Re: Hard drives v. CF/Smart media/etc.

[Alloishus BeauMains <all0i5hu5 () gmail com>]

I am not sure about the x-ray machine. Probably might do something on
a magnetic platter. Probably won't do anything to flash media. I don't
know for sure..I haven't read about any cases involving that.

If I come across something I will post it. I might actually walk over
to a nearby hospital one day and try it out even.

On 10/18/05, Herman Frederick Ebeling, Jr. <hfebelingjr () lycos com> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> - ----Original Message----
> From: Alloishus BeauMains [mailto:all0i5hu5 () gmail com]
> Sent: Tuesday, 18 October, 2005 20:11
> To: hfebelingjr () lycos com
> Cc: gillettdavid () fhda edu; security-basics () securityfocus com
> Subject: Re: Hard drives v. CF/Smart media/etc.
>
> : Most Media referred to as a Hard Drive isn't currently flash media.
> : They are for the most part still magnetic heads reading platters. This
> : goes for the newer USB Hard Drives as well. However, I know that there
> : are large flash drives, and those fall under flash memory as much as
> : any other flash type device (USB drive, etc).
> :
> : It only takes one overwrite after a format to pretty much thoroughly
> : screw up a hard drive recovery. As far as I know, there isn't a
> : published way to retrieve that information, although I have read of a
> : high profile recovery outfit (and it was like $6k for each gig)
> : recovering tidbits of information. Using a ghost image of garbage
> : usually works pretty well, especially since you can tell the ghost
> : image to pull the entire size of the drive. Overwriting data on a
> : small drive might not be a problem....load it up with your the
> : pictures of your favorite car. Overwriting data on a huge drive is a
> : beast. In those cases, there is a device that will rearrange the
> : electrons on the magnetic discs to make data hard to recover.
>
> Yep, and IF I remember correctly on last seasons CSI: NY Sinise' character used
> a piece of equipment that I was frankly
> more then a little surprised to see the NYC police have in their arsenal.
>
> :
> : If a hard drive has a flash memory cache, then the best way to do it
> : would be to format the drive, and then go ahead and rearrange the
> : electrons.
> :
> : At any rate, there are professional tools to completely erase drives.
> : I only added that tidbit on magnetic platters because you would be
> : surprised at how many people believe that using a strong magnet will
> : erase an HD. That is a myth. You cannot use a magnet to erase a hard
> : drive reliably, and you cannot use a magnet at all to erase flash
> : memory (The magnet that you would need to do that would have to be the
> : size of your house, and have a better chance of sucking electrons from
> : your skin than it would erasing the flash drive).
>
> What if any effect would an X-Ray machine have on it?
>
> :
> : I cannot stress enough for people to wipe out those drives before
> : throwing them away! If you don't plan on using the drive anymore....go
> : ahead and drill a hole in it or something similar to destroy the
> : drive. Then you never have to worry about it.
>
> Yep, the ole "Black & Decker" eraser, followed by the ole 10 oz ball peen hammer
> to the platters, followed by a bath in
> acid, followed by a trip to a fireplace.  Love to see someone get data after all
> of that. . .;-)
>
> :
> : "I would have thought with that element to flash memory that there
> :: isn't/wouldn't/shouldn't be a "ghost" image of the
> :: data that had been stored there."
> :
> : I think you misunderstood me there....There isn't a ghost image at all
> : on flash memory. After the logic is changed, then that is it. No need
> : to do anything else with flash memory other than format it to clear it
> : out (Or you can overwrite it.)
>
> Ok, sorry, for the misunderstanding.  So then all one needs to do is erase the
