Peter Gutmann data deletion theaory?

[Jared Johnson]

All,

Do you all agree with Peter Gutman's conclusion on his theory that data can
never really be erased, as noted in his quote below:

"Data overwritten once or twice may be recovered by subtracting what is
expected to be read from a storage location from what is actually read. Data
which is overwritten an arbitrarily large number of times can still be
recovered provided that the new data isn't written to the same location as
the original data (for magnetic media), or that the recovery attempt is
carried out fairly soon after the new data was written (for RAM). For this
reason it is effectively impossible to sanitise storage locations by simple
overwriting them, no matter how many overwrite passes are made or what data
patterns are written. However by using the relatively simple methods
presented in this paper the task of an attacker can be made significantly
more difficult, if not prohibitively expensive."

It seems that the perhaps the only real way to rid your Hard Drives of data
is to burn them.

I'd love to hear some thoughts on this from security and data experts out
there.

[Jeremy Epstein]

Like anything in security, "it depends". In particular, it depends on what
the assumed adversary motivations and capabilities are. If the adversary is
a nation-state with electron microscopes and other expensive devices, and
the disk is believed to have held highly classified information, it's
clearly true that the only way to destroy the data is to burn the disk (and
in the right way). If, on the other hand, the adversary is someone who's
randomly buying used computers in hopes of finding carelessly deleted files,
then a full reformat is quite enough to cause them to move on to the next
machine - they're not going to have the motivation or equipment to delve
into a randomly selected disk.

Where in between these two extremes it's necessary to burn the disk is an
exercise left to the reader ;-) You really have to do a risk analysis... If
it's cheaper / easier / less dangerous for the adversary to dumpster dive to
get hardcopies or bribe someone or hack into the system, then destroying the
hardware is putting the effort in the wrong place. For a lot of classified
systems, the assumption is that obtaining used disks is a low cost attack,
so it's cost effective to use destruction.

--Jeremy

> -----Original Message-----
> From: Jared Johnson [mailto:jaredsjazz@Yahoo.com]
> Sent: Wednesday, July 20, 2005 7:49 PM
> To: focus-ms@securityfocus.com
> Cc: bugtraq@securityfocus.com
> Subject: Peter Gutmann data deletion theaory?
>
> All,
>
> Do you all agree with Peter Gutman's conclusion on his theory
> that data can never really be erased, as noted in his quote below:
>
> "Data overwritten once or twice may be recovered by
> subtracting what is expected to be read from a storage
> location from what is actually read. Data which is
> overwritten an arbitrarily large number of times can still be
> recovered provided that the new data isn't written to the
> same location as the original data (for magnetic media), or
> that the recovery attempt is carried out fairly soon after
> the new data was written (for RAM). For this reason it is
> effectively impossible to sanitise storage locations by
> simple overwriting them, no matter how many overwrite passes
> are made or what data patterns are written. However by using
> the relatively simple methods presented in this paper the
> task of an attacker can be made significantly more difficult,
> if not prohibitively expensive."
>
> It seems that the perhaps the only real way to rid your Hard
> Drives of data is to burn them.
>
> I'd love to hear some thoughts on this from security and data
> experts out there.
>
>
>

The relevant question one should ask is: how costly will it be (time, money)
to recover data?

If you have, for example, a modern tape and just zero it (write eofs at the
beginning), nearly every drive in the world will report blank tape errors if
you try to go past BOT, even if the tape store past there is physically unt=
ouched.

What's needed to decide how exposed erased data is would be instead how much
it might cost (and how many questions might be asked) to get someone with s=
pecial
gear to attempt recovery? Possibly also it could make sense to ask how many
sites that could recover the data exist.

Merely writing zeroes (or anything else) once onto a disk sector means the
drive will as a general matter read what was written, not what used to be
there, regardless of the analogue magnetic state underlying.=20

To judge whether that's enough to block an adversary, I need some idea how =
much
it'll cost to get the data back, and whether all recovery shops might ask e=
mbarrassing
questions about how someone came to have this disk, or make police reports =
or the like.

I don't believe I've seen any such information in this forum.

