Storage

Deleting files isn't always enough


As our computers get old, we tend to want to recycle them. Many give their computers to charities or schools. Many pass them on to friends and relatives whose computing requirements are not as demanding, and who can use the upgrade. Sometimes, we might even sell them to mom and pop computer shops that sell refurbished systems.

When doing so, people should and do often delete the data on their hard drives. They don't want to accidentally give away sensitive information like social security numbers, credit card numbers, and passwords for their bank accounts, after all. Businesses of course have to protect both their own data and that of their clients. Usually, however, people do not do a good enough job of deleting data from their hard drives before passing them on -- or even before disposing of them.

Security issues that get a lot of play in the press tend to involve threats that touch someone's network via the Internet and stolen laptops with sensitive data stored in unencrypted filesystems, but another source of danger for your data security is simply improper disposal. Whether giving them away, selling them, or simply tossing them in the trash, we should always be careful about how we dispose of our hard drives and other mass storage devices, including USB solid-state storage devices.

The most effective means of protecting your data when you dispose of a storage device would be to do something really drastic like melt down the platters in your hard drive. Using a drill press to put holes in the platters can be fairly effective as well. I once knew a man whose employer had the policy of wiping drives, extracting the platters, and having the techs go out on company picnic days to skip the platters across the surface of the duck pond next to the corporate headquarters, where they would sink to the bottom and quietly corrode -- not ideal, but less of a security risk than just giving the drive to your nephew or tossing it in a dumpster.

If we're leaving our drive platters intact, however, we need some way to ensure some reasonable security of our data. First, let's examine the structure of your filesystems.

Filesystems:

  1. Your storage device has a table stored at the beginning of it that lists partitions that have been created there.
  2. For each partition, there is a table of contents that catalogs the locations of all files on the system.

Any time you delete a file from an extant filesystem, all you're doing is deleting the file's entry in the table of contents. The actual file stored on the disk is left untouched. When later writes to the hard drive are made, those files then might be overwritten by new files or by additions to old files, but unless and until that happens the data that makes up the file, itself, remains untouched. This means that someone with the right forensic software can often recover "deleted" files very easily.

Deleting the entire partition is no better. In fact, it may be worse. When you delete the partition, you not only leave the file data in place, but you also leave the table of contents that catalogs all the locations of files and file fragments in that filesystem. All that is deleted is the partition's entry in the partition table. At this point, you don't even need specialized forensic software to recover those files -- many basic filesystem management tools can actually reconstruct your partition quite easily. In fact, on one occasion when a filesystem was unintentionally "lost", I was able to recover it by using a FreeBSD installation CD: I installed FreeBSD in some free space on the hard drive, and it automatically recreated the partition table in the process of creating a boot menu to allow me to boot into whichever installed operating system I wanted to use.

Secure Deletion:

There's still hope, however. There are tools out there that you can use to securely delete data from your hard drive, USB storage device, and even a floppy disk. One example is called shred, and you can carry it around on a LiveCD operating system such as Knoppix. If you want to destroy all data on a hard drive, it's as easy as booting up your Knoppix CD and using the shred utility:

# shred --verbose --zero /dev/hda

By default, the shred utility will overwrite whatever you designate with random bytes 25 times. If you use it on a single file, you can then "delete" the file (removing it from the table of contents for that filesystem) and be reasonably sure it will never be recovered. The --remove option can be used to automate file deletion after it has been shredded. The --zero option tells it to overwrite the last random bytes iteration with zeros, to hide the fact the file or filesystem has been overwritten with random bytes.

Caveats:

  1. When shredding a full disk with a Knoppix CD, you should probably disconnect any drives you don't want shredded by accident. Mistakes *do* happen, and you don't want to end up deleting important data you intended to keep just because you fat-fingered the drive specification.
  2. The shred utility is not infallible. Each such tool has its own strengths and weaknesses, and you should read up on them before trusting them. You should also understand that in general shredding a specific file has no automatic effect on any backups that might exist, including Microsoft Windows restore points. The manpage for the shred utility does a pretty good job of explaining its limitations -- some other tools are not as clear about their limitations, and may require more work to effectively sort out their capabilities.
  3. The shred utility is available along with the rest of the GNU core utilities for installation on most, if not all, Unix-like systems, and for installation in Unix emulation environments on some other OSes (such as Cygwin for MS Windows). Note that these tools may have different names than you expect. For instance, on FreeBSD, all tools in the coreutils port have the letter "g" tacked on, making shred into gshred.
  4. All such tools, including shred and all its contemporaries, have limits. You can pretty much bet that the NSA has the tools necessary to recover your data even after 25 random overwrites and a final overwrite with zeros, for instance. If you are that concerned about your privacy, get a furnace you can use for melting the drives down. I've heard rumors of a guy in Hawaii that guarantees secure disposal of storage devices in an active volcano for a "reasonable" price, if your tastes run that way.

