A couple of days ago on 4chan /b/, a thread about CP (nothing new there) segued into a discussion about the nature of hard drives, and different methods of 'permanently' removing data from them. I thought some of the things mentioned were pretty interesting, but some of the questions about hard drives went unanswered. So, I bring you these questions, hoping there will be a more in-depth discussion here.
tl;dr -- How is 'deleted' data recovered from a disk, and what are some ways of 'completely' removing data from the disk?
Name:
Anonymous2006-03-15 22:19
How is 'deleted' data recovered from a disk
Oversimplified explanations:
Filenames are generally stored in a big table on the disk, with pointers to the actual data (so e.g. 'file hotcp.jpg starts at block 31415'). A normal delete removes the filename (and other related metadata), but doesn't touch the file's data blocks. So these will be left intact until they're overwritten with new data.
A secure delete overwrites the filedata. An single overwrite with null still allows the data on the disk to be recovered, because on disk the zeroes and ones aren't exactly 0 and 1. For example, suppose the values 0 1 0 1 are stored at first, after overwriting them with nulls, you might now have 0 0.1 0 0.1.
So overwriting your data with random data is safer. I don't know how they'd go and retrieve it after that, but people say it's possible and that you should overwrite multiple times. There are a ton of programs that do this for the truly paranoid.
Name:
Anonymous2006-03-15 22:37
The US Government recommends you write over the data 7 times.
Name:
Anonymous2006-03-15 23:15
>>3
Of course they recommend that, they're the ones who have to recover the data.
In reality, nobody has recovered usable data from a 5 times overwrite (or if they have it's using classified equipment which they're hardly going to use against common-or-garden criminal types).