-----Original Message-----
From: Jared Johnson [mailto:jaredsjazz@Yahoo.com]
Sent: Wednesday, July 20, 2005 7:49 PM
To: focus-ms@securityfocus.com
Cc: bugtraq@securityfocus.com
Subject: Peter Gutmann data deletion theaory?


All,

Do you all agree with Peter Gutman's conclusion on his theory that data can
never really be erased, as noted in his quote below:

"Data overwritten once or twice may be recovered by subtracting what is
expected to be read from a storage location from what is actually read. Data
which is overwritten an arbitrarily large number of times can still be
recovered provided that the new data isn't written to the same location as
the original data (for magnetic media), or that the recovery attempt is
carried out fairly soon after the new data was written (for RAM). For this
reason it is effectively impossible to sanitise storage locations by simple
overwriting them, no matter how many overwrite passes are made or what data
patterns are written. However by using the relatively simple methods
presented in this paper the task of an attacker can be made significantly
more difficult, if not prohibitively expensive."

It seems that the perhaps the only real way to rid your Hard Drives of data
is to burn them.=20

I'd love to hear some thoughts on this from security and data experts out
there.





************************************************** ********************
This transmission may contain information that is privileged, confidential =
and/or exempt from disclosure under applicable law. If you are not the inte=
nded recipient, you are hereby notified that any disclosure, copying, distr=
ibution, or use of the information contained herein (including any reliance=
thereon) is STRICTLY PROHIBITED. If you received this transmission in erro=
r, please immediately contact the sender and destroy the material in its en=
tirety, whether in electronic or hard copy format. Thank you
************************************************** ********************

[Barbara Lockwood]

This is a well known fact of data forensic science and why this science
flourishes at all. Overwriting data hardly obscures the data. Even when
sections of data sectors are overwritten many times, changes can very =
often
be reverse engineered. There are companies out there that make their =
entire
revenue on just such reconstructions.=20

In fact even de-gaussing (magnetic relignment of ions) sometimes fails =
to
remove all residual data. The degaussing machine can fail to cover the
separating bands between data. Imagine you had an eraser and managed to
completely erase everything except the top parts of characters. You =
could
probably guess what the data said. Imperfections in the media, the =
optical
writing mechanism and the de-gaussing tools can all contribute to there
being some residual data left.

Bar Biszick-Lockwood (cisa, cissp, csqa)
SDLC & Security Process Standards Expert
GCC SOX 404 Audit and Remediation

QualityIT
206-388-3333
pager message: 4252415391@tmomail.net
barbis@qualityit.net

RESOURCE SITE: http://www.securityprocessprofessional.com

SERVICES SITE http://www.qualityit.net






-----Original Message-----
From: Jared Johnson [mailto:jaredsjazz@Yahoo.com]=20
Sent: Wednesday, July 20, 2005 4:49 PM
To: focus-ms@securityfocus.com
Cc: bugtraq@securityfocus.com
Subject: Peter Gutmann data deletion theaory?


All,

Do you all agree with Peter Gutman's conclusion on his theory that data =
can
never really be erased, as noted in his quote below:

"Data overwritten once or twice may be recovered by subtracting what is
expected to be read from a storage location from what is actually read. =
Data
which is overwritten an arbitrarily large number of times can still be
recovered provided that the new data isn't written to the same location =
as
the original data (for magnetic media), or that the recovery attempt is
carried out fairly soon after the new data was written (for RAM). For =
this
reason it is effectively impossible to sanitise storage locations by =
simple
overwriting them, no matter how many overwrite passes are made or what =
data
patterns are written. However by using the relatively simple methods
presented in this paper the task of an attacker can be made =
significantly
more difficult, if not prohibitively expensive."

It seems that the perhaps the only real way to rid your Hard Drives of =
data
is to burn them.=20

I'd love to hear some thoughts on this from security and data experts =
out
there.





