[Cialug] Semi-OT: wiping a hard drive once is enough?

[Matthew Nuzum]

On Wed, Mar 11, 2009 at 4:53 PM, Daniel A. Ramaley
<daniel.ramaley at drake.edu> wrote:
> What i've read on the subject over the last couple years is that if
> you've an old MFM drive from the 1980s, one pass is insufficient. A
> well-financed attacker would be able to either instruct the drive to
> reposition its heads to read the faint left-over signal at the edge of
> the tracks, or disassemble the drive and use an electron microscope to
> read the residual magnetic fields. In the latter case, the attacker
> would have to be very well financed indeed, as time on such a
> microscope is not cheap. In the former case, perhaps all it would take
> is some specialized data recovery software; i don't really know.
>
> If you have a drive made in the 1990s or 2000s, don't worry about it.

In the mid-90's we had a software package made by (I think) PowerQuest
or Binary Research. It could recover deleted data and even wiped data.

You had to buy it per computer, it was a floppy disk and once used
could never be used again on a different computer/hard drive
configuration. You put a second hard drive into the computer, booted
off the floppy (and thereby making the floppy unusable again) and it
would run all night or even longer, copying the recovered data to the
spare drive.

Some times it would recover almost everything (when the drive was just
formatted), other times, when the data was overwritten, it would
recover files, folders or just portions of files. We only used it a
few times because it was very expensive, both for the software and for
the time involved. I used it once to recover data for a person who had
formatted their drive (I was very successful iirc) and I remember a
colleague using it at least once for forensic recovery in a court case
(don't remember the outcome).

-- 
Matthew Nuzum
newz2000 on freenode, skype, linkedin, identi.ca and twitter