Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

c't on secure file deletion

0 views
Skip to first unread message

Arno Wagner

unread,
Feb 27, 2003, 5:21:58 PM2/27/03
to
Since this was discussed here recently, I am posting this
info and my thoughts on it:

The German computer magazine c't has an article on secure file
deletion in it's last issue. Among other things they asked
three data recovery companies (Ibas, Ontrack, Vogon) to
recover overwritten files from harddrives. The companies
where not even able to recover files overwritten with zeroes
once. (I think they did not even try, but said they could not
do it.)

Now this surprised me. I had thought that at least one layer
of overwriting was relatively easy to remove. I see several
possibilities why it might not be:

1. The special equipment needed is not worth having, as the
market is too small.

2. Many different sets of expensive equipment are needed, and
new ones for many/all new hdd models.

3. A single overwrite already weakens the previous data signal
enough that it vanishes in the background noise.

4. The usual conspiracy theories about the companies lying
because of official order, alien influence or time
traveling under-cover agents in their midst ....


For 1.-3. input of somebody working in HDD R&D would be nice.


Security implications:

Attackers up to smaller company level should be unable to recover
anything from a harddisk overwritten once. They would have to do
exactly what c't tried, namely ask a professional data recovery
company to recover the overwritten data for them. Law enforcement
may fall into this class as well, as long as the case is not
important enough.

What a more ressourceful attacker can do is entirely unclear.
In cases 1. and 2. they might still get in. (Multiple overwritings
may solve this problem.) If it 3. is true, no attacker can do
anything, regardless of available ressources.

In addition, even if some organizations are able to recover
data that has been overwritten one or several times, they
might not want to admit they can. As an effect, they will not be
able to act upon data recoverd in this way unless it
is extremely important or they can pretend to have gotten the data
in another way.

Side note: Overwriting files is potentialy difficult, expecially
in the presence of journalling systems or swap space. For true
secure deletion c't recommends a single complete overwrite of the
harddisk. My note: I find this excessive. Overwriting the partition
where the data was and the partition where temporary and swap-files
reside (or the swap partition if there is one) should be enough.
However any kind of selective overwrite needs some knowledge
about how data is stored. A complete overwrite will allways work.

Regards,
Arno
--
For email address: lastname AT tik DOT ee DOT ethz DOT ch
GnuPG: ID:1E25338F FP:0C30 5782 9D93 F785 E79C 0296 797F 6B50 1E25 338F
"The more corrupt the state, the more numerous the laws" - Tacitus


Mike

unread,
Feb 27, 2003, 6:42:28 PM2/27/03
to
A MUCH more fundamental question is why does it matter ?

Clearly multiple overwriting is trivial if you
are say getting rid of a hard drive and want to
ensure that no one can steal data that matters.

Even if you are say attempting to conceal illegal activity
like say child porn or drug trafficking, the only thing that
makes any sense is multiple overwriting too.

The short story is that you'd be stupid to risk a single pass of zeros.

It seems pretty clear that a single pass of zeros
combined with some form of encryption of the data
that matters is worth it with more basic data, even
for a business, protecting against theft etc.

"Arno Wagner" <m...@privacy.net> wrote in message news:b3m326$1o56r1$1...@ID-2964.news.dfncis.de...

Arno Wagner

unread,
Feb 28, 2003, 11:10:21 AM2/28/03
to
Previously Mike <m...@bang.biz.ru> wrote:
> A MUCH more fundamental question is why does it matter ?

Easy: It allows some estimation of the security level of overwrite
methods. If, e.g. a single overwrite could be removed easily, then
overwriting 4 times would probably not be secure. If a single layer is
problematic, 4 overwrites are pretty secure.

And there is the question on how to delete information that is not
illegal to possess. You might have e.g. a legal oblication to delete
some data. In that case doing a single overwrite would be acceptable
if a court accepts that because of the c't article (or because
professional data recovery companies cannot recover data ubn this
case) single overwrite was adequate.

And think of somebody that has to efficiently erase
some hundred disks, without damaging them. Then information
like this helps in determining a reasonable procedure.

This group is not only read by home-users.

J. Clarke

unread,
Feb 28, 2003, 12:57:32 PM2/28/03
to
On Fri, 28 Feb 2003 16:10:21 +0000, Arno Wagner wrote:

> Previously Mike <m...@bang.biz.ru> wrote:
>> A MUCH more fundamental question is why does it matter ?
>
> Easy: It allows some estimation of the security level of overwrite
> methods. If, e.g. a single overwrite could be removed easily, then
> overwriting 4 times would probably not be secure. If a single layer is
> problematic, 4 overwrites are pretty secure.
>
> And there is the question on how to delete information that is not
> illegal to possess. You might have e.g. a legal oblication to delete
> some data. In that case doing a single overwrite would be acceptable if
> a court accepts that because of the c't article (or because professional
> data recovery companies cannot recover data ubn this case) single
> overwrite was adequate.
>
> And think of somebody that has to efficiently erase some hundred disks,
> without damaging them. Then information like this helps in determining a
> reasonable procedure.
>
> This group is not only read by home-users.

