As one can find in the Disk Utility/Erase/Security Options section, there are two options for erasing disks securely - zero out 7 times or zero out 35 times. Where these numbers come from?

migrated from programmers.stackexchange.com May 12 '13 at 0:59

This question came from our site for professionals, academics, and students working within the systems development life cycle.

  • 1
    35 comes from multiplying 7 by 5. – FredOverflow May 11 '13 at 3:41
  • 3
    @FredOverflow "What do you get if you multiply six by nine?" :-) – Ross Patterson May 11 '13 at 13:03
  • Do you mean "odd" as in peculiar, or "odd" as in not a multiple of 2? – Keith Thompson May 11 '13 at 18:40
  • @KeithThompson, I mean as in not multiple of 2. – duros May 11 '13 at 18:42
  • 3
    Our drive eraser goes upto 11 – Martin Beckett May 11 '13 at 18:45

The 7 and 35 passes very probably come from the paper "Secure Deletion of Data from Magnetic and Solid-State Memory" by Peter Gutmann. There, he described various overwrite patterns targeted at specific hard drive write encodings.

However, the paper, and the 35 passes, are now obsolete, as they were for old hard drive technology, as even the author readily admits. Nowadays, to delete a disk, a single pass with zeroes is enough. Even better, use the SECURE ERASE feature of all modern drives.

For more discussion see the Wikipedia article on the Gutmann method.

  • 1
    Just a quick note for future readers: For more info on the ATA Secure Erase command, and why it's the preferred choice for magnetic disks today, see security.stackexchange.com/a/5784/2122 . Also, don't wipe SSDs by overwriting, and be cautious with ATA Secure Erase, see security.stackexchange.com/q/5662 – Jesper Mortensen May 12 '13 at 14:20
  • Use secure erase, but verify. I've seen drives out in the wild with firmware bugs that prevent secure erase from working properly. For instance, older WD Caviar Black 1TB disks would only erase about 2/3 of the disk, or would brick before completing the erase. In the latter case, physical destruction would be required. – Michael Hampton May 12 '13 at 17:12
  • Any recommendations for the verification tool? – moey Apr 3 '14 at 4:15
  • @moey: Sorry, no idea. Better ask that as a new question. – sleske Apr 3 '14 at 8:41
  • 1
    Done, here's the new question: security.stackexchange.com/q/54822/43367 – moey Apr 4 '14 at 3:17

Writing information to a hard drive once will thoroughly replace all data that's under the drive head with the new data, but requests to write a particular track won't always cause the head to pass over exactly the same spot. Especially with older drives, various factors like aging and temperature are likely cause the head to pass slightly to the left or right of its "ideal" location. If e.g. information was written when the drive was cold, causing the head to be to the left of its ideal position, and it was later overwritten when it was warmer causing the head to be to the right of ideal, it's possible that enough residue of old information might remain on the left edge of the track to be readable with suitable equipment. Note that overwriting the track dozens of times may not help; depending upon the design of the drive, it might be possible to influence the heat position other ways (e.g. if the information in question is on track 53, accessing track 52 and then 53 may leave the head in a different place from accessing track 54 and then 53, but there's no guarantee that would be sufficient).

Flash drives present a different challenge, because repeated requests to write the same sector will actually cause the data to be stored in different areas of memory. Flash memory can generally be written in 528-byte pages (each holding 512 bytes of data plus some bookkeeping information), but once a page of flash is written it cannot be rewritten until a bulk-erase request is used to clear all of the pages in a rather large area (hundreds or thousands of pages). Rather than erasing a sector as soon as a request is received to rewrite it, the flash chip simply stores the new version and keeps track of the fact that the old one has been superseded. When the number of completely-blank blocks reaches a certain threshold, the drive will try to find find a block with relatively few pages that are still valid, copy those to a completely-blank block, and then erase the block. When a block is erased, any information which had been on it but wasn't copied will be thoroughly destroyed, but if a page happens to reside in a block with hundreds of pages that are still in use its storage may not get recycled even other, more-recently-written pages do.


Neither of those should be considered the least bit secure. Just zero-ing out the data is not enough, no matter how many times you do it.

All so-called secure erase software should follow recommendations such as those given in Secure Deletion of Data from Magnetic and Solid-State Memory by Peter Gutmann. This paper recommends 35 write passes, some of which use random data and some of which use specific patterns, only one of which is all zeroes.

  • 1
    Has there ever been a well-documented case where a significant amount of data (i.e. not some impractical value like every 1000th bit) could be recovered after overwriting it once with zeros? – FredOverflow May 11 '13 at 13:10
  • @FredOverflow I don't know. I'm not an expert, I'm just citing the literature. But my view is: why take the chance? Use a secure eraser. – Celada May 11 '13 at 16:08
  • 3
    Number of passes is irrelevant. If you actually overwrite the data once it's enough. Multiple overwrites were only necessary decades ago. The real problem is that it's hard to ensure that the data is overwritten at least once. Things like wear-leveling, defect sectors, shadow copies etc. can lead to copies of the data remaining even after you tried to overwrite them. – CodesInChaos May 11 '13 at 17:24
  • 2
    -1 Just zero-ing out is enough. No one has ever demonstrated data recovery. Some agency might be able to do it and keep it secret, but that's very speculative. – sleske May 11 '13 at 18:04
  • 2
    Also even in the 1980's you never needed all 35 passes. 35 passes covers all types of drives. Given that any given hard drive uses a single physical encoding you only needed to apply the passes applicable to that encoding. – jhoyla May 12 '13 at 12:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy