com/2022/09/12/wd-red-pro-22tb-hard-drive-review-wd221kfgx/ https://nascompares.com/2022/09/12/wd-red-pro-22tb-hard-driv...
- Gordonjcp 3y ago
  In the olden days hard disks wrote data on spinning platters the size of dinner plates with heads the size of Sharpie markers, and the controllers were a Z80 microprocessor on a card with a few kB of ROM and maybe as much as 16kB of RAM. Everything past those days though, the data is very thoroughly scrambled for spectral whitening before being written to disk so there's no practical difference between /dev/urandom and /dev/zero.
- charcircuit 3y ago
  What makes it far better? When overwriting a full drive they are about the same.
  - pessimizer 3y ago
    Intuitively because if you're just writing zero bytes everywhere, and there's a lab that can detect the difference between a zero that used to be a one and a zero that was always a zero, they can get the entire drive. When I get a drive, I LUKS encrypt it and fill it with zeros before throwing a filesystem on it, which results in the drive looking entirely like random nothing. The privacy test that it definitely fails is that disks don't ever look like that unless they're encrypted, but I'm not worried about anybody finding old drives.
    - Bedon292 3y ago
      My current understanding is that it is no longer possible to detect those differences on modern drives. I believe it has come down to density. Where it was possible when density was much lower, and you could detect some residual information from the wide tracks. But things are so dense now those residuals aren't physically possible.
manicdee 3y ago
Falsehoods like this spreading through populations that consider themselves technically literate is one reason the NIST standard requires absolute destruction. There are methods available that will allow recovery of second, third or even fourth generation data to be recovered from magnetic disks. Writing /dev/zero "over" an SSD won't necessarily accomplish what you expect either.
- rasz 3y ago
  No one has ever demonstrated those purely theoretical methods even on an ancient very low density drive, or even a floppy drive.
- Gordonjcp 3y ago
  No, there isn't. The data is *gone*. There is no way to recover it. If you know anything about how hard disks work, you'll see why. There's this theoretical idea that you can get a kind of "latent image" of a mark or a space on the platter even if it's been overwritten, but hard disks haven't written things as literal north-to-south or south-to-north flips for 30 years or so. The data is written as changes of level and phase in a signal, and it's thoroughly scrambled to reduce the chances of a long run of patterns of all zeroes or all ones making the signal hard to recover. Essentially, you'd be taking a list of floating point numbers, multiplying them all by another much smaller floating point number, adding on another floating point number, and trying to imagine what the original was. It's not possible. No, the NSA does not have a big magic machine that does it.
SkyPuncher 3y ago
Not true at all. It’s ultimately very complex and device specific, which is why destruction is recommended.
- rcxdude 3y ago
  There hasn't been a single public demonstration of this on a hard drive made after the 90s, nor any credible reports of private ones. So I wonder what your assertion is based on.
rasz 3y ago
It wont touch G-List (growing list of weak/defective sectors https://forum.hddguru.com/viewtopic.php?f=1&t=41352 https://forum.hddguru.com/viewtopic.php?f=1&t=41352) nor HPA (https://en.wikipedia.org/wiki/Host_protected_area https://en.wikipedia.org/wiki/Host_protected_area). While the second one relies on active attack hiding data for exfiltration, first poses statistically possible scenario where a sector containing sensitive data like password or part of mbox with "We are operating a fucking unlicensed securities exchange in the USA bro" becomes weak read (still fully completed, but slow) and gets remapped. Anyone with PC-3000 can recover this data.
rhn_mk1 3y ago
Will it though? What if you had some bad sectors which became unwriteable and now contain sensitive data forever?
- Gordonjcp 3y ago
  They won't be readable either, if they're that bad.
  - rhn_mk1 3y ago
    Even if not all bits can be error corrected successfully, surely there's enough correct bits remaining to recover some secrets. A 512-byte sector with 100 bytes stuck is "unreadable", but I wouldn't want my secrets to be read out in some raw mode from the 412 good bytes.

HPsquared 3y ago

It's a lot easier to verify the process. It's a lot easier to check that all the drives leaving the building are physically destroyed, than it is to verify that they contain no sensitive data.

ConcernedCoder 3y ago
a little off topic but the mob has been operating this way for years when it comes to risk management... dead men don't talk, no matter how trustworthy the individual might be, it's easier to put a bullet in someones head and be done with it, than to worry about what could happen later.