When you are done with a hard drive, you don't always have to physically destroy it to protect your sensitive data -- but you do have to make sure you understand how to properly delete the data so that it cannot easily be recovered.

About

Chad Perrin is an IT consultant, developer, and freelance professional writer. He holds both Microsoft and CompTIA certifications and is a graduate of two IT industry trade schools.

97 comments
AlexNagy
AlexNagy

No, I haven't read all the comments and I know this article is almost two years old, but here goes: What about passing the platter through a strong magnetic field (or near the drive magnets for something like a cray? I've toyed with some of those magnets and they are STRONG).

Michael Jay
Michael Jay

I still have not read each post but I am getting close, this has been one of the most interesting threads that I have seen in some time. Only a few do not have a clue, or the one. Anyhoo thanks again for the reading material.

jcalkins
jcalkins

Well, this certainly has been bust as far as acquiring a simple procedure or solution for resolving the data security issues described in "Deleting files isn't always enough." As soon as the self annointed experts (shills for perpetuating problems) come out of the wood work to invade the scene, it is time to move on.

steve
steve

I have been using a free small utility for years called autoclave. It boots the system and allows you to choose the depth of deletion. I have used numerous tools to try and recover the data to no avail so as an analyst, I'm convinced it works great!

bfitz2000
bfitz2000

Any of the DoD level wiping is good enough for things like your personal e-mail or semi-public files, but to take medical records, bank records or higher security - you must destroy the components...even a screwdriver through the platters will leave about 60 to 85% of data available to those that may want it bad enough... Have those media (CD ROMS, DVD, Hard Drives, Thumb drives...) all taken to an authorized place for certified destruction AND 100% recyling...there are some very precious metals in hard drives and the plastic in CD/DVDs are near the level of eye glasses...well worth saving.

jcalkins
jcalkins

The nature and issue of deleting files versus reformatting a drive is not expressly discussed by Chad Perrin in his article "Deleting files isn't always enough. I would like to hear what Mr. Perrin has to say concerning the nature of deleting files versus reformatting a drive.

apotheon
apotheon

There are some incredibly smart, knowledgeable people hiding here amongst the hoi polloi at TechRepublic. Discussions like this sometimes draw them out, and we get a good dose of intelligent, well-supported discussion. It's probably the biggest reason I keep coming back to TechRepublic.

Joe_R
Joe_R

I can't recall when I've read a more rude and misinformed reply. You have no idea what it might take to write these blogs, week after week, and month after month. None of the bloggers are "self-anointed", and "expert" is a matter of perspective and experience. You might know everything there is to know about every subject, but not all of us are so fortunate. Maybe you should try to expose yourself in such a way before you criticize another for simply throwing out a subject that might best be described as food for thought and a subject for discussion.

apotheon
apotheon

As NickNielsen pointed out, solutions [b]have[/b] been offered.

apotheon
apotheon

Speaking specifically of hard drives, here: A high-level format consists of installing a boot sector and creating a filesystem. This doesn't do anything to the bulk of the data on the drive other than tell any normal user software that the drive is ready to be used and doesn't contain any meaningful data. A reinitialization involves resetting the drive to factory specifications and overwriting the drive with zeros. This can make it less trivial to recover data, but isn't as secure a wipe as overwriting numerous times with random data. A true low-level format on at least most, if not all, modern hard drives is something that can generally only be done at the factory. The reasons for that are manifold, but include such factors as the advent of RLL encoding and the fact that these days hard drives are actually specialized embedded systems. I imagine that would have a pretty significant effect on the recoverability of data, but since I'm not exactly a storage hardware design expert, I can't give you any specifics on modern low level formatting of hard drives. edit: High-level formatting is probably what you mean. A high-level format actually occurs within a partition. When you fire up a Microsoft Windows machine and you see "Drive C:", what you're looking at is the C: partition on the master disk of IDE controller 0.

jdclyde
jdclyde

We do not tolerate rational, thoughtful posts around here. Your attempt to be civil, yet stern, is out of place. It seems some only have room for flamebait, and your ruining all of their fun. How rude. ;\

jcalkins
jcalkins

Concerning the "shred" utility, the author states: "The shred utility is not infallible. Each such tool has its own strengths and weaknesses, and you should read up on them before trusting them. You should also understand that in general shredding a specific file has no automatic effect on any backups that might exist, including Microsoft Windows restore points. ? "All such tools, including shred and all its contemporaries, have limits. You can pretty much bet that the NSA has the tools necessary to recover your data even after 25 random overwrites and a final overwrite with zeros, for instance." Concerning DBAN, that author states: "No way I'd use it at the corporate level or government level...even if you don't keep sensitive data at the end user level it's always best to destroy the hard drive." Besides, I am looking for reliability, not a potential infection or a scrap recipe that must be prepared and recooked with each use. Who knows what you get when you slap one of these on your system. Keep looking and let me know what you find. I will be interested. Simply put, I am looking for complete and total erasure of data the first time. I am not picky how it is done as long as it is reliable and results in continued, full use of the storage medium.

jcalkins
jcalkins

I meant reformat and all the results that occur thereupon, including an indicated empty drive without any data previously stored by the user. If this is not what occurs, then the manufacturer is fraudulently representing the results of the process to the detriment (which means "damage") of the user.

jcalkins
jcalkins

Interesting. It seems every time I have reformatted a hard drive, before the reformatting process is commenced, a warning message is given indicating "all data will be lost upon reformatting," allowing the user to cancel commencement of the reformatting of the hard drive. Now maybe we users are getting jerked around, but that warning message seems to be in plain English, straight forward, and something intended for users to rely upon.