--=20
No virus found in this incoming message.
Checked by AVG Anti-Virus.
Version: 7.0.323 / Virus Database: 267.9.2/54 - Release Date: 7/21/2005
=20

--=20
No virus found in this outgoing message.
Checked by AVG Anti-Virus.
Version: 7.0.323 / Virus Database: 267.9.2/54 - Release Date: 7/21/2005
=20

[Jay D. Dyson]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Wed, 20 Jul 2005, Jared Johnson wrote:

> It seems that the perhaps the only real way to rid your Hard Drives of
> data is to burn them.

The sophistication of data recovery in LEAs and TLAs is such that
drives that once held classified data are routinely shredded and slagged.

But for those of us who handle sensitive and personal data (and,
unfortunately, don't have access to a smelter), having a kiln, a drill
press, and a belt sander is almost as good. :)

As for retiring CD-ROMs, I just do what I learned from the DoD:
http://www.treachery.net/~jdyson/infosec/dod_cd_declassification.html .

- -Jay

( ( _______
)) )) .-"There's always time for a good cup of coffee"-. >====<--.
C|~~|C|~~| \----- Jay D. Dyson -- jdyson@treachery.net -----/ | = |-'
`--' `--' `---- You don't want to make me be myself. ----' `------'

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (TreacherOS)
Comment: See http://www.treachery.net/~jdyson/ for current keys.

iD8DBQFC3+2XxzN3WIW0edsRAieqAJ4xWpeJGJ4qxNtgLAhfXQ J5qp7pAACgqeSu
6EuufQazjcA+3z2hSn5XZY4=
=gD4T
-----END PGP SIGNATURE-----

[Simple Nomad]

--nextPart2236158.5QqGBUutjy
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

On Wednesday 20 July 2005 18:48, Jared Johnson wrote:
> Data overwritten once or twice
<snip>

The quote is from 1996. I spoke with Guttman about this at AusCERT a few ye=
ars=20
ago and even *he* doesn't believe it anymore. Drive technology has changed=
=20
substantially since then.

The main areas where criminals get caught with bad stuff on their drives by=
=20
forensics people is from 1) not knowing where the data is being written to=
=20
(browser cache, swap file, etc) 2) not doing any overwrite of the data as a=
=20
part of deletion, and 3) not taking into consideration such items as file=20
slack.

Drives that do caching and file systems that do journaling also may be a=20
factor. That being said, 3 wipes are "good enough for government work". DoD=
=20
5220.22-M chapter 8 subsection 306 in the Cleaing and Sanitization Matrix=20
shows under the Magentic Disk section that to properly sanitize a=20
non-removable rigid drive, that the choices of degaussing, destruction of t=
he=20
drive, or a 3 pass wipe are acceptible methods for disk sanitation. Note th=
at=20
the 3 pass wipe method is NOT acceptable for drives that contained Top Secr=
et=20
information - so unless the drive contained Top Secret material, you're=20
covered.

It should be noted that this issue has been done to death on bugtraq severa=
l=20
times.

=2D-=20
# Simple Nomad, C=B2ISSP -- thegnome@nmrc.org #
# C1B1 E749 25DF 867C 36D4 1E14 247A A4BD 6838 F11D #
# http://www.nmrc.org/~thegnome/ #

--nextPart2236158.5QqGBUutjy
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (GNU/Linux)

iD8DBQBC3/JpJHqkvWg48R0RAm8NAJsEengeBmq+/s+4C1sC+2EHub0+RwCfe34z
gfe0XwWAcE+Q5PseLuEtQ4A=
=fHx4
-----END PGP SIGNATURE-----

--nextPart2236158.5QqGBUutjy--

[D. Weiss]

Though smelting of course will clean them, your average rotary sander will
take the medium off the disk quite as well. I suppose that someone somewhere
will tell you that if all the kings horses and all the kings men try to put
the sanded off dust back together again, someone could read your data, but I
think it would be a number of magnitudes more difficult than putting finely
chopped chaff back together again.

Peter's whole point is that if you have unlimited time, unlimited resources,
then an infinite number of monkeys typing randomly on an infinite number of
typewriters will one day produce the works of Shakespeare. Will someone
devote that effort to your old drive?

