[Bulk] Re: What's in my hard drive? How can I get rid of it?

Ralf Mardorf ralf.mardorf at rocketmail.com
Wed Feb 18 01:02:46 UTC 2015


On Tue, 17 Feb 2015 18:37:38 -0600 (CST), Valeri Galtsev wrote:
>
>On Tue, February 17, 2015 5:30 pm, Daniel Feenberg wrote:
>>
>>
>> On Tue, 17 Feb 2015, Michael Powell wrote:
>>
>>> jd1008 wrote:
>>>
>>> [snip]
>>>
>>> Remove the cover. Remove the platters. Smash all platters with large
>>> sledge
>>> hammer until all pieces are fairly small. Melt material with
>>> oxyacetylene
>>> welders torch. Repeat smashing with hammer. Soak for few hours in
>>> hydrofluoric acid. Rinse and allow to dry. Grind material into a
>>> fine particulate dust. Dispose of out the back of airplane while
>>> flying or drop
>>> into convenient nearby volcano. That might be good enough.
>>>
>>> Send the electronic components to Kaspersky for analysis.
>>
>> I did once investigate claims that overwritten sectors could be read
>> by sophisticated instruments and posted my results at:
>>
>>    http://www.nber.org/sys-admin/overwritten-data-gutmann.html
>>
>>
>> In short - that is pure science fiction.
>>
>
>Interesting. I never saw this particular explanation. I have heard that
>overwiritten data can be recovered (to significant extent). Due to
>different reason. I lost the reference, so let me try to reproduce what
>I've read (and that didn't and still doesn't offend my university
>degree knowledge, physics was part of it):
>
>If some information sits intact for years (that is without any change
>in particular physical places on disk platters), then over time due to
>some sort of aging magnetic domains become slightly different (in
>size, maybe?) in places where magnetization is in one direction from
>that in the other direction. If to overwrite that information, nothing
>original becomes readable. If, however you magnetize the whole bulk of
>platter in one direction, then the areas that were magnetized for very
>long time in one direction have slightly different residual
>magnetization from areas magnetized for long time in different
>direction. This difference is much smaller that sensitivity of regular
>drive magnetic heads and pre-amlifier. However, more sensitive
>equipment is capable to detect that thus very significant portion of
>information can be recovered (not 100% though). You can recover
>information even if it was overwritten with some new junk, provided
>this junk didn't sit there comparably long.
>
>One still can fully wipe the information, even sitting there due to
>those "aged magnetic domains" if one re-magnetizes platters in opposite
>directions many times (over 1000) going deeply into hysteresis every
>time. One time overwriting data is definitely not enough. Using some
>50-100 cycles may not be sufficient either (but already this number of
>cycles becomes impractical with all software based destroying of
>information).
>
>Sorry about long e-mail. Sledge hammer and shredder are the best for
>the purpose ;-)

Actually criminal investigation departments seems to be unable to
recover all the data that was deleted by a simple rm command, even on
journaling file systems. Why is it recommended to mount read only, as
soon as possible, if we lose data, to be able to recover that data?

The NSA is able to recover all the data that was deleted all over the
world even by a shred command on a non-journaling FS? If so, the NSA
isn't willing to give hints against child molesters and other criminals,
because the NSA is the watchdog of more important crimes? That's
grotesque.


More information about the freebsd-questions mailing list