CharlieSpencer
CharlieSpencer

because people who used phrases like 'people in the know' forget it's a big honkin' Internet? because people in the know know better than to waste their time on two-year-old discussion?

AlexNagy
AlexNagy

because people in the know know that all of BBSpot is satire?

seanferd
seanferd

There really is no reliable way at all to recover data from a dead drive. "Dead drive" is simply too generic a term for one. It depends on what is actually wrong with the drive and who is going to try to recover data. There is always Spinrite, if the drive isn't totally trashed. It is best to be using this before the drive is in trouble, but it is pretty good at data recovery. http://www.grc.com/default.htm The most important thing is, if the drive is mechanically messed up, and the data is important, just store it away somewhere safe until experts can access it. If there is no way that you're going to have data recovery experts look at it, try the least risky methods first. If someone can replace the controller board, try that and/or Spinrite before freezing it. Freezing is something I would try if the data wasn't truly important, but I just wanted it, and just felt like going for broke before giving up.

NickNielsen
NickNielsen

I understand freezing has worked, but the cause of failure will also affect whether it does work. I strongly suspect you won't be able to recover from a controller failure or head crash using this method. As seanferd said, it depends on how important the data is to you. The only "self-help" method for hardware recovery that I know for certain works (and that not too reliably!) is cleaning badly soiled keyboards. Back when keyboards were $100 or more and $100 was actually worth something, we would run keyboards through the dishwasher on warm wash and air dry, then put them in an oven set at 160F. This procedure was only successful about 30-40% of the time, but if you could save a few hundred dollars on keyboards back then it was a good thing. It's much more economical today to just buy a new keyboard. Edit: grammer and spelig

shazardy2000
shazardy2000

Well i have heard about the put the drive in the freezer... never knew it actually worked :( Allot of people from these links talk about it... http://geeksaresexy.blogspot.com/2006/01/freeze-your-hard-drive-to-recover-data.html http://www.macosxhints.com/article.php?story=2006110111270170 and for those who really need their lost data check this link http://www.ewoss-news.com/s/Hard+Drive+Recovery.aspx?sid=-12509&k2=hard%20drive%20recovery Anybody else knows about any 'self help' way to get access to a 'dead' drive to recover information?

seanferd
seanferd

Perhaps a take-off on freezing a drive to see if it will run long enough to recover data? None of the "self-help" ideas are any good if the data is actually important.

apotheon
apotheon

I don't know for sure, but it sounds like a really bad idea to me. If I had to guess, I'd say it would probably work about one time in a thousand at best -- and the rest of the time you'd run substantial risk of making it even more difficult to retrieve data from the drive.

shazardy2000
shazardy2000

I also read some where (can't remember the link) that if the read/write heads are seized up you can check it by rotating the drive(manually with your hand of course) and listen if the heads move. If they don't they are seized up. They said to preheat an oven to it's lowest temperature (they didn't say how much but of course not extremely hot to melt any of the drive's components) turn of the oven and put the drive in for a couple of seconds. Test it if the heads move by rotating the drive (manually again of course). If they do quickly put the drive in your computer for file recovery. Does anyone know if this sort stuff works? It sounds pretty weird but i guess it can theoretically work temporarily if the heads are seized up . Ermm and it's allot better than greasing up the drive plates lol

apotheon
apotheon

Why doesn't that post have a BIG RED WARNING SIGN on it saying "DANGER: THIS IS SATIRE"?

seanferd
seanferd

Now I know what to do about it! :^0

Michael Jay
Michael Jay

Bet that drive will not make a sound again. EVER.. LOL

normhaga
normhaga

The aspect of the program that oscillates the write head is based on theoretical work at a University. However, I am a pessimist from way back. I installed EE on a test drive and then wiped it. Then I ran some high powered forensic tools against the drive. Even knowing what was on the drive and where it was at, I could not reconstruct anything. The program is very slow in the secure mode. Even so, my practice when a "secure" drive is decommissioned is to use a sledge hammer.

apotheon
apotheon

I wasn't aware of that feature of the software. Of course, that sounds like it might be dangerous to the hard drive -- the read-write heads aren't intended to be manipulated in that manner. I'm also skeptical of the claim that it's so fool-proof.

