destorying the hard drive

[John John]

Mike Y wrote:

> "John John" <audetweld@nbnet.nb.ca> wrote in message
> news:enRecXxiIHA.6084@TK2MSFTNGP06.phx.gbl...
>
>>Lee wrote:
>>
>>
>>>Best advice yet is correct, but your advice on zero filled data is
>>>totally incorrect.
>>
>>No, his advice is totally correct! I challenge you, or anyone reading
>>these groups, to offer concrete proof that they can recover zero
>>written/wiped files or to give us the names of data recovery firms who
>>can do it.
>>
>>It cannot be done, it has never been done, no one has ever been able to
>>do it and no one has ever been able to offer a shred of evidence that
>>they have successfully recovered files on securely wiped disks.
>>
>>John
>>
>
>
> Special hardware can could overwritten data. Either with an analog
> analysis or looking for bit shifts. Don't get confused in thinking that
> digital is digital, it's still an analog media...

That is not true, there is no such magical machine available at any cost
that can recover data on securely wiped (zero filed) drives. No one can
recover data on properly wiped drives, the notion that it can be done is
nothing more than a myth.

John

 

[Brian A.]

Take them to a metal scrapyard where they load ore cars with I-beams and other
metal using a large magnet.

--


Brian A. Sesko { MS MVP_Windows Desktop User Experience }
Conflicts start where information lacks.
http://basconotw.mvps.org/

Suggested posting do's/don'ts: http://www.dts-l.org/goodpost.htm
How to ask a question: http://support.microsoft.com/kb/555375


"Gary S. Terhune" <none> wrote in message
news:uck0uw0iIHA.4076@TK2MSFTNGP05.phx.gbl...
>I was being factual: I don't know who the girl is worried about, what the
>information is worth, and thus can't tell just how much money they might be willing
>to spend. We don't know what the recycler does with the HDs. Probably melts them,
>but what do I know? Throw a HD into the morning trash and it's very likely to never
>see the light of day again, to undergo the same melting when the landfill pile is
>mass recycled -- unless someone is stalking you. Then you got problems. I'm
>paranoid, so I do zero-wipes on dead HDs but am also developing a pile in the corner
>of the shed and am in the market for a mass-destructor magnet.
>
> --
> Gary S. Terhune
> MS-MVP Shell/User
> www.grystmill.com
>
> "Davej" <galt_57@hotmail.com> wrote in message
> news:34e37af9-d4a2-4d53-bbdf-2a6193600cc4@f63g2000hsf.googlegroups.com...
>> On Mar 20, 5:36 pm, "Gary S. Terhune" <none> wrote:
>>> Not even smashing the thing with a sledge hammer will destroy the data.
>>>
>>
>> If the disk is bent the data is unrecoverable by anyone without a full-
>> blown laboratory and a big budget. That is good enough, but reusing
>> the drive in another machine makes more sense.
>

 

[dadiOH]

Use to be just plain "format" (sans adjectives)

dadiOH
_____________

Gary S. Terhune wrote:
> What you describe is a "low-level" format, not a "full" format.
>
>
> "dadiOH" <dadiOH@guesswhere.com> wrote in message
> news:ei9JBrziIHA.5504@TK2MSFTNGP05.phx.gbl...
>> Bill in Co. wrote:
>>> Even as I said, if you do a Full format, I think you'll be hard
>>> pressed to recover much, despite what Gary said. But I think
>>> Gary was thinking of the Quick Format (and I don't consider that a
>>> real format).
>>
>> There is no longer such a thing as a true "full format" of a hard
>> drive except the one done by the manufacturer originally.
>> Certainly, not one by Windows...a full format of even a smallish
>> hard drive would take many hours during which time the drive
>> geometry - cylinders, tracks - is laid out, tracks are numbered,
>> the entire drive is written with a byte pattern and verified.
>>
>> If the OP wants to destroy everything on the drive - including all
>> intersector bytes - passing a magnet over it should do it.
....a help file of info about MP3s, recording from
LP/cassette and tips & tricks on this and that.
Get it at http://mysite.verizon.net/xico

 

[Gary S. Terhune]

What did?

