How secure do you consider this process?
- A drive has data from a previous OS installation.
- A new OS installation is made on the drive, and Heidi Eraser is run on free space.
What are the chances of data being recovered from the original install?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
As far as I can see from the documentation, Heidi Eraser makes a serious attempt at erasing all the unused space on the disk where old data may linger. Make sure to select “erase cluster tips”, as otherwise some hard-to-exploit data fragments could be left in blocks that are only partially used by a file (because the size of this file is not a whole number of blocks) (this is explained in the “cluster tips” entry in the glossary in the manual). Heider Eraser also takes care of erasing the filesystem table to wipe the names of old files. I have not seen any reference to erasing areas reserved for filesystem metadata which may not have been initialized (I don't know if NTFS has such areas).
Nonetheless, I strongly recommend wiping data before installing the new operating system, because it's simpler. Heider Eraser has to whitelist areas to wipe, because it must make sure not to erase live data. Wiping a blank disk is straightforward. Do this, then install the new operating system.
Note that overwriting once with zeroes is practically as good as overwriting with random data multiple times (there was a difference with 1980s technology, but not with today's denser disks). Also, note that against an attacker with physical access and some electronic equipment, wiping is not enough, especially with SSD, because the disks reallocate defective or worn sectors but you can still read them with the right equipment. See How can I reliably erase all information on a hard drive? and other [deletion] questions on this site.
Any drive eraser app which overwrites every block on the partition even once will make your chances of data retrieval effectively nil. Check to see if Heidi was set to do this. Don't worry about the number of passes - it was useful when hard disks were not as well developed, as you could retrieve a lot of information by moving the read head slightly off the correct track, but this isn't the case any more.
If it wasn't a full erase, you may get some data back, but not from the areas the new OS was installed to as it will have overwritten it.
Have a look at this question on securely deleting files for more information.
It depends on the algorithm used to over write the data. The most successful (probably an overkill but...) algorithm that Heidi Eraser uses is Gutmann (35 passes).
There are two methods of data recovery. One of which is just reading the deleted data from the hard disk. If it is the case just overwriting the deleted data is enough. But other recovery method is Magnetic force microscopy (MFM) in which the number of overwrites and even how you overwrite the data is very important.
Please download something like Parted Magic or Hirens boot cd. There are tools on these disks to secure erase your hard drive or SSD. I personally use Parted Magic just because I find it easy to work with. just start a ATA secure erase. The normal command will overwrite all user data with zeros, the enhanced version of the command will overwrite all bad sectors on hard disks with predetermined random data. On SSDs the normal command should delete the encryption keys (for self encrypting drives) or delete all data accessible to the user. The enhanced version should mark all blocks as invalid and garbage collection/TRIM would then clear the cells.
@JohnCharles117 Your media destruction policy should directly support your data destruction policy, and your data destruction policy should be based upon your threat model and hte value of your data assets.
Per NISPOM (DoD 5220.22-M, section 8, table 1) as recently as 1997 allowed for media destruction via securely overwriting the medium via a special procedure (this procedure can be executed using tools like DBAN). Post 1997, this procedure has been removed and the remaining acceptable media destruction techniques are degaussing, shredding or incineration.
Presuming your data dos not have the confidentiality requirements comparable to the data processed by personnel contributing to a SAP, you may accept the overwriting as sufficient. Fundamentally, this business decision can only be made by the person accountable for the confidentiality of the data that you process at your facility.