normhaga
normhaga

it causes the write head to oscillate, in such a way that it bit zones to randomize. It is these outer area's that forensic software most often recovers data from. The claim is that even an electron microscope cannot read the data with any certainty.

apotheon
apotheon

"[i]Are you so literal that you were unable to understand what was said until it was spelled out for you?[/i]" That's obviously not it, because it was [b]spelled out[/b] many times before this. For instance, in the post at the second link you provide, I said "Short of physical destruction of the drive platters, there's always a possibility of getting the data back." How much more "spelled out" can it get than that? I suspect that what happened is something like this: 1. jcalkins decided that the "warning" message that comes up when choosing to format a drive was not a warning, but was instead a guarantee 2. jcalkins tried to get people to "admit" that a format is as good as anything else 3. when people didn't oblige, jcalkins decided this means all IT pros are dishonest, or at least disingenuous 4. jcalkins was confused by the fact that a handful of people all showed up and tried to explain the situation in excruciating detail, with absurd patience 5. jcalkins finally decided to pick out a post at random (yours), and claim that it somehow made his point for him, despite the fact it's yet another refutation of what he started out trying to claim 6. jcalkins is, in essence, a troll -- which is similar to a lawyer, but is [b]not[/b] a lawyer, since lawyers have to work with the law and court precedent, whereas a troll only has to work with his desire to be a pain in the butt

seanferd
seanferd

But they can read data off the "sides" of the tracks, and decipher it through several writes, potentially recovering more data than the actual capacity of the drive.

apotheon
apotheon

"[i]It took long enough.[/i]" What took long enough? You mean the statement that the NSA might be able to recover data from a drive even after it has been overwritten with random data 25 times? We've been trying to pound that into your thick skull for many, many posts now -- and we've been trying to point out that a [b]warning[/b] about data loss is [b]not the same[/b] as a [b]guarantee[/b] of secure deletion. What planet are you from, anyway?

apotheon
apotheon

Evidence Eraser basically just does the same thing as most of the rest of the drive-cleaning software out there: it overwrites locations on the drive multiple times with random data.

NickNielsen
NickNielsen

[i]Personally, I NEVER give away any hard disks. Take a hammer to them and bust 'em up ...it's not worth your personal information getting out there and whoever is taking your donated computer can buy a new hard disk cheaply these days.[/i] You also received excellent answers in the following posts: http://tinyurl.com/2ujj9k, http://tinyurl.com/327pdh, http://tinyurl.com/2n9shk, and http://tinyurl.com/2lwege. Are you so literal that you were unable to understand what was said until it was spelled out for you? Or are you a lawyer?

normhaga
normhaga

Evidence Eraser 6.x? It is the only program in the world outside of Alphabet agencies that securely deletes data from a HD. According to the US Courts, FBI, and NSA, when used in the most secure mode even electron microscopy can not recover the data with more than a 0.3 percent chance of accuracy. When destroying data is is very slow!!! I use it in my lab machines; however when it is time to decommission one of the lab drives, I use a sledge hammer on them.

jcalkins
jcalkins

There it is, according to the self annointed experts: protecting confidential communications stored on a replaced drive require smash and torch. All other representations are bogus or fraudulent. It took long enough. To edit and/or TechRepublic: Take me off this laughable waste of time at getting accurate & reliable information. I never look at the TechRepublic e-mails that clutter up my e-mail inbox, but the file deletion problem article caught my eye. The TechRepublic appears to be developing expertise in spit balling.

NickNielsen
NickNielsen

[i]Completely removing all fingerprints from my place of residence occurs by wiping all print surfaces.[/i] It's Monk! ...all is now explained...

NickNielsen
NickNielsen

OK, here's your solution: When you're finished with the data on a hard drive, take the drive out, smash it, trash it, and take an oxy-acetylene torch to the remains until they are nothing more than a pile of smoking slag. Start stocking up on hard drives. Expect it to get expensive fast. Edit: I was laughing so hard, I missed your final line: [i]I am not picky how it is done as long as it is reliable and results in continued, full use of the storage medium.[/i] As long as you use magnetic media, you are doomed to disappointment; no matter what you use, there will always be residual magnetism. It's called hysteresis; if you need the math, I can give you a source.

apotheon
apotheon

"[i]your BS will be considered nothing more than amusement for the people laughing at your lack of comprehension.[/i]" It's more the refusal to comprehend that gets me, rather than the simple lack of comprehension. Good ol' jcalkins clearly [b]refuses[/b] to comprehend.

Neon Samurai
Neon Samurai

All he needs is a clean room and fresh platters from the factory. I'm sure the room is vacuum sealed and located right beside the forensics lab he uses to confirm that no fingerprints have been left behind after wiping all surfaces in his home. Doesn't everyone have a clean room in there basement for those pesky times when you have to format a drive by replacing the used platters with factory fresh ones? :D (I was going to get all worked up about the shmuck but it's far more entertaining to simply find humor in it all.)