--
Gary S. Terhune
MS-MVP Shell/User
www.grystmill.com

"dadiOH" <dadiOH@guesswhere.com> wrote in message
news:%23P7qnx1iIHA.1132@TK2MSFTNGP06.phx.gbl...
> Use to be just plain "format" (sans adjectives)
>
> dadiOH
> _____________
>
> Gary S. Terhune wrote:
>> What you describe is a "low-level" format, not a "full" format.
>>
>>
>> "dadiOH" <dadiOH@guesswhere.com> wrote in message
>> news:ei9JBrziIHA.5504@TK2MSFTNGP05.phx.gbl...
>>> Bill in Co. wrote:
>>>> Even as I said, if you do a Full format, I think you'll be hard
>>>> pressed to recover much, despite what Gary said. But I think
>>>> Gary was thinking of the Quick Format (and I don't consider that a
>>>> real format).
>>>
>>> There is no longer such a thing as a true "full format" of a hard
>>> drive except the one done by the manufacturer originally.
>>> Certainly, not one by Windows...a full format of even a smallish
>>> hard drive would take many hours during which time the drive
>>> geometry - cylinders, tracks - is laid out, tracks are numbered,
>>> the entire drive is written with a byte pattern and verified.
>>>
>>> If the OP wants to destroy everything on the drive - including all
>>> intersector bytes - passing a magnet over it should do it.
> ...a help file of info about MP3s, recording from
> LP/cassette and tips & tricks on this and that.
> Get it at http://mysite.verizon.net/xico
>
>
>

 

[philo]

"Lee" <melee5@my-deja.com> wrote in message
news:bce17331-9666-4b2f-b393-0895d58410b6@a1g2000hsb.googlegroups.com...
On Mar 20, 6:05 pm, "philo" <ph...@privacy.net> wrote:
> "Franc Zabkar" <fzab...@iinternode.on.net> wrote in message
>
> news:9ur5u3l0qbdnqh4pjnu8s4om84jvgkmm98@4ax.com...
>
>
>
> > On Thu, 20 Mar 2008 16:48:40 -0600, Jim Madsen <jus...@nobody.com> put
> > finger to keyboard and composed:
>
> > >My daughter has an old Gateway computer running Windows 98. She says no
> > >one wants it because it is slow and obsolete and she wants to turn it
> > >into the local recycling place.
>
> > >She is worried about (personal) data on the hard drive. I wonder if
> > >reformatting the HD will destroy all the data? My old W95 computer, I
> > >took the HD out and smashed it with a sledge hammer, but she doesn't
> > >want to do that.
>
> > >She took it to a computer store, and they offered to "hose" the HD and
> > >dispose of the computer for $50.00.
>
> > >Any suggestions?
>
> > >Jim
>
> > Use a "zero fill" utility, eg ...
>
> http://www.seagate.com/ww/v/index.jsp?vgnextoid=65a8783c970ce010VgnVC...
>
>
>
> > - Franc Zabkar
>
> This is the best advice yet.
>
> If the drive is zero filled...not only is the data gone...
> it cannot be recovered.- Hide quoted text -
>
> - Show quoted text -

Best advice yet is correct, but your advice on zero filled data is
totally incorrect. Gary's cheap tools can recover this data even if
zero filled multiple times.


Nope that's a total myth.
No drive zero-wiped to government standards has even had any data recovered
from it.
The only reason the government destroys drives is due to the human error
element
VIZ: There is the possibility that the person who wipes the drive failed to
do so
or run it until completion.

No one has *EVERY* given evidence of retrieving data from a properly
zero-wiped drive.
Here is the definitive answer:

http://searchwincomputing.techtarget.com/tip/0,289483,sid68_gci1246592,00.html


For the average guy, zero filling is about as far as one needs to go.
Bart's free Disktool will do this and also overwrite the disk with
test patterns over and over just to be double sure the average guy is
not going to be able to recover your credit card number for example -
but it can still be done by those with the more expensive tools.
http://www.nu2.nu/utils/

 

[Bill in Co.]

That's it, for a hard drive??? OK, then I stand corrected. Must be only
for floppies that it can do the whole shebang.

I had thought, though, in the past, when I did a format c:/s, for preping a
hard drive for Win9x, it was overwriting all the hard disk, as it took
awhile (at least as I recall). Guess not.