The big question to ask is "If they DO devote the level of effort necessary,
will they find anything I don't want them to have?" If yes, then take strong
steps to defeat them. Don't statistically determine your danger - make it as
close to zero as you can. If economics says you can't send them off to the
smelters (who may be recovering the data and selling it and then melting the
drive, profiting on both sides of the fence) give Jesse the Java Wizard an
additional task of opening and sanding the platters off. Now you can use the
platters on award plaques and the magnets are wicked strong and can hold
large amounts of documents to the frig door.

If the answer is no, Norton wipe them three times and re-use them.

Peters whole work is about estimates and averages, and just like logarithms,
you can do a damned site closer to perfectly right than one would commonly
think. There is a danger. You CAN read a disk overwritten x number of times.
Don't ask "If they did this", ask do I care if they did this.

But sanding the platters and spreading the dust into a couple bins should
really stop them, until Peter comes up with a way to put the dust back on
the platters.

Peter, You aren't efforting that as we email, are you? :-)

Weiss

-----Original Message-----
From: Jared Johnson [mailto:jaredsjazz@Yahoo.com]
Sent: Thursday, July 21, 2005 01:49
To: focus-ms@securityfocus.com
Cc: bugtraq@securityfocus.com
Subject: Peter Gutmann data deletion theaory?


All,

Do you all agree with Peter Gutman's conclusion on his theory that data can
never really be erased, as noted in his quote below:

"Data overwritten once or twice may be recovered by subtracting what is
expected to be read from a storage location from what is actually read. Data
which is overwritten an arbitrarily large number of times can still be
recovered provided that the new data isn't written to the same location as
the original data (for magnetic media), or that the recovery attempt is
carried out fairly soon after the new data was written (for RAM). For this
reason it is effectively impossible to sanitise storage locations by simple
overwriting them, no matter how many overwrite passes are made or what data
patterns are written. However by using the relatively simple methods
presented in this paper the task of an attacker can be made significantly
more difficult, if not prohibitively expensive."

It seems that the perhaps the only real way to rid your Hard Drives of data
is to burn them.

I'd love to hear some thoughts on this from security and data experts out
there.

[Tiago Halm]

One thing I would add here is the difference between the physical data and
its meaning.
Physically, it may always be possible to retrieve data, but when there is no
notion of the topic at hand or the possible semantic associated with the
data, then that may be an impossible task trying to assemble pieces that in
the end, can have several meanings.

But in the end, I would assume this thread is focusing on the abilities to
retrieve and not to assemble.

Just my 2 cents.

Tiago Halm

-----Original Message-----
From: Barbara Lockwood [mailto:barbis@qualityit.net]
Sent: quinta-feira, 21 de Julho de 2005 19:43
To: 'Jared Johnson'; focus-ms@securityfocus.com
Cc: bugtraq@securityfocus.com
Subject: RE: Peter Gutmann data deletion theaory?

This is a well known fact of data forensic science and why this science
flourishes at all. Overwriting data hardly obscures the data. Even when
sections of data sectors are overwritten many times, changes can very often
be reverse engineered. There are companies out there that make their entire
revenue on just such reconstructions.

In fact even de-gaussing (magnetic relignment of ions) sometimes fails to
remove all residual data. The degaussing machine can fail to cover the
separating bands between data. Imagine you had an eraser and managed to
completely erase everything except the top parts of characters. You could
probably guess what the data said. Imperfections in the media, the optical
writing mechanism and the de-gaussing tools can all contribute to there
being some residual data left.

Bar Biszick-Lockwood (cisa, cissp, csqa)
SDLC & Security Process Standards Expert
GCC SOX 404 Audit and Remediation

QualityIT
206-388-3333
pager message: 4252415391@tmomail.net
barbis@qualityit.net

RESOURCE SITE: http://www.securityprocessprofessional.com

SERVICES SITE http://www.qualityit.net






-----Original Message-----
From: Jared Johnson [mailto:jaredsjazz@Yahoo.com]
Sent: Wednesday, July 20, 2005 4:49 PM
To: focus-ms@securityfocus.com
Cc: bugtraq@securityfocus.com
Subject: Peter Gutmann data deletion theaory?


