0

The recommended way of ensuring that data on a hard disk cannot be recovered is to destroy it physically, for example using a hammer, drill or even thermite.

Question

When physical disk destruction is not an available option, what is the next best way of ensuring data cannot be recovered from a hard disk?

Note:

  • In the event that all data cannot be made unrecoverable, please assume that making it unrecoverable at a cost of less than millions of dollars would be a good enough solution. That is, the cost of hiring a forensics team to conduct deep technical work for many weeks, only for a small chance of recovering anything that could be made sense of.
Improve this question
11
  • 3
    "When physical disk destruction is not an available option" - I cannot understand the objective of this question. Given the amount of acceptable costs I cannot understand why the fairly cheap physical destruction would not be seen as acceptable. On other words: I currently cannot see a value in asking (and answering) this question. Maybe you could add enough context so that the value gets obvious. Also, is this about real hard drives (no SSD) where the data were not encrypted?
    – Steffen Ullrich
    Mar 14, 2021 at 20:28
  • 1
    Does this answer your question? How can I reliably erase all information on a hard drive? I suggest to close this question. It was asked many times and there are many answers available, that suggest many solutions except physical destruction.
    – mentallurg
    Mar 14, 2021 at 20:45
  • 2
    @stevec: "... please assume that making it unrecoverable at a cost of less than millions of dollars would be a good enough solution ..." - addressing the risks you describe here should make it acceptable to spend a considerate amount of money. This means selling the disk after spending this much money could still lead to a loss. Insofar I cannot accept your arguments. And as mentallurg already - this kind of questions was asked before and your previous question was even closed as duplicate of some of these.
    – Steffen Ullrich
    Mar 14, 2021 at 21:04
  • 2
    @stevec: "The question is perfectly clear. And why someone wants to do it is not relevant in the first place." - I've tried to dig deeper in order to find out how your question differs from previous ones, especially since your were aware of the previous ones since they were used to close your last question as duplicate. Finding out this difference is needed to address the specific different problem you have instead of just again closing the question as duplicate. Unfortunately I'm not able to find a difference so far, i.e. the problem as I understood it is IMHO handled by existing questions.
    – Steffen Ullrich
    Mar 14, 2021 at 21:38
  • 1
    @stevec: It looks for me like you are looking for actual easy to use product or tool recommendations instead of more general concepts. This is not the scope of this site. And question like "what is ATA" are not actually security related. Simply searching for securely erase hard drive, maybe combined with the name of the OS you use, will probably be more useful in searching for actual products or instructions specific to the OS you use. See also the tool guides at ssd.eff.org which cover secure deletion too.
    – Steffen Ullrich
    Mar 14, 2021 at 22:36

1 Answer 1

Reset to default
2

Yes variants of this question constantly recur, nevertheless I'll try to do a quick and dirty answer before this gets closed.

A single pass over write of the raw drive with anything, zeros, random, whatever is sufficient to make data practically unrecoverable. This can be done via direct write or via the builtin security commands.

Magnetic force microscopes are not going to extract the data.

Wear leveling in Solid State drives would require disassembly and chip removal to bypass the wear leveling controllers. Custom chip analysis of the wear level swapped bits can extract unwiped old snippets but this would be expensive, time consuming and have very little context. Standard forensic shops won't do this.

Bad sectors won't be wiped, but if they are truly bad you likely have nothing significant worth the effort of expensive reconstruction of the bad sectors. Yes, bad sectors can be artificially created to hide data, but if you did this you would know it.

Similarly HPA & DCO hidden sectors will not be wiped, but unless you created them and put data there, there's nothing of your's present.

Official classification standards require physical destruction to avoid even the most unlikely release.

Wipe with zeroes then check for non-zero content afterwards to verify. It won't meet military standards but it's a 99.9% solution.

Since you are looking for a simple "Do This", I suggest Eraser, or DBAN.

Improve this answer
1
  • Thanks, this info is very handy. Especially "Yes, bad sectors can be artificially created to hide data, but if you did this you would know it." because I don't even know what a bad sector is, so I wouldn't have created one. Would it be possible to include code/instructions for how to "Wipe with zeroes then check for non-zero content afterwards to verify."
    – stevec
    Mar 14, 2021 at 22:17

Not the answer you're looking for? Browse other questions tagged .