Gary S. Terhune wrote:
> You're wrong. Full format has no effect on the data. Full format is Quick
> format followed by a cluster integrity check, no more.
>
> --
> Gary S. Terhune
> MS-MVP Shell/User
> www.grystmill.com
>
> "Bill in Co." <not_really_here@earthlink.net> wrote in message
> news:uNue8uxiIHA.4740@TK2MSFTNGP05.phx.gbl...
>> Even as I said, if you do a Full format, I think you'll be hard pressed
>> to
>> recover much, despite what Gary said. But I think Gary was thinking of
>> the Quick Format (and I don't consider that a real format).
>>
>> John John wrote:
>>> Lee wrote:
>>>
>>>> Best advice yet is correct, but your advice on zero filled data is
>>>> totally incorrect.
>>>
>>> No, his advice is totally correct! I challenge you, or anyone reading
>>> these groups, to offer concrete proof that they can recover zero
>>> written/wiped files or to give us the names of data recovery firms who
>>> can do it.
>>>
>>> It cannot be done, it has never been done, no one has ever been able to
>>> do it and no one has ever been able to offer a shred of evidence that
>>> they have successfully recovered files on securely wiped disks.
>>>
>>> John

 

[Bill in Co.]

dadiOH wrote:
> Bill in Co. wrote:
>> Even as I said, if you do a Full format, I think you'll be hard
>> pressed to recover much, despite what Gary said. But I think
>> Gary was thinking of the Quick Format (and I don't consider that a
>> real format).
>
> There is no longer such a thing as a true "full format" of a hard
> drive except the one done by the manufacturer originally. Certainly,
> not one by Windows...a full format of even a smallish hard drive would
> take many hours during which time the drive geometry - cylinders,
> tracks - is laid out, tracks are numbered, the entire drive is written
> with a byte pattern and verified.

OK, then I stand corrected.

> If the OP wants to destroy everything on the drive - including all
> intersector bytes - passing a magnet over it should do it.
>
> --
>
> dadiOH
> ____________________________
>
> dadiOH's dandies v3.06...
> ...a help file of info about MP3s, recording from
> LP/cassette and tips & tricks on this and that.
> Get it at http://mysite.verizon.net/xico

 

[Gary S. Terhune]

FORMAT C: takes a while because the default action is a Thorough scan by
Scandisk after formatting. To avoid this, use the /q (quick) switch.

--
Gary S. Terhune
MS-MVP Shell/User
www.grystmill.com

"Bill in Co." <not_really_here@earthlink.net> wrote in message
news:%23xU60M5iIHA.4396@TK2MSFTNGP04.phx.gbl...
> That's it, for a hard drive??? OK, then I stand corrected. Must be
> only for floppies that it can do the whole shebang.
>
> I had thought, though, in the past, when I did a format c:/s, for preping
> a hard drive for Win9x, it was overwriting all the hard disk, as it took
> awhile (at least as I recall). Guess not.
>
> Gary S. Terhune wrote:
>> You're wrong. Full format has no effect on the data. Full format is Quick
>> format followed by a cluster integrity check, no more.
>>
>> --
>> Gary S. Terhune
>> MS-MVP Shell/User
>> www.grystmill.com
>>
>> "Bill in Co." <not_really_here@earthlink.net> wrote in message
>> news:uNue8uxiIHA.4740@TK2MSFTNGP05.phx.gbl...
>>> Even as I said, if you do a Full format, I think you'll be hard pressed
>>> to
>>> recover much, despite what Gary said. But I think Gary was thinking
>>> of
>>> the Quick Format (and I don't consider that a real format).
>>>
>>> John John wrote:
>>>> Lee wrote:
>>>>
>>>>> Best advice yet is correct, but your advice on zero filled data is
>>>>> totally incorrect.
>>>>
>>>> No, his advice is totally correct! I challenge you, or anyone reading
>>>> these groups, to offer concrete proof that they can recover zero
>>>> written/wiped files or to give us the names of data recovery firms who
>>>> can do it.
>>>>
>>>> It cannot be done, it has never been done, no one has ever been able to
>>>> do it and no one has ever been able to offer a shred of evidence that
>>>> they have successfully recovered files on securely wiped disks.
>>>>
>>>> John
>
>

 

[Bill in Co.]

OK, but I apparently stand corrected in assuming that it was as "thorough"
on a hard disk as it was on a floppy - overwriting everything on the disk
(or at least I'm pretty sure that assumption is still true for a floppy
using full format).

Hmmm. Perhaps I should have known better in at least one way, because I
once tried one of those disk overwriting programs and it seemed it took
forever.