All,

Do you all agree with Peter Gutman's conclusion on his theory that data can
never really be erased, as noted in his quote below:

"Data overwritten once or twice may be recovered by subtracting what is
expected to be read from a storage location from what is actually read. Data
which is overwritten an arbitrarily large number of times can still be
recovered provided that the new data isn't written to the same location as
the original data (for magnetic media), or that the recovery attempt is
carried out fairly soon after the new data was written (for RAM). For this
reason it is effectively impossible to sanitise storage locations by simple
overwriting them, no matter how many overwrite passes are made or what data
patterns are written. However by using the relatively simple methods
presented in this paper the task of an attacker can be made significantly
more difficult, if not prohibitively expensive."

It seems that the perhaps the only real way to rid your Hard Drives of data
is to burn them.

I'd love to hear some thoughts on this from security and data experts out
there.





--
No virus found in this incoming message.
Checked by AVG Anti-Virus.
Version: 7.0.323 / Virus Database: 267.9.2/54 - Release Date: 7/21/2005


--
No virus found in this outgoing message.
Checked by AVG Anti-Virus.
Version: 7.0.323 / Virus Database: 267.9.2/54 - Release Date: 7/21/2005


---
[This E-mail has been scanned for viruses but it is your responsibility
to maintain up to date anti virus software on the device that you are
currently using to read this email. ]

[Volker Tanger]

Greetings!

On Thu, 21 Jul 2005 14:07:12 -0500
Simple Nomad <thegnome@nmrc.org> wrote:
> On Wednesday 20 July 2005 18:48, Jared Johnson wrote:
> > Data overwritten once or twice
[...]
> The quote is from 1996. I spoke with Guttman about this at AusCERT a
> few years ago and even *he* doesn't believe it anymore. Drive
> technology has changed substantially since then.

His theory no longer does hold true. His 1996 paper is available at
http://www.cs.auckland.ac.nz/~pgut001/pubs/secure_del.html, targeting
MFM and RLL disk technology, where a typical 5.25" disk held 20-80MB
(yes, MEGAbyte, not GB). His recommendations were based on old magnetic
disc technology where each bit was represented by the magnetical
orientation on the platter (north=1, south=0). After that came other
technologies, where bits are defined by changes of the magnetic field
even down to probabilistic field measurements - which allowes tighter
data packing but rendered the base of his recommendations useless.

Of course - if you write often enough with different data over "the
same" spot, the original data will become more and more unreadable.

OTOH I have seen one company with a *really* thorough disk & tape
cleaning technique:

1. writing zeroes all over
2. low level format
3. shredding the disc drive into small pieces
4. magnet treatment of the scrap metal
5. burning in their own waste incinerating plant

For "home use" a grinder/raw polish/sandblast treatment of both platter
sides should be fine, too... ;-)

Bye

Volker


--

Volker Tanger http://www.wyae.de/volker.tanger/
--------------------------------------------------
vtlists@wyae.de PGP Fingerprint
378A 7DA7 4F20 C2F3 5BCC 8340 7424 6122 BB83 B8CB

[Dana Hudes]

The NSA disagree and have conducted laboratory tests.
I work for NYC as a unix admin (Solaris). We use the sun format purge to
erase disks (that can be written to; drives that won't spin up or can't be
written are another problem).

I guarantee that a sufficiently strong degausser will erase your
data...along with the timing tracks and possibly burning out micromotors
and ball bearings. Its a question of how many oersteds you need for the
drive so that the magnetic field penetrates the housing (take out the
platters and you have another situation entirely).

I don't have the site bookmarked at home but NIST or NSA have a site which
reviews the degaussing equipment and other data erasure techniques.





