How is it possible to get data from a Zeroed Drive?
 

There was stupid news story on TV a few nights ago about how unsafe your computer is even if you turn it in to a recycling place. They got some computer expert, and gave him some old computers and had him get data off them. Of course the news recomended the top of the line harddrive wiping software blah blah blah a total prapaganda story about how everyon MUST protect themselves from the evil harddrive pirates. They then went back to the poor shmo who donated his computer to some charity (they sure tought him a lesson about donating his computer) and told him how they got his credit card numbers, his tax forms and all that. This didn't look like a very computer savvy user. He probably just ran a clean install of windows, if that.

But it got me to thinking. How is it possible to get anything, ANYTHING off a zeroed harddrive. I always thought zeroing a harddrive ment manuall changing every byte to a 0. If the entire drive is nothing but a wastland of Zeros how can anyone or any software get the 1s back?

First off, most people who donate computers don't even bother to wipe the drive. So discount what you hear on the news.

But it is possible in theory (and given sufficient skill and specialized equipment, in practice) to recover data from a drive that has been zeroed.
This is because writing a zero to a location on the drive reduces the magnetization of that small bit of material to almost (but not quite) zero. E.g. suppose that a "1" is represented by a magnetization of 5.0 (in some arbitrary units) and a "0" is represented by a magnetization of 0.0.

When you write a "0" where there used to be a "1", the magnetization might end up as 0.0001 instead of exactly 0.0
The normal disk drive software will recognize 0.0001 as close enough to 0.0 (since it only has to decide if it is closer to 0.0 or to 5.0) but sensitive equipment can detect the precise patterns of magnetization and recover the data.

wow I can't believe it. What if you zero the same drive multiple times in a row? Does that help?

On the side note, I really hate the news. They could have at least decided to pick a guy who gave his computer to a recycling plant, instead of a charity. He was doing a good thing, and they no doubt scared him out of ever doing it again. It's so stupid.

If you also run an option that is available with Mac OS, which is to write over data too (I think the standard is write over 7 times) it makes it much harder as new data has been writen over the old one... So I don't think that at this point much data could be retreived... However, if you do this, make sure to have another computer cause a 40 gig HD can take 24-36 hours to zero out if you choose to write over as well.

Not to mention the wear and tear you're putting on all the sectors of the disk.. talk about reduced lifespan..

There's also the 35 pass option, where zeroes are written 35 times over, successively.

Talk about a reduced life span...

Reduced lifespan? Are you being serious? This would have a tiny effect on the drive mechanism, and a near-zero effect on the platters and heads. Magnetic platters don't have a finite lifespan (well, unless we start talking in the order of decades of constant writing).

Yup, thats true too... However, when the company says to do that before sending the computers of, you say "Yup" and don't argue. loll :D

Even if it does impact the drive, would it matter to you if you're getting rid of it?

You should read up on the techniques of forensic audio scientists to try and recover the recordings from the "erased" portions of the Nixon White House tapes. While that's analog and not digital, you learn a lot about how magnetic media REALLY works.

I think this always boils down to how bad the person wants your data, and how much money they have. Zero'ing a drive will keep you data safe from most people, save very bored geeks and NSA technicians

for those willing to go the extra mile ...

after zeroing it out several times, you could always take the hard drive to the closest superconducting magnet, such as this one, which is > 383,000x the Earth's magnetic field strength.

... that is, if you can somehow fit it perfect inside :). if it's unshielded, you should see results from a few feet away.

Way back when I worked in a community college computer lab. One of the guys I worked with had been in the army, and told me that their standard procedure for retiring a drive included writing zeroes to the drive some insane number of times, smashing the drive with a sledgehammer, then incinerating the whole thing. Standard caveat of "I don't know how true this is, since I've never been in the military" applies.

But even if someone did get a hold of my hard drive, they wouldn't get my credit card numbers. Why would I store those on my hard drive in the first place?

Regarding the superconducting magnet, your local hospital's MRI produces a field powerful enough to launch an oxygen tank across the room.

And about zeroing, smashing and then burning it, that sounds like the old "how dead do you want it to be?" army question. If you are going to incinerate the drive, make sure it gets hot enough, or your data will be toasty, not toasted. If the platter (not the case, the platters inside) doesn't reach the Curie point of whatever it's made of, the information will not be damaged. Notice from the table that plain old iron has to get up to 1000 kelvins before it's not magnetic anymore!

Ditto for smashing it - shattering the circuit board may look impressive, but that's what data recovery companies deal with daily.

I like a nail gun myself. One inch spike through the case and platter in a couple of places. Quick, simple, massive physical deformation of the platter (ceramic ones shatter like glass) and jagged-edged holes that span hundreds of tracks. Great if you are decommisioning hundreds of old company machines.

It's worth mentioning one of my failed hard disks (failed on a Friday afternoon, deadlines, etc etc). After throwing it off a three storey building, I pierced it with a pickaxe a few times then encased it in perspex. Makes a lovely paperweight.....

No special tools are required to disassemble a hard drive. Remove the cover on the far side from the circuit board, then remove the screws on the end of the spindle holding the discs, remove and separate the platters, and demagnetize them, then either break or bend them. Now you're talking about several thousand dollars to recover anything - nobody will do it. Having said that, I love Big Dave's paperweight - wonderful!

Nice Cube Dave! There's a market for good art like that.
Next time take the drive cover off and put it near the perspex surface - a Han Solo Bill Gates in Carbonite look.

Hum... I'm starting to think some people havbe too much time to spend destroying hardware here... But it doesn indedd make realy nice art work... Maybe BigDave has a gold mine here... Buying real old 1 gig hds, having fun with them and then dropping them in perspex may be something that would sell realy easily on eBay and such... Every geek would want one ! Just so their non-geek friends would go "What the *** is that ?" :D

The best data security tools come from a company called Craftsman. ;)

Where do you get Prespex? I don't even know what that is.

I work for a comptuer repair place, and the guys here have set up a mouse ball launcher out of 2 hardrive bolted together so one spins clockwise, and the other counterclock wise. You drop a mouse ball between them and watch it fly.

Perspex is the British name for Polymethylmethacrylate. Dupont's version of Perspex is called "Lucite". In general it's just called 2-part castable Acrylic; the stuff you see coins, flowers, and other stuff embedded in. Dyed pink, it's often used to make the gums of false teeth.

LOL! A few seconds in a microwave oven will also do wonders for a drive. :D

What about all these programs that advertise "shredding files." See this link for a few examples. Do they do any good? Might come in handy if you're selling a computer and want to be sure that your old drive is clean.