Gary S. Terhune wrote:
> FORMAT C: takes a while because the default action is a Thorough scan by
> Scandisk after formatting. To avoid this, use the /q (quick) switch.
>
> --
> Gary S. Terhune
> MS-MVP Shell/User
> www.grystmill.com
>
> "Bill in Co." <not_really_here@earthlink.net> wrote in message
> news:%23xU60M5iIHA.4396@TK2MSFTNGP04.phx.gbl...
>> That's it, for a hard drive??? OK, then I stand corrected. Must be
>> only for floppies that it can do the whole shebang.
>>
>> I had thought, though, in the past, when I did a format c:/s, for preping
>> a hard drive for Win9x, it was overwriting all the hard disk, as it took
>> awhile (at least as I recall). Guess not.
>>
>> Gary S. Terhune wrote:
>>> You're wrong. Full format has no effect on the data. Full format is
>>> Quick
>>> format followed by a cluster integrity check, no more.
>>>
>>> --
>>> Gary S. Terhune
>>> MS-MVP Shell/User
>>> www.grystmill.com
>>>
>>> "Bill in Co." <not_really_here@earthlink.net> wrote in message
>>> news:uNue8uxiIHA.4740@TK2MSFTNGP05.phx.gbl...
>>>> Even as I said, if you do a Full format, I think you'll be hard pressed
>>>> to
>>>> recover much, despite what Gary said. But I think Gary was thinking
>>>> of
>>>> the Quick Format (and I don't consider that a real format).
>>>>
>>>> John John wrote:
>>>>> Lee wrote:
>>>>>
>>>>>> Best advice yet is correct, but your advice on zero filled data is
>>>>>> totally incorrect.
>>>>>
>>>>> No, his advice is totally correct! I challenge you, or anyone reading
>>>>> these groups, to offer concrete proof that they can recover zero
>>>>> written/wiped files or to give us the names of data recovery firms who
>>>>> can do it.
>>>>>
>>>>> It cannot be done, it has never been done, no one has ever been able
>>>>> to
>>>>> do it and no one has ever been able to offer a shred of evidence that
>>>>> they have successfully recovered files on securely wiped disks.
>>>>>
>>>>> John

 

[Franc Zabkar]

On Fri, 21 Mar 2008 05:32:07 -0700, "Gary S. Terhune" <none> put
finger to keyboard and composed:

>You're wrong. Full format has no effect on the data. Full format is Quick
>format followed by a cluster integrity check, no more.

I think you're right. Maybe the confusion, at least in my case, is due
to the different way the Format command appears to treat floppy
diskettes as opposed to hard drives.

Anyway, after "full" formatting a 320GB USB HD from within Explorer, I
used a disc editor to view the HD and found that all the data appeared
to be intact. I suspect that a "format /u" from within DOS would
produce the same result but I don't have a spare HD to reliably test
this (my USB HD stalls at 0%).

OTOH, a full format of a floppy diskette writes F6 bytes to every
sector in the data area. The same thing happens when I type ...

format a: /u

.... at a DOS prompt.

A "quick" GUI format or a plain DOS format both leave the diskette's
data area intact.

Here are two of the FD images:
http://www.users.on.net/~fzabkar/frmt_img.zip (4.2KB)

I suspect that the difference in the treatment of FDs and HDs may be
due to the fact that diskettes can be magnetically blank, ie they may
have no prerecorded sector IDs, in which case they need to be low
level formatted. HDs, OTOH, are already low level formatted at the
factory.

- Franc Zabkar
--
Please remove one 'i' from my address when replying by email.

 

[Franc Zabkar]

On Fri, 21 Mar 2008 11:46:57 -0600, "philo" <philo@privacy.net> put
finger to keyboard and composed:

>No one has *EVERY* given evidence of retrieving data from a properly
>zero-wiped drive.

>Here is the definitive answer:
>
>http://searchwincomputing.techtarget.com/tip/0,289483,sid68_gci1246592,00.html

I see that the author cites a paper by Peter Gutmann:
http://www.cs.cornell.edu/people/clarkson/secdg/papers.sp06/secure_deletion.pdf

Gutmann states that ...

=====================================================================
Most drives are capable of microstepping the heads for internal
diagnostic and error recovery purposes (typical error recovery
strategies consist of rereading tracks with slightly changed data
threshold and window offsets and varying the head positioning by a few
percent to either side of the track), but writing to the media while
the head is off-track in order to erase the remnant signal carries too
much risk of making neighbouring tracks unreadable to be useful (for
this reason the microstepping capability is made very difficult to
access by external means).
=====================================================================

In the 80s I used to service CDC SMD hard drives which supported track
offsets and early/late data strobes for improving the reliability of
data retrieval. These features were part of the documented command
set. I still don't see how, by using a simple software approach, one
could extract the remnant magnetisation at the track edges from the
much more dominant primary data.

- Franc Zabkar
--
Please remove one 'i' from my address when replying by email.

