Solved I need more than 1 pass in Shredd Method?

[seventrad]

[SOLVED] I need more than 1 pass in Shredd Method?

Hi,

When I overwritten a data with only 1 pass or when the data is superscript, a lost the old data forever or not? Why I need more than 1 pass to secure delete my data?

 

[FliGi7]

If data is overwritten once, it is gone. I'm not sure what you mean when it is superscript, though.

 

[seventrad]

If data is overwritten once, it is gone. I'm not sure what you mean when it is superscript, though.

I was not clear, sorry!

If when I use a "erase software" with only 1 pass or when data is overwritten by another file of SO (data file, mp3, movie...), why exists many software with many methods of data erase (CCleaner, Eraser, Active@ Kill Disk, PGP...) ?

Methods of Data Erase:

• Bruce Schneier's algorithm
• Canadian OPS-II
• DoD 5220.22 M
• Gutmann's algorithm
• German VSITR
• HMG IS5 Baseline
• HMG IS5 Enhanced
• Navso P-5329-26 (RL)
• Navso P-5329-26 (MFM)
• NCSC-TG-025
• Russian GOST p50739-95
• US Army AR380-19
• US Air Force 5020

 

[FliGi7]

The multiple passes date back to hard drives of many generations ago where data storage was much less dense and provided for greater ability for recovery with very sophisticated software. Current hard drive density doesn't nearly as easily allow for such things any more, so the multiple passes are for added feeling of security rather than actual. Data overwritten once on any remotely recent hard drive is gone. At best, with very expensive microscopy equipment, parts of sparse data could be recovered, but even then you'll be lucky to find anything contiguous or that you'd be able to piece back together into something whole.

 

[seventrad]

There are differences about this subject: https://www-secure.symantec.com/connect/forums/pgp-shredding-really-safe

 

[FliGi7]

As far as I'm aware, no one has produced any results publicly of data recovery of anything substantial after overwriting data once on a modern hard drive.

If you are just concerned about making sure your data is not recoverable, you can overwrite the data 35 times if that will make you feel more comfortable that it's gone.

 

[Britton30]

According to the 2006 NIST Special Publication 800-88 Section 2.3 (p. 6): "Basically the change in track density and the related changes in the storage medium have created a situation where the acts of clearing and purging the media have converged. That is, for ATA disk drives manufactured after 2001 (over 15GB) clearing by overwriting the media once is adequate to protect the media from both keyboard and laboratory attack."

Data erasure at Wikipedia

As a practice however, I use CCleaner's 7 pass option when running it.
As FliGi7 points out, this is due to very high density media. In older drive a, say 500MB drive would have 3 platters and therefore low density of data. I am currently running a 500GB drive which has only one platter.

 

[Thorsen]

try Eraser:

Eraser

This allows many different options from single file erasing, erasing entire recycle bin and even erasing full HDD's or just the unused data on an active HDD

all on a wide array of erase types:

35 pass Gutmann
7 pass Schneier
7 Pass DoD
3Pass DoD E
1 pass first last 2k
1 pass PsuedoRandom Data

Edit: Sorry misread your question as well. Posted as an easy third party app that I like for it.

 

[Bare Foot Kid]

Geez guys!

Secure Erase / Wipe : Definition and Methods <--Method Three
for an 11 pass file shredder

Additional Secure Erase / Wipe Information

SSD / HDD : Optimize for Windows Reinstallation




​

 

[Thorsen]

found something fun for everyone.

It is old and would, as stated above, only be useful to older drives under 15Gb, but I thought the information on how data is erased / recovered was an interesting insight into computer functionality.

This is a link (through Google) to a PDF:

counter forensic privacy tools - Google Search

and if you read just #passes on a file is not enough since the computer copies certain things in temp files and keeps track of file locations of these temps even after deletion of the original. when the temps are no longer being seen as deletable, they are still referenced and available on the unallocated disk space. meaning at least 1 pass of all unallocated disk space is a good idea as well.

 

[FliGi7]

So, there are two issues here...

