Posted 13 years ago
·
Author
FAQ
Q. Doesn't deleting a file make it impossible to recover?
A. Deleting files on a hard drive only reallocates the space, it does not technically remove the files. Even when a hard drive is formatted it is still (potentially) vulnerable to forensic analysis. Using a program like DBAN (or ATA Secure Erase, which may even be better than DBAN) is a safe way to wipe the entire contents of a hard drive between projects, or even randomly every few months to provide a fresh start. It is also good to use in emergency situations that are not time sensitive (An expected visit versus a knock on the door).
Q. I hear the only way to make sure that my hard drive can not have data recovered from it is to smash it to bits or shoot it with a high powered assault rifle
A. This actually wont do much to remove data. Even if the platter is completely shattered forensic teams can just piece it back together. Data will only be lost at fracture lines, even with a highly shattered platter this is not a whole lot of lost data. Spin stand microscopy is one technique that can be used to read data from the entire shattered platter, minus fracture lines.
Q. What about using a powerful magnet on the drive platter?
A. This will work, but why break the drive and wipe it with an external magnet when there is already a strong magnet in the drive that you can use a program such as DBAN to wipe data off of the drive?
Q. What about tools like GPG Shredder or Heidi Eraser?
A. These tools do a good job at securely erasing the target data, but forensic teams are not fully hindered by them. Even if a tool such as this is used to destroy data, metadata is left all over the hard drive. If you use a tool like shredder to securely erase data, the data can not be recovered. A forensic team can however probably determine that you wiped a certain type of data on your computer (images, text files, etc), how many of the files you wiped, possibly the names of the files depending on your operating system, how often you accessed the files, when you wiped the files, etc. This is better than them directly finding the files but it is not as good as a full drive wipe.
Q. What about tools like DBAN and ATA Secure Erase
A. Tools like DBAN and ATA Secure Erase are a forensic data recovery teams worst nightmare. By securely wiping the entire drive (or in DBANs case the parts of the drive that are likely to be relevant to an investigation) these tools remove the sensitive information and (in DBANs case probably all data, ATA Secure Erase is allegedly more certain) all traces of it.
Q. Doesn't deleting a file make it impossible to recover?
A. Deleting files on a hard drive only reallocates the space, it does not technically remove the files. Even when a hard drive is formatted it is still (potentially) vulnerable to forensic analysis. Using a program like DBAN (or ATA Secure Erase, which may even be better than DBAN) is a safe way to wipe the entire contents of a hard drive between projects, or even randomly every few months to provide a fresh start. It is also good to use in emergency situations that are not time sensitive (An expected visit versus a knock on the door).
Q. I hear the only way to make sure that my hard drive can not have data recovered from it is to smash it to bits or shoot it with a high powered assault rifle
A. This actually wont do much to remove data. Even if the platter is completely shattered forensic teams can just piece it back together. Data will only be lost at fracture lines, even with a highly shattered platter this is not a whole lot of lost data. Spin stand microscopy is one technique that can be used to read data from the entire shattered platter, minus fracture lines.
Q. What about using a powerful magnet on the drive platter?
A. This will work, but why break the drive and wipe it with an external magnet when there is already a strong magnet in the drive that you can use a program such as DBAN to wipe data off of the drive?
Q. What about tools like GPG Shredder or Heidi Eraser?
A. These tools do a good job at securely erasing the target data, but forensic teams are not fully hindered by them. Even if a tool such as this is used to destroy data, metadata is left all over the hard drive. If you use a tool like shredder to securely erase data, the data can not be recovered. A forensic team can however probably determine that you wiped a certain type of data on your computer (images, text files, etc), how many of the files you wiped, possibly the names of the files depending on your operating system, how often you accessed the files, when you wiped the files, etc. This is better than them directly finding the files but it is not as good as a full drive wipe.
Q. What about tools like DBAN and ATA Secure Erase
A. Tools like DBAN and ATA Secure Erase are a forensic data recovery teams worst nightmare. By securely wiping the entire drive (or in DBANs case the parts of the drive that are likely to be relevant to an investigation) these tools remove the sensitive information and (in DBANs case probably all data, ATA Secure Erase is allegedly more certain) all traces of it.
and thermite 
and the microwave all in one >P! MAUAHAHAHAHAHAHAHAH