 

[Franc Zabkar]

On Fri, 21 Mar 2008 02:38:55 -0300, John John <audetweld@nbnet.nb.ca>
put finger to keyboard and composed:

>Lee wrote:
>
>> Best advice yet is correct, but your advice on zero filled data is
>> totally incorrect.
>
>No, his advice is totally correct! I challenge you, or anyone reading
>these groups, to offer concrete proof that they can recover zero
>written/wiped files or to give us the names of data recovery firms who
>can do it.
>
>It cannot be done, it has never been done, no one has ever been able to
>do it and no one has ever been able to offer a shred of evidence that
>they have successfully recovered files on securely wiped disks.
>
>John

The following article was written by a company that is selling data
wiping software, so actual data recovery may be less plausible than
they make out, if not impossible:

http://web.archive.org/web/20070307054145/http://www.forensics-intl.com/art15.html

The article states that "horizontal head alignment and vertical head
placement is just a bit different every time data is written and
rewritten to the same track". This results in horizontal and vertical
magnetic "shadow data" which can be recovered by sensitive equipment.

Curiously the article claims that "if you have an interest in
researching and experimenting with shadow data, basic tools are
available for free download over the Internet". However the authors
qualify this statement by adding that "software solutions provide
limited success because they rely upon the same mechanical flaws
discussed above". I don't understand how software could do what the
authors claim, although I expect that one could use undocumented
commands (if they exist) to add track offsets and/or early/late data
strobes to any read or seek command. But AFAICS this would only be
useful in retrieving marginal primary data, not remnant data.

- Franc Zabkar
--
Please remove one 'i' from my address when replying by email.

 

[dadiOH]

Format. There was no such thing as a format with adjectives. No "low
level", no "full", no "quick". Just plain format...
"during which time the drive geometry - cylinders,
tracks - is laid out, tracks are numbered, the entire drive is
written
with a byte pattern and verified."
Except there were no cylinders on 5 1/4 floppies..

dadiOH
______________

Gary S. Terhune wrote:
> What did?
>
>
> "dadiOH" <dadiOH@guesswhere.com> wrote in message
> news:%23P7qnx1iIHA.1132@TK2MSFTNGP06.phx.gbl...
>> Use to be just plain "format" (sans adjectives)
>>
>> dadiOH
>> _____________
>>
>> Gary S. Terhune wrote:
>>> What you describe is a "low-level" format, not a "full" format.
>>>
>>>
>>> "dadiOH" <dadiOH@guesswhere.com> wrote in message
>>> news:ei9JBrziIHA.5504@TK2MSFTNGP05.phx.gbl...
>>>> Bill in Co. wrote:
>>>>> Even as I said, if you do a Full format, I think you'll be hard
>>>>> pressed to recover much, despite what Gary said. But I think
>>>>> Gary was thinking of the Quick Format (and I don't consider
>>>>> that a real format).
>>>>
>>>> There is no longer such a thing as a true "full format" of a hard
>>>> drive except the one done by the manufacturer originally.
>>>> Certainly, not one by Windows...a full format of even a smallish
>>>> hard drive would take many hours during which time the drive
>>>> geometry - cylinders, tracks - is laid out, tracks are numbered,
>>>> the entire drive is written with a byte pattern and verified.
>>>>
>>>> If the OP wants to destroy everything on the drive - including
>>>> all intersector bytes - passing a magnet over it should do it.
>> ...a help file of info about MP3s, recording from
>> LP/cassette and tips & tricks on this and that.
>> Get it at http://mysite.verizon.net/xico

 

[dadiOH]

Franc Zabkar wrote:

> I suspect that the difference in the treatment of FDs and HDs may be
> due to the fact that diskettes can be magnetically blank, ie they
> may have no prerecorded sector IDs, in which case they need to be
> low level formatted. HDs, OTOH, are already low level formatted at
> the factory.
>
> - Franc Zabkar

Bingo.

--

dadiOH
____________________________

dadiOH's dandies v3.06...
....a help file of info about MP3s, recording from
LP/cassette and tips & tricks on this and that.
Get it at http://mysite.verizon.net/xico

 

[Franc Zabkar]

On Fri, 21 Mar 2008 13:41:24 +1100, Franc Zabkar
<fzabkar@iinternode.on.net> put finger to keyboard and composed:

>Typing "help format" at the DOS prompt documents the function of
>several switches, including /U, which is supposed to "destroy all
>existing data":

I now recall doing some pertinent testing (on an NTFS volume from a
Win98SE box) in this group over a year ago. Here is what I found at
that time:

http://groups.google.com/group/micr..._discussion/msg/7826f476393adc6b?dmode=source

"I was able to confirm that an Fdisk does write F6 data patterns to
those sectors identified in a previous post, but I was surprised to
find that neither Format /u nor Format /c (in real DOS mode) appeared
to write anything at all to the disc ... A Windows full format appears
to write the boot block, initialise the FATs with zeroes, and create a
new root directory containing a volume name and the Recycled folder.
It appears that nothing else is written to the disc - all the original
NTFS data are still there."

