RE: Peter Gutmann data deletion theaory?

From: Robert Thompson Jr. (rthompson_at_columbiabank.com)
Date: 07/21/05

  • Next message: Cesar: "[Argeniss] Oracle 9R2 Unpatched vulnerability on CWM2_OLAP_AW_AWUTIL package" 
    Date: Thu, 21 Jul 2005 12:03:06 -0700
To: "Jared Johnson" <jaredsjazz@Yahoo.com>, <focus-ms@securityfocus.com>

    "Do you all agree with Peter Gutman's conclusion on his theory that data
    can never really be erased, as noted in his quote below:"

    Absolutely...

    If you have ever done any form of data recovery, you will see how much
    information is recoverable, with just basic tools off of the internet.
    If you haven't, just google "data recovery", find almost any program
    with a free demo and take a hard drive, catalog it, format it (after
    backing up what you need of course) then recover it. Watch how much
    information you retrieve. Should be all of it, and then some.

    I recall the first time I ever did a recovery from a hard drive that had
    something off happen to it. I pulled up information on that drive from
    back when it was first used. YEARS before...

    That is just with a basic program off of the internet.

    With wiping/sanitizing of your hard drives, you have elimiated having to
    worry about any mediocre programs doing any data recovery, but "good"
    programs or hardware recovery is still an option. The software recovery
    will eventually fail if you are careful enough...

    Now imagine what a hardware based recovery could pull off?

    I would recommend using the sanitizing products as they will help keep
    the people that don't have the time or money from locating anything on
    your box, but for those out there that have the money or have the time,
    they will be able to get just about anything off of your disk.

    To keep your drives completely secure, you have two choices: either
    don't use them, ever... OR physically destroy them when you are
    finished.

    Rob.

    -----Original Message-----
    From: Jared Johnson [mailto:jaredsjazz@Yahoo.com]
    Sent: Wednesday, July 20, 2005 4:49 PM
    To: focus-ms@securityfocus.com
    Cc: bugtraq@securityfocus.com
    Subject: Peter Gutmann data deletion theaory?

    All,

    Do you all agree with Peter Gutman's conclusion on his theory that data
    can never really be erased, as noted in his quote below:

    "Data overwritten once or twice may be recovered by subtracting what is
    expected to be read from a storage location from what is actually read.
    Data which is overwritten an arbitrarily large number of times can still
    be recovered provided that the new data isn't written to the same
    location as the original data (for magnetic media), or that the recovery
    attempt is carried out fairly soon after the new data was written (for
    RAM). For this reason it is effectively impossible to sanitise storage
    locations by simple overwriting them, no matter how many overwrite
    passes are made or what data patterns are written. However by using the
    relatively simple methods presented in this paper the task of an
    attacker can be made significantly more difficult, if not prohibitively
    expensive."

    It seems that the perhaps the only real way to rid your Hard Drives of
    data is to burn them.

    I'd love to hear some thoughts on this from security and data experts
    out there.

  • Next message: Cesar: "[Argeniss] Oracle 9R2 Unpatched vulnerability on CWM2_OLAP_AW_AWUTIL package"

    Relevant Pages

    • ~~~~~ HARD DRIVE ~~~~~
      ... hard drive information recovery software ... hard drive for dell latitude d800 ... hard drive not recognized in enclosure ...
      (rec.arts.theatre.stagecraft)
    • Re: SHRED for EXT3?
      ... On Tue, 2005-07-26 at 13:41 -0400, Scot L. Harris wrote: ... > conducted where they bought used hard drives from ebay. ... > recovery methods were used and the researchers were able to recover a ...
      (Fedora)
    • Re: New Computer, No Original Win XP disk
      ... as I said they only have to provide a method recovery to as shipped - thus his hidden partition is sufficient is that is what the OEM chooses to do. ... Yes, I have two physical hard drives, I ...
      (microsoft.public.windowsxp.general)
    • [SLE] Disaster Recover Preparation -- How to do it?
      ... I have 2 usb 2.0 ports and two USB ... hard drives with 120G each of storage on them, ... I am currently running 8.1 Pro, my original SuSE version. ... do a full recovery, and everything comes back and works perfectly. ...
      (SuSE)
    • Re: Hard Drive data security (magnet link)
      ... The company that provides the magnets responded. ... the ceramics, but I believe they're still about $15 --don't ... class 8 ceramic magnet...but hard drives, ... >this aspect of data recovery. ...
      (Security-Basics)