Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

How secure do you consider this process?

  1. A drive has data from a previous OS installation.
  2. A new OS installation is made on the drive, and Heidi Eraser is run on free space.

What are the chances of data being recovered from the original install?

share|improve this question

migrated from stackoverflow.com Jan 30 '12 at 11:06

This question came from our site for professional and enthusiast programmers.

    
Why wouldn't you run a boot disk eraser before installing the new OS? –  Iszi Jan 30 '12 at 16:04

3 Answers 3

As far as I can see from the documentation, Heidi Eraser makes a serious attempt at erasing all the unused space on the disk where old data may linger. Make sure to select “erase cluster tips”, as otherwise some hard-to-exploit data fragments could be left in blocks that are only partially used by a file (because the size of this file is not a whole number of blocks) (this is explained in the “cluster tips” entry in the glossary in the manual). Heider Eraser also takes care of erasing the filesystem table to wipe the names of old files. I have not seen any reference to erasing areas reserved for filesystem metadata which may not have been initialized (I don't know if NTFS has such areas).

Nonetheless, I strongly recommend wiping data before installing the new operating system, because it's simpler. Heider Eraser has to whitelist areas to wipe, because it must make sure not to erase live data. Wiping a blank disk is straightforward. Do this, then install the new operating system.

Note that overwriting once with zeroes is practically as good as overwriting with random data multiple times (there was a difference with 1980s technology, but not with today's denser disks). Also, note that against an attacker with physical access and some electronic equipment, wiping is not enough, especially with SSD, because the disks reallocate defective or worn sectors but you can still read them with the right equipment. See How can I reliably erase all information on a hard drive? and other [deletion] questions on this site.

share|improve this answer

Any drive eraser app which overwrites every block on the partition even once will make your chances of data retrieval effectively nil. Check to see if Heidi was set to do this. Don't worry about the number of passes - it was useful when hard disks were not as well developed, as you could retrieve a lot of information by moving the read head slightly off the correct track, but this isn't the case any more.

If it wasn't a full erase, you may get some data back, but not from the areas the new OS was installed to as it will have overwritten it.

Have a look at this question on securely deleting files for more information.

share|improve this answer

It depends on the algorithm used to over write the data. The most successful (probably an overkill but...) algorithm that Heidi Eraser uses is Gutmann (35 passes).

There are two methods of data recovery. One of which is just reading the deleted data from the hard disk. If it is the case just overwriting the deleted data is enough. But other recovery method is Magnetic force microscopy (MFM) in which the number of overwrites and even how you overwrite the data is very important.

share|improve this answer
4  
The number of overwrites doesn't matter much, the main issue is making sure that you overwrite every physical bit you want gone at least once. It's very hard to do this, especially one SSDs. –  CodesInChaos Jan 30 '12 at 14:08
    
@CodeInChaos - The only real way to do it with SSD is to encrypt the entire drive before any data is placed on it. This is of course because Solid State Drives have technology to prevent wear, so it will on its own, move data all the time. As with both mechanical drives and SSD deleted data is not actually deleted, its just marked as delete, and overwritten when the drive decides to do so. –  Ramhound Jan 30 '12 at 15:08
    
One overwrite is enough with modern drives - except SSD's. –  Rory Alsop Jan 30 '12 at 19:13
    
Even rotating disks have "spare sectors", and many disks with wear leveling are not called "SSD". –  Ben Voigt Jan 31 '12 at 1:31
    
Well, there are two methods of data recovery. One of which is just reading the deleted data from the hard disk. If it is the case just overwriting the deleted data is enough. But other recovery method is Magnetic force microscopy (MFM) in which the number of overwrites and even how you overwrite the data is very important. –  Ömer Mert Ekşioğlu Jan 31 '12 at 7:39

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.