Sorry for my original disinformation.

- Franc Zabkar
--
Please remove one 'i' from my address when replying by email.

 

[Gary S. Terhune]

Ancient days, well before the technology that is the topic here.

--
Gary S. Terhune
MS-MVP Shell/User
www.grystmill.com
\
"dadiOH" <dadiOH@guesswhere.com> wrote in message
news:O2NQzw5iIHA.944@TK2MSFTNGP05.phx.gbl...
> Format. There was no such thing as a format with adjectives. No "low
> level", no "full", no "quick". Just plain format...
> "during which time the drive geometry - cylinders,
> tracks - is laid out, tracks are numbered, the entire drive is
> written
> with a byte pattern and verified."
> Except there were no cylinders on 5 1/4 floppies..
>
> dadiOH
> ______________
>
> Gary S. Terhune wrote:
>> What did?
>>
>>
>> "dadiOH" <dadiOH@guesswhere.com> wrote in message
>> news:%23P7qnx1iIHA.1132@TK2MSFTNGP06.phx.gbl...
>>> Use to be just plain "format" (sans adjectives)
>>>
>>> dadiOH
>>> _____________
>>>
>>> Gary S. Terhune wrote:
>>>> What you describe is a "low-level" format, not a "full" format.
>>>>
>>>>
>>>> "dadiOH" <dadiOH@guesswhere.com> wrote in message
>>>> news:ei9JBrziIHA.5504@TK2MSFTNGP05.phx.gbl...
>>>>> Bill in Co. wrote:
>>>>>> Even as I said, if you do a Full format, I think you'll be hard
>>>>>> pressed to recover much, despite what Gary said. But I think
>>>>>> Gary was thinking of the Quick Format (and I don't consider
>>>>>> that a real format).
>>>>>
>>>>> There is no longer such a thing as a true "full format" of a hard
>>>>> drive except the one done by the manufacturer originally.
>>>>> Certainly, not one by Windows...a full format of even a smallish
>>>>> hard drive would take many hours during which time the drive
>>>>> geometry - cylinders, tracks - is laid out, tracks are numbered,
>>>>> the entire drive is written with a byte pattern and verified.
>>>>>
>>>>> If the OP wants to destroy everything on the drive - including
>>>>> all intersector bytes - passing a magnet over it should do it.
>>> ...a help file of info about MP3s, recording from
>>> LP/cassette and tips & tricks on this and that.
>>> Get it at http://mysite.verizon.net/xico
>
>
>

 

[Gary S. Terhune]

I don't know that floppies are treated the same but I think so.