Neon Samurai
Neon Samurai

From what you've posted, it seems you chose not to be satisfied by *any* answer given long before you asked the first question. People tried to explain (politely at first even) data formatting and they offered potential solutions which would effectively solve your problem. You've had your fun. You've asked your questions. Give us a chance to ask some questions back: Do you clean your house daily to forensic standards encase the police turn up at your door asking for fingerprints? When you move, do you burn down the place you are leaving so no one can find any possible trace of your passing? Do you shred then burn every piece of paper you discard encase it retains fingerprint or led/ink from being written on? How do you insure that any hair strands, finger nail clippings or those pesky thousands of daily discarded skin cells are unrecoverable? What exactly are you trying to remove from your hard drives? Have some minors in compromising positions you need to be sure the FBI can't recover in an investigation? Seriously, what is the source of your paranoia? What are you storing on drives that would possibly interest the NSA. You can't possibly be that interesting. Again, you asked a question and initially, other's tried to answer it. You attacked the people answering your questions as if it was there conspiracy personally against you. Do you really think any of the people here are responsible for a third party operating system development companies decision to continue warning there customers that formatting a drive will remove there general access to data stored on the drive? Do you honestly think you wouldn't be laughed out of a court of law and then bankrupted through counter suites over this juvenile BS you present? Baud save you if your really that dim. If, as you now indicate, you are simply going to walk away from the conversation because you choose not to accept the potential and viable solutions given; I gotta say, I'm not feeling a loss to the ongoing professional and mature discussions that are the TR forums. Heck, that's not even a loss for the less mature and unprofessional discussions that flow through the TR forums. If your willing to listen and hear the solutions that others can offer based on there years of experience then by all means, rejoin us and ask away. Until then, your BS will be considered nothing more than amusement for the people laughing at your lack of comprehension.

medullaoblongata
medullaoblongata

Think of your hard drive as a piece of paper. You have a pencil you use to write on that piece of paper. There is a little thing at the end of your pencil called an eraser. This eraser is like the format option on your computer. So you write on your piece of paper and then realize that you want to remove what you've written. You simply use the eraser and it clears everything off. You have a clean piece of paper and can start writing new stuff on it. Using that eraser is good enough for getting rid of old information for most people. Just like a format. But, if that piece of paper was evidence in a crime, there are people that can look at that piece of paper and find out exactly what was on it before it was erased. There are impressions left on the paper from the first time something was written. So by statements made in previous posts, I should be able to sue the eraser manufacture for being misleading and lying that an eraser can wipe away all traces of what I wrote. I'm sure you realize that is silly and the same goes with suing computer manufacturers. The only way to be 100% certain that no one will be able to figure out a single word you wrote on that piece of paper is to destroy it and get a new one. The same principles apply with a hard drive. It is a physical item and the process of saving data on it leaves lasting effects that you can obscure but you can never totally get rid of.

apotheon
apotheon

I edited my previous post at the same time you were responding to it. You may want to read it again for details. "[i]Completely removing all fingerprints from my place of residence occurs by wiping all print surfaces.[/i]" Holy cow. Are you serious? Good luck with that. "[i]Wiping a hard drive of data will certainly take much less time (a tiny fraction of the time because of the super organized nature of the drive and speed of an electric current) than my spending the time to completely wipe all fingerprints from my residence.[/i]" How exactly do you intend to achieve this perfect, irreversible, totally secure wipe of the drive in so little time? I'm curious.

jcalkins
jcalkins

Do you think NSA can "get any data off it" when "it" comes off the assembly line? Completely removing all fingerprints from my place of residence occurs by wiping all print surfaces. Wiping a hard drive of data will certainly take much less time (a tiny fraction of the time because of the super organized nature of the drive and speed of an electric current) than my spending the time to completely wipe all fingerprints from my residence.

apotheon
apotheon

It sounds like you want a magical, instant means of "erasing" a hard drive such that even the NSA can't get any data off it. Good luck with that. Do you have any magic wands you can use to remove all the fingerprints from your place of residence? How about a wand for removing all sign you ever existed from the Internet? edit: . . . and I have no idea where you get this stuff about infections, et cetera. Are you trying to say that the shred utility and DBAN are malware? What evidence do you have for such a statement? If anything, they are both far less likely to be or contain malware than MS Windows itself, and I somehow suspect that you're using MS Windows without any hesitations in that regard. What's up with that?

seanferd
seanferd

I really am going to have to read this entire thread. It is interesting, but I haven't spent the necessary time on it. I've seen some intriguing information, but the mind-bending hilarity of some of this...

NickNielsen
NickNielsen

that not everything that is written is true. That message has existed in essentially that form since [u]at least[/u] MS-DOS 2.0 (1983). At that time, the FORMAT command actually wrote the hex character "F6" to each of the 131072 bytes (128 kBytes) on the single-sided floppy drive. This process took up to 5 minutes. FORMAT program operation has changed since then. The message has not. Blame Microsoft. Edit: splel

Forum Surfer
Forum Surfer

Ahhhh...the frivolous law suits. I've seen many and the waste OUR time and money. I think we have more frivolous cases these days because of exactly what the poster said...he read something in plain english. Didn't bother researching, just took what the software said as golden. People either don't care to search out knowledge and answers for themselves, or they expect too much. It's like buying a car or a house. Are you going to take what the seller gives you as selling points as something carved in stone and handed down from the mountain? Or are you going to research the product yourself so you don't get a lemon?

apotheon
apotheon

I think the kind of lawsuit you're talking about is the sort of thing we call "frivolous litigation". [b]If[/b] you managed to make a case for it in court, you'd basically just be confirming your status as one of the people screwing up the court system in this country. That message you're bleating about is intended as a [b]WARNING[/b] (which is why it includes the word "WARNING"), intended to point out to the common computer user that they may lose data by formatting the hard drive. It's not meant as a guarantee that the data cannot be recovered by someone sufficiently motivated and sufficiently well-funded if that person acquires your drive. By the same token, claims that Vitamin C help your immune system are not intended to suggest that drinking orange juice will render you immune to disease even if someone injects Ebola Zaire directly into your carotid artery.

jcalkins
jcalkins

As I have indicated somewhere else on this discussion, I just started the process of reformatting my hard drive. I received the following warning notice before commencing that reformatting: "WARNING: Formatting will erase ALL data on the disk." That warning message is both in plain English and unambiguous. Also, that warning message looks like it is intended to be relied upon. With all the class action notices that I have received relating to software and hardware products that I have purchased and, consequently, including me as a member of each class in those lawsuits (I think that there has been 1 hardware lawsuit in that mix), I don't know--maybe some informed, skilled attorney may conclude the issue is actionable and, more importantly, likely to return a large damage settlement or judgment. The reasonable person understands the ordinary meaning of "erase ALL data on the disk."

apotheon
apotheon

Good luck making that hold up in court. As far as the common user's ability to recover the data, it's gone. If, on the other hand, the FBI gets its hands on your hard drive -- well, that's another story altogether. Somewhere between "not formatted for use as a fresh filesystem" and "the FBI has its ways", there's a line between can and can't get the data back.

shazardy2000
shazardy2000

If the controller isn't the problem, if it was the heads or the motor? The controller here you are speaking of is the circuit board on the underside of the hdd right? I would also need a similar hdd (type, size, brand)? Well it would be nice to try to recover the data my self. The data i lost wasn't very important but in the event that it occurs again (knocks on wood) i can probably recover it my self.

normhaga
normhaga

If you really want to delete the data and secure against recovery, after you smash the controller and case with a sledge hammer, take the pieces of the plater and put them into a degaussing coil for 15 minute. But this is no guaranty that in the future some technology will not be able to recover information from it. As to a dead drive, simply replacing the drives controller may allow access long enough to make an image of the drive.

shazardy2000
shazardy2000

Ok so remember the hard drive I told you about. Well it died last night (RIP). Its was 4 years old. It began making whirring noises (signs of death) and then just like that the pc stalled. The hdd was never recognised again :(. I lost some data but not much, i bought a spanking new 160 GB, now to reinstall all my programs and stuff. I would like respond to that lawyer guy whose been kind of hard headed on this topic. Normal people will not be able to recover a drive like what happened to mine. But i'm sure even you can recover the data that i lost if you learned how the hard drive it self work and stores data. Most likely i think it over heated and for what ever reason began to fail due to that. Who knows what happened maybe the heads got damaged in the overheating process. Maybe the motor began failing. Just a side note, a computer is such a wonderful piece of equpiment. Some people tend to forget that people like you and me designed and made that piece of equipment (humans) and not some alien life form. And we all know humans are very prone to errors. So there may be a more efficient way of saving data to come some time in the future. Remember a hard drive is magnetic medium (just like the floppy drive which held only 1.44 megs) now we have optical media which holds tens of thousands more megs than that. wow talk about straying from the discussion ... any how what i'm trying to say is that there are always people out there who can accomplish the impossible (basically better than you in some aspect). So what if there are maybe 1000 guys in the world who can recover data from a hard disk fragment. How sure are you that they will find your condemned disk and search it for God knows what. Take the risk. You are more likely to get a speeding ticket speeding down the highway because you are late for work and yet i'm sure allot of us take that risk.

Neon Samurai
Neon Samurai

Throw some tunes behind quick cuts between scenes of smart people doing sciency things and anything is possible. :)

Neon Samurai
Neon Samurai

The last quote I saw was in the thousands to attempt recovery on about an 80 gig drive. Between home owners with pleanty of money, private business owners, huge companies and the verious agencies with forensic needs; there be gold in them thar hills. The bad news; you'll be wanting a computer science or computer engineering degree or the capital to hire those skills and the equipment is not going to be cheap. In cases, the engineer doing the recovery will have to write there own programing specific to each drive. In the case of your drive, it sounds like a hard drive on it's way out or a machine that needs better cooling. If the drive is making noises then it's in need of a backup because it'll go sooner rather than later. If it's just running hot then it may be fine with a fan on it but prolonged heat will kill it. Physical damage refers to shattering the platters inside the drive with a hammer or similar distruction. If your drive simply overheats and seazes it could be the drive head or motor that's dead leaving the platters unreadable but containing data. If your a little crazy, you could buy a duplicate drive then swap the platters to recover what's left on them but that's going to destroy both drives and your going to have a very limited amount of time to get what you can off it before the inherent dust in the room finishes it off.

apotheon
apotheon

Data cannot [b]always[/b] be recovered -- but there is always a [b]chance[/b] that it can be recovered. Data recovery operations are not always successful, and the more diligent you are about increasing the difficulty of data recovery (by overwriting multiple times with random bits, for instance), the less likely someone is to be able to recover anything useful. . . . but there's always the chance, if it's still an operational storage device, that someone might be able to recover something you don't want recovered, given enough time, effort, and money to throw at the problem. "[i]I currently have a disk that began over heating and making all sorts of weird noises, so i know it's going bad... is this considered physical damage or can the data that i can't copy out of the drive still be recovered or copied some how?[/i]" This may or may not involve physical damage. If it's still working at all, you can pretty much guarantee it hasn't destroyed the disk sufficiently to really protect you at all. Even if your read/write heads turn into plows and start carving furrows into the platters, however, there's still a chance that data can be recovered with (very expensive and time consuming) techniques like electron microscopy. You need to actually [b]physically destroy[/b] the platters to eliminate any chance of data recovery at all -- and when I say destroy, I mean more than just breaking them in a couple of pieces or something like that. Any part of the drive that is still intact might yield some data to the sufficiently diligent party with enough expensive equipment. It's a bit like a sheet of paper with a bunch of secrets written on it. If you tear the paper into little pieces and burn about half the pieces, there's still a possibility someone might be able to reconstruct some of those secrets from the remaining pieces of paper. It just requires much more expensive equipment to "read" the parts of a hard drive platter than to read handwritten characters on paper.

shazardy2000
shazardy2000

So no matter what once the drive is not physically destroyed, meaning drilling holes in it or throwing it in an active volcano... the data that was written before the disk was formated 20 times ago can be recovered by some FBI or NSA guy? I currently have a disk that began over heating and making all sorts of weird noises, so i know it's going bad... is this considered physical damage or can the data that i can't copy out of the drive still be recovered or copied some how? If this is possible i really have to get me some of those devices/hardware/software to recover data i'm sure i can make some cash out of it lol

Neon Samurai
Neon Samurai

.. trying to tell you. The other posters are giving you very good information which, if added to your current knowledge of computers, will make you a better computer user (I'm aprehensive of using the term techie for you as of yet). Besides, there's much grosser lies being fed into your brain by constant marketing and advertisements. Don't waste your energy getting all spun up over an "if you do this bad things will happen to your data" warning message.

Neon Samurai
Neon Samurai

It changed all the fat tables 1/0s to 0s in less than a second. Even in that case, you just need a utility that reads the partition data and reconstructs the fat table as best it can. If your not destroying the drive phisically, your best bet is a DOD standard whipe which writes all 1s then all 0s (or random data) to the drive seven or more times. There is still a chance of finding something left behind but after seven or more times overwritting the data, it's pretty much gone or fragmented beyond reconstruction. The people who can restore data from teh drive after that work for the Gov or get paid near bankrupting sums of money for saving corporations from bankcrupting data loss.

Neon Samurai
Neon Samurai

It's a warning just like back when everyone ran Dos. I don't think the text has even been changed since. For standard users a format makes the data pretty much gone. Computer forensics shops (contracted by FBI and big business to restore hard drive data) can do a lot more than the average user and can usually find something even if all you bring them is a platter in a ziplock bag. In some cases, the technition restoring the drive has to write there own program to run against but restoring lost data is what they do for a living. This is also why any tech will tell you that a format will prepare a partition for data but if you want to "whipe" a drive clean use something that formats to DOD standards or whack it with a hammer. This isn't a conspiracy by the hardware industry to defraud you.

Forum Surfer
Forum Surfer

An experienced mechanic will add on things outside of what the manufacturer RECCOMMENDS (not what they decree). There are millions of moving parts in your car and something will fail and your safety is at risk. I've built a few motors in my time and I can say that no two mechanical items built with the exact same specs and parts will turn out the same horsepower levels. Now if you're talking about a full out several thousand dollar race motor built to exacting specs...they'll all be within a few horsepower of each other. The downside being that if you build moving parts to these exact specs, it won't last 3 weeks driving day to day in stop and go, start restart daily driving. The same holds true to your car. Things go wrong and parts fail or wear out, fact of life. If you drive your Honda to work every day through 50 miles of interstate traffic with few stops or slow downs, your call will wear out different parts than another Honda exactly like yours driving through 50 miles of gridlock downtown traffic. The manual isn't the car's Bible, it's simply a recommendation. It's up to you to use a trusted mechanic who won't rip you off, or learn enough to know what your mechanic is selling you. The manual is a start, but it is a very generalized document that does not go in-depth at all or take irregularities into play, simply averages...which is why the top of that chart says Manufacturer's RECCOMENDED Maintenance.

jcalkins
jcalkins

Before I go to the car dealer (that sold me my car) for car maintenace that is due, I read my car manual to find out what kind of service maintenance the manufacturer recommends for my car with its current mileage. Always, the car dealer throws in several additional service maintenance items and tasks (which substantially increases the final bill) that the manufacturer makes no mention in its recommended maintenance list. And every time I tell the dealer to stick with the car manual list of maintenance items because the car manufactuer has been in the business of designing, manufacturering, and servicing its cars for the past 100 years, acquiring enormous expertise and experience to back up whatever that manufacturer advises me to do about maintaining my car. And every time the dealer grumbles and grouches, sending me the message that I, just a regular consumer, have the audacity to use the words of the manufacturer to countermand what the dealer wants me to do. Accordingly, I do what the manufacturer tells me to do, not the dealer or some technician, and I rely on the manufacturer to tell me, again, just a regular consumer, what I need to do to protect my car and protect my family while using the car. Now, if a computer products manufacturer tells me that formatting or reformatting (choose whatever term that pleases you) my hard drive "erases ALL data on the drive," I expect that to happen without any double talk, BS, baloney, or nitpicking. You are saying that the manufacturer is both misleading its consumers and lying through its teeth and describing all the nitpicking, double talk, baloney used to effect that lie. That situation is an example of the source of litigation for parties damaged by the lie, whether accidently or intentionally effected. In light of the expertise and experience involved, the situation is not accidental.

Forum Surfer
Forum Surfer

I don't know about you, but I don't rely on what some piece of software splashes on a screen...I do my own research if my job is on the line. A simple Google search for data recovery will yield you dozens of free trials to download. I have used these products and successfully recovered data that has been on a formatted drive, regardless of what the warning said. Matter of fact, I discovered the drive had been formatted 4 times and found some old W2k info from it. Four formats and the and I recovered the inital data through a simple download. The files (excel, word, access docs) were intact after the retrieval and able to be read and modified. For curiosity sake, I could still recover data with this free software after formatting and wiping the drive in a 3x pass. Just do a few simple google searches, you'll see that formatting absolutely does not destroy the data. I'm not talking about some super geek in a lab coat magically pulling data off...I mean a regular joe with the power of google can do it.

apotheon
apotheon

Every time you write data to a given part of the disk, it becomes more difficult to recover what was previously there. If you overwrite the entire disk, you make it more difficult to recover anything that was on the disk. If you overwrite it [b]many times[/b], you make it [b]much more difficult[/b] to recover anything from before those overwrites. Generally speaking, most people will not have the know-how and the tools to recover anything that has been overwritten even once. Some people will still be able to do so, however, including data recovery firms, computer forensics consultants, and certain government agencies. Overwriting more times makes it more and more difficult for such people to recover data, eventually requiring use of very expensive magnetic scanning equipment and the like to even have a snowball's chance in hell of getting data. So . . . just formatting the drive or repartitioning the drive may be enough, depending on who gets the thing next, but don't bet on it. Overwriting the drive 25 times with random noise, on the other hand, provides far better protection against unauthorized recovery of useful data.

jcalkins
jcalkins

I just started the process of reformatting my hard drive. I received the following warning notice before commencing that reformatting: "WARNING: Formatting will erase ALL data on the disk." I am from planet Earth and that warning message is both in plain English and clear. Also, that warning message looks like it is intended to be relied upon.

shazardy2000
shazardy2000

hmmm what if you format a drive which resets the toc and verfies that the drive had no bad sectors etc as people already said in the previous replies the data that was there before is not removed jus 'lost' as in its there on the hdd but no toc so it can't be found via the toc... So when formatted and if the entire hdd is refilled to max with other random data, does this mean it over writes the old data and it will be gone? or will the previous data could still be recovered after being over written...

apotheon
apotheon

. . . from the perspective of the common user. This is especially the case considering that, the moment you start using the newly formatted filesystem, you're overwriting the drive. Anyway, the fact that something is "lost" doesn't always mean it cannot be "found" again. There are people whose jobs are based entirely on their ability to recover data from corrupted filesystems, formatted drives, and so on. Trying to recover data that has been given the default [b]shred[/b] treatment is a significant undertaking. Recovering data from a simple high-level format is a cakewalk. Short of physical destruction of the drive platters, there's always a possibility of getting the data back.