1) Erasing a single file so that no trace is left behind

This requires overwriting the file, overwriting and temp files related to it (if it was ever auto-saved somewhere), erasing any remnants of it in system restore points, erasing links to it in the current registry (.LNK files, MRU's), erasing links to it in system restore point registries, and removing it from the MFT which requires knowing where it's stored in the MFT and erasing that block of information. Your best bet is to do as many of these things as possible and hope your system randomly overwrites the remaining info at some point in the future before someone else tries to find traces of the file.

2) Erasing a hard drive

This requires writing zeros (or random data or whatever you want) to a drive using something like DBAN or DD. It doesn't care whether the space is unallocated, temp storage, or anything of the sort. It writes zero's to the entire readable drive space so that nothing in any space on the disk is recoverable.

 

[Bare Foot Kid]

You do not need 3rd party software, Windows will do it all, single files or entire HDD / SSDs.

Secure Erase / Wipe : Definition and Methods


​

 

[Britton30]

OP was just asking if one overwrite was enough.

 

[Bare Foot Kid]

OP was just asking if one overwrite was enough.

For most instances it is.

 

[FliGi7]

Sdelete doesn't delete registry information as stated above, nor do I see that it deletes this data from system restore points (maybe it does, but it didn't say so in the tech description here SDelete). Sdelete securely deletes the file data so that the file is not recoverable (although it doesn't address restore points, which would allow for recovery of the file if not deleted), it doesn't appear to delete all traces of it having been there. There is a difference in being able to recover a file and being able to find traces of it, as I pointed out above. It depends on what the user is looking to do. The OP talks about just erasing the data then asks paranoid questions about how to make sure it's completely gone, so I'm not sure what they're actually looking to do here.

 

[seventrad]

The OP talks about just erasing the data then asks paranoid questions about how to make sure it's completely gone, so I'm not sure what they're actually looking to do here.

What I doing here? I'm looking for information!

I do this question because I'm confused about that Peter Gutmann believes:

"Gutmann claims that intelligence agencies have sophisticated tools, including magnetic force microscopes, which together with image analysis, can detect the previous values of bits on the affected area of the media (for example hard disk)." ("Criticism" section)
Gutmann method - Wikipedia, the free encyclopedia

I need to believe in secure references: Gutmann is Ph.D in Computer Science. He is specialist in cryptographic and computer security.
Peter Gutmann (computer scientist) - Wikipedia, the free encyclopedia

I searched about this question in other forums. Many people said different things.

Now, after the help all of you, I'm more secure about this matter. Especially after the Britton30's post.

Thank you all for the help!

 

[Britton30]

Glad you have the info you wanted seventrad.
Guttman did his theorizing and testing in the mid 90's, so most of what was true then, of course, doesn't apply now. It is interesting to read about his methods though. His reasoning of a 35-pass overwrite was to prevent electro-magnetic scanners or electron microscopy to recover data.

Footnote:
A group of Purdue University students, as an experiment, went out and bought several HDD's a few years ago. They were used and thought to be clean or non-functioning. they were able to recover passwords, email accounts, bank account numbers, pictures, medical records and more. The drives had all been at least reformatted too.

If when I use a "erase software" with only 1 pass or when data is overwritten by another file of SO (data file, mp3, movie...), why exists many software with many methods of data erase (CCleaner, Eraser, Active@ Kill Disk, PGP...) ?

All those were aimed at pre-2001 hard drives. The military and security agencies had the need for secure erasure, so developed those methods. These are all uneeded now to get the same level of erasure.
Of course the developers/vendors of these products want to keep selling them.

 

[Golden]

The multiple passes date back to hard drives of many generations ago where data storage was much less dense and provided for greater ability for recovery with very sophisticated software. Current hard drive density doesn't nearly as easily allow for such things any more, so the multiple passes are for added feeling of security rather than actual. Data overwritten once on any remotely recent hard drive is gone. At best, with very expensive microscopy equipment, parts of sparse data could be recovered, but even then you'll be lucky to find anything contiguous or that you'd be able to piece back together into something whole.

+1. All that is needed is method 3 in BFK's tutorial http://www.sevenforums.com/tutorials/172617-secure-erase-wipe-definition-methods.html