Why can data still be read when a disk is completely erased?

Question

I understand that normal delete operations only delete the file identification information, but not the file contents itself. I'm talking, though, of writing all zero's or all ones on a disk on an extreme low level format. Some disk forensics can still read data. How can that happen?

Answer 1

If you use software to scrub your drive (writes over everything), the data is not recoverable.

People CLAIM that you can recover stuff based on the idea that the write head will not be perfectly aligned with the tracks each time - over yonder on the other edge of the track are some residual patterns you can read with special hardware.

This was partly true in the early 1990's and earlier when drive mechanics and electronics were big and sloppy (relatively speaking). The legend lives on.

But it just isn't going to happen with new stuff. The track-track spacing and precision required is too tight. If you write over the bits, the data is gone, never to be recovered by any tool.

If a 'forensics tool' recovers any data, it is because it was not erased. Period.

The usual recovery process is about scanning unused sectors, temp files, and residue in file slack space. To ensure your plans for world domination are secure, you need to do a low level format and a high level format afterwards.

Answer 2

When data is written to the disk, there are slight variations on where the exact bit was written. This means that when you wrote a zero over a one, part of the one may still be there even though only slightly. Then a statistical analysis of the comparison of magnetic fields of data you thought you zeroed can be used to determine what the old data was. Also, I don't know if this technology is used, but a higher resolution MR head than was originally used to write the data could theoretically be used to read the partial bits and tell what the data was.

There are programs available that will securely erase data by writing a series of patterns over each byte of data sequentially. There is even a DoD standard for how secure this erase must be to make the government happy.

Answer 3

Because in a basic format, you are not overwriting the disk, you are simply writing over the file allocation table. If you reconstruct the table, you can get to the data. The forensics can use specialized equipment to read the traces of the original magneticized platters.

If you really want to get rid of it, you have to follow what major companies do, and do several low level formats, writing the disk full of 1s then 0s in another pass. Do this several times, the disk will become un-recoverable.

Answer 4

It is magnetism, as well as lazy deletion methods employed by operating systems. The data is still there, the operating system just tells the computer it is OK to over-write the data later. It marks it for destruction and leaves the data to rot, more or less.

As mentioned above, the only way to ensure total data annihalation is to either magnetize the drive or to write over the entire disk MANY times which can be a rather tedious endeavor.

Answer 5

Residual magnetism. Some companies sell programs that write random patterns over and over to try to destroy the data but if the head tracks are just a bit off the old stuff is just laying there in the space between tracks waiting for someone with the time and money to read it.

Only way to be sure: take the magnetic disk out of the drive and hammer the hell out of it... That makes it really unreadable (mashes and re-arranges the magnetic domains).

Answer 6

Because all the information hasn't been erased, unless I guess you take a strong enough magnet to it. Also, " If you delete a program or format your hard disk, there's always a chance your data can be recovered. If you want to completely erase data, eliminating any possibility of recovery, consider using this free, DOS-based utility. To use the program, you boot in DOS mode from a floppy disk. The utility then erases your drive's data. Because the utility bypasses your drive's logical drive structure organization, it does not matter what operating system you're running: you can use the utility in Windows 9x, Windows NT, Windows 2000, Windows XP, Linux, or Unix for PC. This program conforms to US Department of Defense's standards (5220.22-M) for clearing and sanitizing standard sensitive information."

Answer 7

I think the best way to erase any information would be melting the hard drive (properly melted) . That eliminates all of the above mentioned recovery systems.

Answer 8

Because the data isn't actually erased, the pointers to it are removed. It is only overwritten when something else is written over the newly freed space.

Answer 9

Wanna delete your hard drive? .........Geo magnets!


of course you wont be able to use the drive ever again

Answer 10

new info is overidding it, it's just making the space available...