On Wed, 20 Jul 2005, Jared Johnson wrote:

> All,
>
> Do you all agree with Peter Gutman's conclusion on his theory that data can
> never really be erased, as noted in his quote below:
>
> "Data overwritten once or twice may be recovered by subtracting what is
> expected to be read from a storage location from what is actually read. Data
> which is overwritten an arbitrarily large number of times can still be
> recovered provided that the new data isn't written to the same location as
> the original data (for magnetic media), or that the recovery attempt is
> carried out fairly soon after the new data was written (for RAM). For this
> reason it is effectively impossible to sanitise storage locations by simple
> overwriting them, no matter how many overwrite passes are made or what data
> patterns are written. However by using the relatively simple methods
> presented in this paper the task of an attacker can be made significantly
> more difficult, if not prohibitively expensive."
>
> It seems that the perhaps the only real way to rid your Hard Drives of data
> is to burn them.
>
> I'd love to hear some thoughts on this from security and data experts out
> there.
>
>
>
>

[Vincent DUVERNET]

every body speaks about hardware & the best way for datas to be
unrecoverable.
Where states can use eletron microcope or other great machines, data
encryption like EFS is another way to reinforce security no ?

++
Vincent

[underwood-de@hotmail.com]

I was in charge of a stand alone, 125 user, authorised to process up to and including secret, network for a number of years. Our cable infrastructure was fiber from server to the desktop with the only exposed piece of fiber being the LAN connection from
PC to the box. The hard drives were removeable, were locked up every night and random patrols were done nightly as well.

We were not allowed to do a seven pass government wipe to dispose of the drives as our security people deemed it inadequate, we turned them over to our classified waste people who stored them until there were enough to justify having the platters removed
and mechanicaly beaten into little lumps of metal.

It does come down to a proper Risk Threat Assesment, how valuable is your data and in our case how politicaly and militarily sensitive is it.

I personaly was quite happy that we were not responsible for ensuring the cleanliness of the drives when they went for disposal.

[Earnhart, Benjamin J]

I agree with most of what you say, and the general idea is valid. =
However, the specifics of=20

> then a full reformat is quite enough to cause them to move on=20
> to the next
> machine - they're not going to have the motivation or=20
> equipment to delve
> into a randomly selected disk.

is a dangerously na=EFve approach. With point-and-click easy to use =
freeware tools under windows, I can do almost 100% retrieval of files =
after a full reformat, and even after reloading the OS and using it for =
a while, the simple point-and-click freeware tools can retieve an awful =
lot of stuff. And if I have the skills to use more powerful, complex =
tools, I can do even better, without needing a lot of money, time, or =
even strong motivation.

Even for a home user, I'd recommend using a program that securely =
deletes stuff by actively over-writing with multiple passes of random =
data (sdelete and DBAN are a couple of my favorites). A format is *not* =
enough. Your general idea (that it depends on the motivation and =
resources available to the attacker) is good, just that your level of =
paranoia should maybe be turned up a notch :)

I'm not positive which Gutmann piece the OP was referring to, but if =
it's the one I'm thinking of, it's a bit dated -- his methods were =
briefly really popular as a shortcut to secure deletion, but if they're =
the ones I think he's referring to, then they don't work with more =
modern file systems, so simple random passes are better, though more =
costly to implement. =20


