Hi there:
I read all the answers posted earlier, and the suggestions, to put on garbage data and viruses, and burn, shoot, dump in the river, hammer, are a waste of a totally good harddrive. There was only ONE reasonable answer to use killdrive.
You do not want to DESTROY the harddrive itself - you just want to remove the DATA that is written on the harddrive. It is
un-economical to just throw away the entire harddrive, just to
remove a few files, and even the government and large agencies
who have huge amounts of " secret" information, will REMOVE
data, and re-use the old drives. If they BULK remove old
computers that are " END OF LIFE", they will crush the harddrives in a corrugated crusher, but this is just a disposal
situation, and valueable hardrives, re-used internally would
just have the data erased-- properly!
On the web, you will find people asking the same type of
question as yourself:
_______________________________
> I am looking for information concerning computer data
recovery.
> With todays computer hardware is it possible to verify if a
hard
> drive was replaced within a certain period of time. Also, if
> someone 'scrubbed' their computer (deleting and refilling in
> sectors with new bits of info), is there any way to recover
the
> information that the person tried to hide? Any info is
appreciated.
There are a lot of "it depends" in answering your questions;
computers,software, operating systems, etc. are so complex that every situation is unique. Generally, yes, it is possible to determine when a hard drive was
placed into service. It is often possible to tell that data has
been purposefully deleted or destroyed. Depending on the manner that the data has
been deleted, destroyed, or hidden, it can often be recovered.
Microsoft operating systems tend to be very sloppy (infosec wasn't considered...) and often save information, unbeknownst to the user, to various areas of the hard drive.
Information that has actually been written over is, for most
practical purposes, lost. If that same information happens to have been written elsewhere on the drive, it can be recovered there. It is possible to recover information that has been overwritten, but you will need the budget of a small country. The information is recovered using Scanning Tunnel Microscopy. For this reason, the government usually shreds or melts hard drives that have contained sensitive information. While STM is extremely
expensive today, it may well be affordable in a few years.
As with TSCM, anybody can attempt computer forensics. The
professionals will be trained, experienced, and equipped to do the best job possible. A non-pro almost always makes a mess out of the hard drive, often destroying evidence.
Computer forensics is a lot like TSCM, you have to be at least
as good as your opponent, or luckier...
Best Regards, Doug Rehman
__________________________________
What Doug is referring to above, is the taking apart of a
harddrive, removing each disc platter, one by one, and putting
the platter on a Scanning Tunnel Microscope, to read tiny
traces of " OLD " data, under the " new " data.
What you are dealing with, is magnetic regions of North and
SOuth poles, laid down in tracks in rings around the platter.
If the single bit is a SOUTH, and is the only time data was
recorded, there is just a 100% South magnetic spot. But, if the
SOUTH was previously a North, then the existing SOuth is not as
strong - this would be intrepreted as having been a North
poled magnetic spot.
As Doug states, the dissassembly, and scanning and analysis,
disc by disc requires HUGE amounts of time and money usually
only available to huge companies or governments.
Another snippet on the web talks about the standard government
wipe scheme:
___________________________
It is my understanding that if the government wipe of 7x
rewrite (1 followed by 0 followed by a random three digit
number) is used recovery of data is impossible. With the 3x
standard available from some programs, including Norton, some
recovery may be possible, although not likely. As for the date
of installation and removal that should be recoverable, but may
be over written on the
hard disc if the unit is reinstalled in another computer,
therefore, go to the pros.
____________________________
This person states that a standard government wipe is 7 times
an overwrite of the disk. You write new data on the disk 7
times, with RANDOM information. SO that one bit would be North, then South, then South, then North, then North, then South,
then South, so that the ORIGINAL data underneath is so
obscured, that even Scanning Tunnel cant make out the 8th or
9th level of magnetization...
This person states that SOME programs, like the standard
NORTON 3 times wipe, CAN still show data, and that WIndows is bad for having data all over that is not accounted for...
What you want to do, is overwrite the existing data on your
harddrive a few times, so that residual traces of magnetic
poles are so confused, that no one can ever detect the bottom.
or oldest layer.
I would suggest that you FIRST go to the manufacturer of the
harddrive, and download the utility that FACTORY ZEROs the
harddrive. Maxtor has MAXBLAST, and Fujitsu has Disk Manager,
etc. and these are free utilities. Note that these DO NOT erase
underlying residual traces of information - they just remove
all traces of ANY available data that common techniqes to
UN-ERASE would be able to see.
THEN, secondly, run a few FREE data overwriter programs, and I would suggest using 3, since each would write on a different
format, totally scrambling the magnetic poles in 3 different
patterns..
Free Disk Wipe
http://www.freedownloadscenter.com/Utilities/File_Splitting_Utilities/Free_Disk_Wipe.html
Darik's Boot and Nuke
http://www.majorgeeks.com/Dariks_Boot_and_Nuke_CDRCDRW_Version_d4596.html
CyberShredder 1.10
http://majorgeeks.com/CyberShredder_d4823.html
DP WIPER
http://majorgeeks.com/DP_Wiper_d4916.html
ERASER
http://majorgeeks.com/Eraser_d4221.html
Simple File Shredder 3.0
http://www.majorgeeks.com/Simple_File_Shredder_d4744.html
UltraShredder 4.5.2
http://www.majorgeeks.com/UltraShredder_d5016.html
UltraWipe 1.5.1
http://www.majorgeeks.com/UltraWipe_d4758.html
http://killdisk.com/downloadfree.htm
Where you can download the windows version, the floppy version, the CD version and the MANUAL.
_____________________________________
For Government policies, see typically:
http://csrc.nist.gov/publications/nistpubs/800-88/NISTSP800-88_rev1.pdf
_____________________________________
Note that when you just " delete" a file using WIndows, all
you do is to put a "?" on the first letter of the filename, you
do not erase anything at all. WIndows Operating System has
permission to overwrite any file with the "?", so that once
overwritten, it is destroyed. If the file is NOT written with
new data, there are a hundred free programs that just search
the drive for files starting with "?", and they will show them
to you, COMPLETE !
The disk wiping programs WRITE data all over the drive,
obscuring the old magnetic fields, as I described above.
If you ZERO the drive ( which can take a long time on large
drives ) to remove ALL directory listings and commonly readable
data, and then use 3 or more DISK WIPER programs, no one should be able to read anything. You then have a complete computer, ready to go with a good harddrive.
Hope this helps
robin
2006-11-24 14:14:20
·
answer #1
·
answered by robin_graves 4
·
4⤊
0⤋