--
Gary S. Terhune
MS-MVP Shell/User
www.grystmill.com

"Bill in Co." <not_really_here@earthlink.net> wrote in message
news:e%23h2Wd5iIHA.1184@TK2MSFTNGP04.phx.gbl...
> OK, but I apparently stand corrected in assuming that it was as "thorough"
> on a hard disk as it was on a floppy - overwriting everything on the disk
> (or at least I'm pretty sure that assumption is still true for a floppy
> using full format).
>
> Hmmm. Perhaps I should have known better in at least one way, because
> I once tried one of those disk overwriting programs and it seemed it took
> forever.
>
> Gary S. Terhune wrote:
>> FORMAT C: takes a while because the default action is a Thorough scan by
>> Scandisk after formatting. To avoid this, use the /q (quick) switch.
>>
>> --
>> Gary S. Terhune
>> MS-MVP Shell/User
>> www.grystmill.com
>>
>> "Bill in Co." <not_really_here@earthlink.net> wrote in message
>> news:%23xU60M5iIHA.4396@TK2MSFTNGP04.phx.gbl...
>>> That's it, for a hard drive??? OK, then I stand corrected. Must be
>>> only for floppies that it can do the whole shebang.
>>>
>>> I had thought, though, in the past, when I did a format c:/s, for
>>> preping
>>> a hard drive for Win9x, it was overwriting all the hard disk, as it took
>>> awhile (at least as I recall). Guess not.
>>>
>>> Gary S. Terhune wrote:
>>>> You're wrong. Full format has no effect on the data. Full format is
>>>> Quick
>>>> format followed by a cluster integrity check, no more.
>>>>
>>>> --
>>>> Gary S. Terhune
>>>> MS-MVP Shell/User
>>>> www.grystmill.com
>>>>
>>>> "Bill in Co." <not_really_here@earthlink.net> wrote in message
>>>> news:uNue8uxiIHA.4740@TK2MSFTNGP05.phx.gbl...
>>>>> Even as I said, if you do a Full format, I think you'll be hard
>>>>> pressed
>>>>> to
>>>>> recover much, despite what Gary said. But I think Gary was thinking
>>>>> of
>>>>> the Quick Format (and I don't consider that a real format).
>>>>>
>>>>> John John wrote:
>>>>>> Lee wrote:
>>>>>>
>>>>>>> Best advice yet is correct, but your advice on zero filled data is
>>>>>>> totally incorrect.
>>>>>>
>>>>>> No, his advice is totally correct! I challenge you, or anyone
>>>>>> reading
>>>>>> these groups, to offer concrete proof that they can recover zero
>>>>>> written/wiped files or to give us the names of data recovery firms
>>>>>> who
>>>>>> can do it.
>>>>>>
>>>>>> It cannot be done, it has never been done, no one has ever been able
>>>>>> to
>>>>>> do it and no one has ever been able to offer a shred of evidence that
>>>>>> they have successfully recovered files on securely wiped disks.
>>>>>>
>>>>>> John
>
>

 

[Gary S. Terhune]

Sounds about right. I realize, too, that I've been restricting my
considerations to HDs, not floppies.

--
Gary S. Terhune
MS-MVP Shell/User
www.grystmill.com

"Franc Zabkar" <fzabkar@iinternode.on.net> wrote in message
news:vr98u3ttfstv2k2gikbfshnlpk2697rdi5@4ax.com...
> On Fri, 21 Mar 2008 05:32:07 -0700, "Gary S. Terhune" <none> put
> finger to keyboard and composed:
>
>>You're wrong. Full format has no effect on the data. Full format is Quick
>>format followed by a cluster integrity check, no more.
>
> I think you're right. Maybe the confusion, at least in my case, is due
> to the different way the Format command appears to treat floppy
> diskettes as opposed to hard drives.
>
> Anyway, after "full" formatting a 320GB USB HD from within Explorer, I
> used a disc editor to view the HD and found that all the data appeared
> to be intact. I suspect that a "format /u" from within DOS would
> produce the same result but I don't have a spare HD to reliably test
> this (my USB HD stalls at 0%).
>
> OTOH, a full format of a floppy diskette writes F6 bytes to every
> sector in the data area. The same thing happens when I type ...
>
> format a: /u
>
> ... at a DOS prompt.
>
> A "quick" GUI format or a plain DOS format both leave the diskette's
> data area intact.
>
> Here are two of the FD images:
> http://www.users.on.net/~fzabkar/frmt_img.zip (4.2KB)
>
> I suspect that the difference in the treatment of FDs and HDs may be
> due to the fact that diskettes can be magnetically blank, ie they may
> have no prerecorded sector IDs, in which case they need to be low
> level formatted. HDs, OTOH, are already low level formatted at the
> factory.
>
> - Franc Zabkar
> --
> Please remove one 'i' from my address when replying by email.

 

[John John]

Franc Zabkar wrote:

> On Fri, 21 Mar 2008 02:38:55 -0300, John John <audetweld@nbnet.nb.ca>
> put finger to keyboard and composed:
>
>
>>Lee wrote:
>>
>>
>>>Best advice yet is correct, but your advice on zero filled data is
>>>totally incorrect.
>>
>>No, his advice is totally correct! I challenge you, or anyone reading
>>these groups, to offer concrete proof that they can recover zero
>>written/wiped files or to give us the names of data recovery firms who
>>can do it.
>>
>>It cannot be done, it has never been done, no one has ever been able to
>>do it and no one has ever been able to offer a shred of evidence that
>>they have successfully recovered files on securely wiped disks.
>>
>>John
>
>
> The following article was written by a company that is selling data
> wiping software, so actual data recovery may be less plausible than
> they make out, if not impossible:
>
> http://web.archive.org/web/20070307054145/http://www.forensics-intl.com/art15.html
>
> The article states that "horizontal head alignment and vertical head
> placement is just a bit different every time data is written and
> rewritten to the same track". This results in horizontal and vertical
> magnetic "shadow data" which can be recovered by sensitive equipment.
>
> Curiously the article claims that "if you have an interest in
> researching and experimenting with shadow data, basic tools are
> available for free download over the Internet". However the authors
> qualify this statement by adding that "software solutions provide
> limited success because they rely upon the same mechanical flaws
> discussed above". I don't understand how software could do what the
> authors claim, although I expect that one could use undocumented
> commands (if they exist) to add track offsets and/or early/late data
> strobes to any read or seek command. But AFAICS this would only be
> useful in retrieving marginal primary data, not remnant data.

