Re: Advice regarding servers and Wiping Drives after testing

On 2007-09-11 William Holmberg wrote:
On Tuesday, September 04, 2007 1:03 PM Ansgar -59cobalt- Wiechers wrote:
On 2007-09-01 gjgowey@xxxxxxxxxxxxxxxxxx wrote:
A since pass with all zero's really won't protect your data from
being recovered by more advanced data recovery software let alone
alone hardware.

I'd like to see a single case where someone was able to recover data
from an overwritten harddisk, even after a single pass with zeroes.

No doubt you are an intelligent and well educated person in these
fields, and probably have many areas of expertise more proficient than
mine. I do have to state however, and nearly any Infragard member can
tell you, the FBI uses tools that accomplish this on a regular basis.
I have no doubt other agencies do as well. We have had demonstrations
of it remotely in a class I help instruct, SAFE computing for Law
Enforcement and Non-Profits (SAFE is Security And Forensic Education)
at Metro State University of Minnesota, MCTC campus.

Demonstrations of recovering data from fully overwritten media, without
opening the case? Sorry, but I seriously doubt that. Feel free to prove
me wrong, but without evidence I find that really hard to believe. Keep
in mind we're not talking about wiping single files, but overwriting the
entire media.

Regards
Ansgar Wiechers
--
"All vulnerabilities deserve a public fear period prior to patches
becoming available."
--Jason Coombs on Bugtraq

Relevant Pages

  • Re: Advice regarding servers and Wiping Drives after testing
    ... Advice regarding servers and Wiping Drives after testing ... being recovered by more advanced data recovery software let alone ... Demonstrations of recovering data from fully overwritten media, ... in mind we're not talking about wiping single files, but overwriting the ...
    (Security-Basics)
  • Re: Advice regarding servers and Wiping Drives after testing
    ... being recovered by more advanced data recovery software let alone ... alone hardware. ... from an overwritten harddisk, even after a single pass with zeroes. ...
    (Security-Basics)
  • bugtraq@planetcobalt.net
    ... "Overwriting Hard Drive Data: The Great Wiping Controversy". ... modern ePRML drives. ... of a few regarding data recovery after a file has been 'zeroed' and ...
    (Security-Basics)
  • Re: FileCopy overwrites the existing file
    ... overwriting large file is quite expensive and if I had to do it, ... I've seen a software that allows a user to overwrite the sectors up ... overwritten once with zeros. ... I wouldn't assume such recovery is a regular offer. ...
    (microsoft.public.win32.programmer.kernel)
  • Re: what happens to deleted files
    ... It has never been done, not even by Dr. Gutmann himself, and he is the one who first advanced the theory that it might be possible to recover data from overwritten drives. ... The best that Dr. Gutmann could do with MFM was to show that there "might" be a possibility that some bits of data might be recoverable, he was never able to recover actual files and he has never been able to publicly demonstrate that he actually could recovery files on zero written drives, and nobody else either ever could. ... The reason that the US government or any other entities who work with very sensitive data might melt or destroy drives instead of securely overwriting them is not because of the possibility of data recovery on these drives, it is because of the possibility of user or software errors when doing the wiping. ... There is one area which can be of real concern with regards to wiped drives and where actual "bits" of data recovery could be made, cluster tips. ...
    (microsoft.public.windowsxp.help_and_support)