How does a 7- or 35-pass erase work? Why would one use these methods?

Question

How and why do 7- and 35-pass erases work? Shouldn't a simple rewrite with all zeroes be enough?

Answer 1

A single pass with zeros doesn't completely erase magnetic artifacts from a disk. It's still possible to recover the data from the drive. A 7-pass erasure using random data will do a pretty complete job to prevent reconstruction of the data on the drive.

Wikipedia has a number of different articles relating to this topic.

http://en.wikipedia.org/wiki/Data_remanence

http://en.wikipedia.org/wiki/Computer_forensics

http://en.wikipedia.org/wiki/Data_erasure

Answer 2

See: Secure Deletion of Data from Magnetic and Solid-State Memory

Answer 3

I'd never heard of the 35-part erase: http://en.wikipedia.org/wiki/Gutmann_method

The Gutmann method is an algorithm for securely erasing the contents of computer hard drives, such as files. Devised by Peter Gutmann and Colin Plumb, it does so by writing a series of 35 patterns over the region to be erased. The selection of patterns assumes that the user doesn't know the encoding mechanism used by the drive, and so includes patterns designed specifically for three different types of drives. A user who knows which type of encoding the drive uses can choose only those patterns intended for their drive. A drive with a different encoding mechanism would need different patterns. Most of the patterns in the Gutmann method were designed for older MFM/RLL encoded disks. Relatively modern drives no longer use the older encoding techniques, making many of the patterns specified by Gutmann superfluous.[1]

Also interesting:

One standard way to recover data that has been overwritten on a hard drive is to capture the analog signal which is read by the drive head prior to being decoded. This analog signal will be close to an ideal digital signal, but the differences are what is important. By calculating the ideal digital signal and then subtracting it from the actual analog signal it is possible to ignore that last information written, amplify the remaining signal and see what was written before.

Answer 4

7 pass and 35 pass would take forever to finish. HIPAA only requires DOD 3-pass overwrite, and I am not certain why DOD even has a 7 pass overwrite as it seems they just simply shred the disks before disposing of machines anyway. Theoretically, you could recover data off of the outer edges of each track (using a scanning electron microscope or microscopic magnetic probe), but it practice you would need the resources of a disk drive maker or one of the three letter government organizations to do this.

The reason to perform multipass writes is to take advantage of the slight errors in positioning to overwrite the edges of the track also, making recovery far less likely.

Most drive recovery companies can't recover a drive that has had its data overwritten even once. They are typically taking advantage of the fact that Windows doesn't zero out the data blocks, just changes the directory to mark the space free. They simply 'undelete' the file and make it visable again.

If you don't believe me, call them up and ask them if they can recover a disk that has been dd'ed over... they will typically tell you no, and if they do agree to try, it will be serious $$$ to get it back...

DOD 3 pass followed by a zero overwrite should be more than sufficent for most (i.e. non- TOP SECRET) folks.

DBAN (and its commercially supported decendent, EBAN) do this all cleanly... I would recommed these.

Answer 5

As mentioned before, magnetic artifacts are present from the previous data on the platter.

In a recent issue of MaximumPC they put this to the test. They took a drive, ran it through a pass of all zeros, and hired a data recovery firm to try and recover what they could. Answer: Not one bit was recovered. Their analysis was that unless you expect the NSA to try, a zero pass is probably enough.

Personally, I'd run an alternating pattern or two across it.