> -----Original Message-----
> From: Jeremy Epstein [mailto:jeremy.epstein@webmethods.com]=20
> Sent: Thursday, July 21, 2005 2:01 PM
> To: Jared Johnson; focus-ms@securityfocus.com
> Cc: bugtraq@securityfocus.com
> Subject: RE: Peter Gutmann data deletion theaory?
>=20
> Like anything in security, "it depends". In particular, it=20
> depends on what
> the assumed adversary motivations and capabilities are. If=20
> the adversary is
> a nation-state with electron microscopes and other expensive=20
> devices, and
> the disk is believed to have held highly classified information, it's
> clearly true that the only way to destroy the data is to burn=20
> the disk (and
> in the right way). If, on the other hand, the adversary is=20
> someone who's
> randomly buying used computers in hopes of finding carelessly=20
> deleted files,
> then a full reformat is quite enough to cause them to move on=20
> to the next
> machine - they're not going to have the motivation or=20
> equipment to delve
> into a randomly selected disk.
>=20
> Where in between these two extremes it's necessary to burn=20
> the disk is an
> exercise left to the reader ;-) You really have to do a risk=20
> analysis... If
> it's cheaper / easier / less dangerous for the adversary to=20
> dumpster dive to
> get hardcopies or bribe someone or hack into the system, then=20
> destroying the
> hardware is putting the effort in the wrong place. For a lot=20
> of classified
> systems, the assumption is that obtaining used disks is a low=20
> cost attack,
> so it's cost effective to use destruction.
>=20
> --Jeremy
>=20
> > -----Original Message-----
> > From: Jared Johnson [mailto:jaredsjazz@Yahoo.com]=20
> > Sent: Wednesday, July 20, 2005 7:49 PM
> > To: focus-ms@securityfocus.com
> > Cc: bugtraq@securityfocus.com
> > Subject: Peter Gutmann data deletion theaory?
> >=20
> > All,
> >=20
> > Do you all agree with Peter Gutman's conclusion on his theory=20
> > that data can never really be erased, as noted in his quote below:
> >=20
> > "Data overwritten once or twice may be recovered by=20
> > subtracting what is expected to be read from a storage=20
> > location from what is actually read. Data which is=20
> > overwritten an arbitrarily large number of times can still be=20
> > recovered provided that the new data isn't written to the=20
> > same location as the original data (for magnetic media), or=20
> > that the recovery attempt is carried out fairly soon after=20
> > the new data was written (for RAM). For this reason it is=20
> > effectively impossible to sanitise storage locations by=20
> > simple overwriting them, no matter how many overwrite passes=20
> > are made or what data patterns are written. However by using=20
> > the relatively simple methods presented in this paper the=20
> > task of an attacker can be made significantly more difficult,=20
> > if not prohibitively expensive."
> >=20
> > It seems that the perhaps the only real way to rid your Hard=20
> > Drives of data is to burn them.=20
> >=20
> > I'd love to hear some thoughts on this from security and data=20
> > experts out there.
> >=20
> >=20
> >=20
>=20

[Jared Johnson]

Interesting. Well it all makes sense. I'm trying to setup a routine for =
our
corporation to regularly wipe our old hard drives before dumping and
donating them. It's fairly sensitive data in that if our competitors got =
a
hold of it, it would probably put us out of business.=20

Seems that just the simple DoD standard should suffice though.=20

Thanks for all your responses.

=20

-----Original Message-----
From: Simple Nomad [mailto:thegnome@nmrc.org]=20
Sent: Thursday, July 21, 2005 3:07 PM
To: bugtraq@securityfocus.com
Cc: Jared Johnson; focus-ms@securityfocus.com
Subject: Re: Peter Gutmann data deletion theaory?

On Wednesday 20 July 2005 18:48, Jared Johnson wrote:
> Data overwritten once or twice
<snip>

The quote is from 1996. I spoke with Guttman about this at AusCERT a few
years ago and even *he* doesn't believe it anymore. Drive technology has
changed substantially since then.

The main areas where criminals get caught with bad stuff on their drives =
by
forensics people is from 1) not knowing where the data is being written =
to
(browser cache, swap file, etc) 2) not doing any overwrite of the data =
as a
part of deletion, and 3) not taking into consideration such items as =
file
slack.

Drives that do caching and file systems that do journaling also may be a
factor. That being said, 3 wipes are "good enough for government work". =
DoD
5220.22-M chapter 8 subsection 306 in the Cleaing and Sanitization =
Matrix
shows under the Magentic Disk section that to properly sanitize a
non-removable rigid drive, that the choices of degaussing, destruction =
of
the drive, or a 3 pass wipe are acceptible methods for disk sanitation. =
Note
that the 3 pass wipe method is NOT acceptable for drives that contained =
Top
Secret information - so unless the drive contained Top Secret material,
you're covered.

It should be noted that this issue has been done to death on bugtraq =
several
times.

--=20
# Simple Nomad, C=B2ISSP -- thegnome@nmrc.org #
# C1B1 E749 25DF 867C 36D4 1E14 247A A4BD 6838 F11D #
# http://www.nmrc.org/~thegnome/ #