The perpetuation of the myth that data can be recovered on wiped drive
is a self serving exercise that sellers of drive wiping software have
long engaged in. No one has ever been able to recover files on securely
wiped drives. The notion that this *might* be possible was only
advanced by Peter Gutmann as background material for his paper on Secure
Deletion of Data on drives. Furthermore, Dr. Gutmann's research was
done on an old class of drives that is practically out of use today, the
techniques described in his paper are hardly applicable to modern hard
drives, which is a moot point anyway because they didn't even work on
the old class of hard drives!

John

 

[John John]

Mike Y wrote:

> "John John" <audetweld@nbnet.nb.ca> wrote in message
> news:eT190Q1iIHA.1204@TK2MSFTNGP03.phx.gbl...
>
>>Mike Y wrote:
>>
>>
>>>"John John" <audetweld@nbnet.nb.ca> wrote in message
>>>news:enRecXxiIHA.6084@TK2MSFTNGP06.phx.gbl...
>>>
>>>
>>>>Lee wrote:
>>>>
>>>>
>>>>
>>>>>Best advice yet is correct, but your advice on zero filled data is
>>>>>totally incorrect.
>>>>
>>>>No, his advice is totally correct! I challenge you, or anyone reading
>>>>these groups, to offer concrete proof that they can recover zero
>>>>written/wiped files or to give us the names of data recovery firms who
>>>>can do it.
>>>>
>>>>It cannot be done, it has never been done, no one has ever been able to
>>>>do it and no one has ever been able to offer a shred of evidence that
>>>>they have successfully recovered files on securely wiped disks.
>>>>
>>>>John
>>>>
>>>
>>>
>>>Special hardware can could overwritten data. Either with an analog
>>>analysis or looking for bit shifts. Don't get confused in thinking that
>>>digital is digital, it's still an analog media...
>>
>>That is not true, there is no such magical machine available at any cost
>>that can recover data on securely wiped (zero filed) drives. No one can
>>recover data on properly wiped drives, the notion that it can be done is
>>nothing more than a myth.
>>
>>John
>
>
> Well, when you say securely wiped, by that meaning multiple wipes, I agree.
> (The most secure is to wipe multiple times with multiple and DIFFERENT
> data)
>
> Also, if you imply that there exists no machine that interfaces to the IDE,
> then I also agree. At least, I've not heard of any. And I don't know of
> any manufacturer that has backdoor hooks to allow the capabilities needed
> to be implemented. (I'm not sure, but reasonably confident that most,
> if not all, drives out there don't have the capability, even if a hacker had
> ability to reprogram the firmware to do his bidding.)
>
> However, there are TWO methods that will extract 'overwritten' info
> from media. Both have strong points and caveats, and both involve
> being able to access the drive other than through the 'user' interface.
> Neither are 100% or secure, and neither can work through multiple
> wipes. Or at least none that I know of can. But then...
>
> It is NOT a myth.
>
> The myth is telling people that it cannot be done.
>
> Granted, it's beyond the abilities of almost any hacker I've heard of, but
> it's NOT beyond the capabilities of manufacturers or certain organizations.
>
> Risk to the consumer? Almost zilch.
>
> But please don't come out with your blatant statement that it's a myth or
> that it can't be done. You are just plain wrong, and either ignorant of
> the technologies involved (I'll grant you that much) or are spouting a
> 'company line'. Which is it?

It is you who is ignorant of the facts! Please substantiate your claims!

The notion that data can be recovered on wiped drives is a myth, plain
and simple. Data cannot be recovered on a zero filled drive, even if it
was only written once! This is not a blatant statement, it's the truth.
If you think it can be done please supply reference material, sources
and names of companies who can do this.

You can use Magnetic Force Microscopy (MFM) or Scanning Tunneling
Microscopy (STM) and examine hard drive platters all that you want and
you will not be able to recover any data whatsoever on a wiped hard
drive, it can't be done, period!

John

And by the way, I do not work for any company that is in anyway involved
in the sale or development of anything to do with computer technology or
software.