> files from a flash drive, then reformat
> it, and they're gone for good. . .
>
> Herman
>
> :
> : On 10/18/05, Herman Frederick Ebeling, Jr. <hfebelingjr () lycos com> wrote:
> ::
> :: -----BEGIN PGP SIGNED MESSAGE-----
> :: Hash: SHA1
> ::
> :: - ----Original Message----
> :: From: Alloishus BeauMains [mailto:all0i5hu5 () gmail com]
> :: Sent: Tuesday, 18 October, 2005 14:50
> :: To: gillettdavid () fhda edu
> :: Cc: hfebelingjr () lycos com; security-basics () securityfocus com
> :: Subject: Re: Hard drives v. CF/Smart media/etc.
> ::
> ::: Yes and no. Delete may have a recovery option.
> :::
> ::: However, formatting a drive with flash memory offers no protection
> ::: that I know of, unless the information is cached (backed up) to a
> ::: separate media.
> ::
> :: I presume that your talking about a USB key, and not a HD that has a flash
> :: memory cache, right?
> ::
> :::
> ::: The reason is that flash memory is either there or it isn't, as
> ::: determined by chip/connection logic.
> ::
> :: I would have thought with that element to flash memory that there
> :: isn't/wouldn't/shouldn't be a "ghost" image of the
> :: data that had been stored there.
> ::
> :::
> ::: However, on a normal hard drive or floppy disc with platters, there is
> ::: a magnetic resonance that is left behind, so even if the electrons are
> ::: scrambled, it is possible to still retrieve that information.
> ::
> :: Yep, and depending on how badly someone wanted said data it is "always"
> :: recoverable.
> ::
> :::
> ::: So this leads to a side question: How to keep others from retrieving
> ::: information from one of those media varieties?
> :::
> ::: Answer: There are two ways: 1. Destroy the media. 2. Overwrite the
> ::: media with garbage (Although this won't utterly completely keep
> ::: someone from retrieving the information....whoever wanted it would
> ::: have to pay dearly).
> ::
> :: How many times of overwriting would it take to decrease the chances of it
> :: being recovered?
> ::
> :::
> ::: I am not aware of any tools that do data retrieval from a flash drive
> ::: unless it is being copied to another location...so if anyone knows of
> ::: anything different, let me know.
> :::
> ::: On 10/18/05, David Gillett <gillettdavid () fhda edu> wrote:
> ::::  Yes.  My dad accidentally deleted half the digital pictures of
> :::: his and my mom's "cruise of a lifetime" (50th anniversary) off the
> :::: flash memory card from his camera, and a garden-variety deleted file
> :::: recovery utility got them back.
> ::::
> :::: David Gillett
> ::::
> ::::
> ::::: -----Original Message-----
> ::::: From: Herman Frederick Ebeling, Jr. [mailto:hfebelingjr () lycos com]
> ::::: Sent: Monday, October 17, 2005 4:26 PM
> ::::: To: security-basics () securityfocus com
> ::::: Subject: Hard drives v. CF/Smart media/etc.
> :::::
> :::::
> ::::: -----BEGIN PGP SIGNED MESSAGE-----
> ::::: Hash: SHA1
> :::::
> ::::: Here's a good question that I don't think I've seen any
> ::::: articles on.  As we all know even though that just because a
> ::::: file is "deleted" from a HD doesn't mean that the info is
> ::::: really "deleted" as it can (depending on how badly someone
> ::::: wants to) be recovered.  Does the same hold true for CF/Smart media/etc.
> ::::: types of media?
> :::::
> ::::: Herman
> :::::
> ::::: -----BEGIN PGP SIGNATURE-----
> ::::: Version: PGP 8.0.3
> :::::
> ::::: iQA/AwUBQ1Qw2h/i52nbE9vTEQLdgwCffPxDF1rD3hx8kpaNq5uYro8647IAoL3H
> ::::: Wfht/XL5GxoPLbli59+iKmzM =UIqO
> ::::: -----END PGP SIGNATURE-----
> ::
> :: -----BEGIN PGP SIGNATURE-----
> :: Version: PGP 8.0.3
> ::
> :: iQA/AwUBQ1V2Cx/i52nbE9vTEQJQlwCgsCzlbp5+fLUSfA9ADFq3qhf/GLYAoIVj
> :: ArRJ1/ADXuZ2R6P/wLNflTD4 =Gj7X
> :: -----END PGP SIGNATURE-----
>
> -----BEGIN PGP SIGNATURE-----
> Version: PGP 8.0.3
>
> iQA/AwUBQ1WcUB/i52nbE9vTEQLYKACfRtLQrRa95BkkA71A4J0HkoC+3jYAnRr1
> 9Z7a3aVKbAMgyeP9eUXCp1Na
> =G4NP
> -----END PGP SIGNATURE-----