Security Basics mailing list archives

Re: Advice regarding servers and Wiping Drives after testing


From: Robert Inder <robert () interactive co uk>
Date: 12 Sep 2007 12:21:18 +0100


Ansgar -59cobalt- Wiechers writes:
    > Date: Sun, 2 Sep 2007 20:17:06 +0200
    > To:
    > Subject: Re: Advice regarding servers and Wiping Drives after testing

    >> I see osx disk utility can with write zeros once, or write zeros many
    >> times. Is there any advantage in multiple writes?

    > The magnetic media in your harddisk are analog, so even after
    > overwriting the media with zeroes there may be some residual magnetism
    > left from which the original data might be reconstructed. However, that
    > will require opening the case and examining the actual platters with
    > Magnetoforce Microscopy or something. 

I had heard it was easier than that.

Looking at the analog properties of the signal produced by the normal
read head is sufficient.  The signal produced by a 1 written over a 0
is subtly different from the signal from a 1 written over a 1.  And,
indeed, a 1 written over a 1 written over a 1 is itself subtly
different from a 1 written over a 1 written over a 0.

So just looking at the precise voltage coming out of the drive's own
read head lets you reliably "see" back a number of "generations".  

If that is true, just adding some new digitising electronics to the
drive would let you read its previous states at normal drive access
speed.  In which case I'd be very surprised if various government
agencies (at least) don't have the wherewithall to analyse a
drive very quickly.

The random variability associated with (enough) multiple re-writes
would mask these effects.  

Robert.

--
Robert Inder      Interactive Information Ltd,          Registered in Scotland
07808 492 213     3, Lauriston Gardens,                  Company no. SC 150689
0131 229 1052     Edinburgh EH3 9HH
                  SCOTLAND UK             Interactions speak louder than words


Current thread: