How many overwrites for secure erase?

How many overwrites for secure erase?

Secure Home | Search | About
 Computer Software Security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
How many overwrites for secure erase? Arthur T. 02-23-2008
Posted by Arthur T. on February 23, 2008, 1:54 am
If you were  Registered and logged in, you could reply and use other advanced thread options
On another list, someone asked a question which piqued my
curiosity.

U.S. DoD requires 7 overwrites. The OP wanted a '*technical*
justification of "15-times" or any other number. Technical one,
not "because mama said so".'

Has anyone actually recovered data that's been overwritten
even once by random data? Twice?

We know about the theoretical techniques to get the data. We
know it would be horrendously expensive. But has anyone
*actually* done it?

And, regardless, is there some number of overwrites that
*will* make the data unrecoverable? The OP was looking for
something better than pulling a number out of the air (or
wherever) - a number with some theoretical or experimental
justification.

I figured if anyone had the answers (and was allowed to give
them), it would likely be someone in this group.

--
Arthur T. - ar23hur "at" intergate "dot" com
Looking for a z/OS (IBM mainframe) systems programmer position

Posted by Sebastian G. on February 23, 2008, 4:40 am
If you were  Registered and logged in, you could reply and use other advanced thread options
Arthur T. wrote:


> And, regardless, is there some number of overwrites that
> *will* make the data unrecoverable?


Current harddrives are within about 5 to 10 % of the Shannon limit, thus one
overwrite should suffice.

Posted by David H. Lipman on February 23, 2008, 7:09 am
If you were  Registered and logged in, you could reply and use other advanced thread options

| On another list, someone asked a question which piqued my
| curiosity.
|
| U.S. DoD requires 7 overwrites. The OP wanted a '*technical*
| justification of "15-times" or any other number. Technical one,
| not "because mama said so".'
|
| Has anyone actually recovered data that's been overwritten
| even once by random data? Twice?
|
| We know about the theoretical techniques to get the data. We
| know it would be horrendously expensive. But has anyone
| *actually* done it?
|
| And, regardless, is there some number of overwrites that
| *will* make the data unrecoverable? The OP was looking for
| something better than pulling a number out of the air (or
| wherever) - a number with some theoretical or experimental
| justification.
|
| I figured if anyone had the answers (and was allowed to give
| them), it would likely be someone in this group.
|

The DoD requirements are...

Write a bit pattern such as; 10101010
Write its complement; 01010101
Write another pattern such as; 11110000

Perform that six times.

The disk will then be sanitized.

--
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp



Posted by Unruh on February 23, 2008, 10:17 am
If you were  Registered and logged in, you could reply and use other advanced thread options


>| On another list, someone asked a question which piqued my
>| curiosity.
>|
>| U.S. DoD requires 7 overwrites. The OP wanted a '*technical*
>| justification of "15-times" or any other number. Technical one,
>| not "because mama said so".'
>|
>| Has anyone actually recovered data that's been overwritten
>| even once by random data? Twice?
>|
>| We know about the theoretical techniques to get the data. We
>| know it would be horrendously expensive. But has anyone
>| *actually* done it?
>|
>| And, regardless, is there some number of overwrites that
>| *will* make the data unrecoverable? The OP was looking for
>| something better than pulling a number out of the air (or
>| wherever) - a number with some theoretical or experimental
>| justification.
>|
>| I figured if anyone had the answers (and was allowed to give
>| them), it would likely be someone in this group.
>|

>The DoD requirements are...

>Write a bit pattern such as; 10101010
>Write its complement; 01010101
>Write another pattern such as; 11110000

>Perform that six times.

>The disk will then be sanitized.

The dod is a bureacracy. Although the recmmendation probably made sense
once, once they had been promulgated they will never again change no matter
how the technology changes. To relax them puts someone's ass on the line.
What if he aralaxes them and suddenly some data leaks. Thus they are frozen
in time even if they make no sense whatsoever.
I would not take their recommendation as indicating anything whtsoever
about what the current best proctice is. While doing what they say may not
harm except that the wipe taks 2 days rather than 20min.-- which means
noone does it.

>--
>Dave
>http://www.claymania.com/removal-trojan-adware.html
>Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp



Posted by David H. Lipman on February 23, 2008, 10:28 am
If you were  Registered and logged in, you could reply and use other advanced thread options


|
| The dod is a bureacracy. Although the recmmendation probably made sense
| once, once they had been promulgated they will never again change no matter
| how the technology changes. To relax them puts someone's ass on the line.
| What if he aralaxes them and suddenly some data leaks. Thus they are frozen
| in time even if they make no sense whatsoever.
| I would not take their recommendation as indicating anything whtsoever
| about what the current best proctice is. While doing what they say may not
| harm except that the wipe taks 2 days rather than 20min.-- which means
| noone does it.
|

The standard has changed. What I posted was the NEW standard.

Don't say "..noone does it.". I see disk sanitization done all the time.

This isn't something for just Defense organizations. Sanitization should be
done by *any*
company that has company proprietary information stored on their respective hard
disks.

--
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp



Similar ThreadsPosted
Fast and secure HDD erase? September 12, 2006, 9:04 am
DoD Harddrive Secure Erase Wipe April 2, 2008, 9:37 pm
Advice needed on secure remote datacenter and secure communication August 24, 2008, 8:36 pm
Secure Auditor secure your windows April 28, 2008, 6:24 am
Does SSL "secure" WEP? October 13, 2006, 3:40 am
Which Is More Secure??? January 4, 2007, 7:47 pm
is my network secure? November 26, 2005, 11:52 pm
is this webpage secure? November 29, 2005, 12:12 pm
Secure passwords? November 30, 2005, 2:45 pm
Is my file secure? February 9, 2006, 4:33 pm

The site map in XML format XML site map

Contact Us | Privacy Policy