The real question is not "how secure is it?", the real question is "how
secure does it need to be?" The answer to that question depends on the
value of the data to an outsider, the resources available to that
outsider, and the probability that he will gain posession of the drive.
Take two extremes--one is a kid's computer. The threat is another kid or
his parents, and neither are going to know much about data recovery or be
willing or able to devote much in the way of resources to the extraction
of the data, and the cost to the kid if the data is extracted is small (by
absolute standards--it may seem huge to the kid), so a simple erasure is
probably sufficient. The other is Osama Bin Laden's computer--the
potential cost is the destruction of his whole organization and the threat
is the US Government, which wants the data _real_ bad and has vast
resources of extremely high technological sophistication to devote to the
task of extracting it--in that case physical destruction of the drive
would be fully justified.


> Regards,
> Arno

--
--John
Reply to jclarke at ae tee tee global dot net
(was jclarke at eye bee em dot net)

Mike

unread,
Feb 28, 2003, 1:25:22 PM2/28/03
to

Arno Wagner <m...@privacy.net> wrote in message
news:b3o1ld$1mvu15$1...@ID-2964.news.dfncis.de...
> Mike <m...@bang.biz.ru> wrote

>> A MUCH more fundamental question is why does it matter ?

> Easy: It allows some estimation of the security level of overwrite methods.

The point is that you'd be mad to be risking a single pass of writing
zeros if the data security matters. Whatever is said in here.

> If, e.g. a single overwrite could be removed easily,
> then overwriting 4 times would probably not be secure.

Mindlessly silly.

> If a single layer is problematic, 4 overwrites are pretty secure.

Mindlessly silly.

> And there is the question on how to delete information that is
> not illegal to possess. You might have e.g. a legal oblication to
> delete some data. In that case doing a single overwrite would
> be acceptable if a court accepts that because of the c't article
> (or because professional data recovery companies cannot
> recover data ubn this case) single overwrite was adequate.

And the only thing that makes any sense is to do a multiple overwrite.
Its not as if that requirement to delete data is done often enough
that the time required for a multiple overwrite matters.

> And think of somebody that has to efficiently erase
> some hundred disks, without damaging them.

In the real world that is so rare its not worth worrying about
and it would be stupid to risk just a single pass with data that
the security matters with, based on what's claimed here.

Any operation where that is done would be
aware of what the policy is on that anyway.

> Then information like this helps in determining a reasonable procedure.

Nope.

> This group is not only read by home-users.

Sure, but only a fool would base something as important as
that on whats claimed here. Particularly when there is an obvious
incentive to claim that a single pass is secure when its not.


Joep

unread,
Feb 28, 2003, 3:13:23 PM2/28/03
to
> Mindlessly silly.
> Nope.
> Mindlessly silly.

Rodney? ....

--
Joep

"Mike" <m...@bang.biz.ru> wrote in message
news:mQN7a.45693$VH5....@news-server.bigpond.net.au...

Joep

unread,
Feb 28, 2003, 3:25:23 PM2/28/03
to
If well known data recovery outfits like the ones mentioned can not recover
data from a single pass wipe then this means your data is pretty safe. C!t
magazine is the most serious, educated, in depth magazine in Holland and
Germany. They do not just fill their pages like some magazines, they
investigate and know their stuff. Their editors are IT professors etc.

I always read stories about labs that recover data even after multiple
passes, but have never seen any proof. I call their bluff ... But even so:

A single pass is like sending your disk to the moon, your neighbour can't
get it, the cops can not get it and even the pope ... sure, there are
agencies, countries that probably could afford to goto the moon and get that
disk. After a few passes it's at Mars ...

--
Joep

"J. Clarke" <jcl...@nospam.invalid> wrote in message
news:pan.2003.02.28....@nospam.invalid...

Arno Wagner

unread,
Feb 28, 2003, 3:50:36 PM2/28/03
to
Previously J. Clarke <jcl...@nospam.invalid> wrote:
> On Fri, 28 Feb 2003 16:10:21 +0000, Arno Wagner wrote:

>> Previously Mike <m...@bang.biz.ru> wrote:
>>> A MUCH more fundamental question is why does it matter ?
>>

[...]

> The real question is not "how secure is it?", the real question is "how
> secure does it need to be?"

Exactly! And in only after that "How can this level of security
be achieved efficiently?".

> The answer to that question depends on the
> value of the data to an outsider, the resources available to that
> outsider, and the probability that he will gain posession of the drive.
> Take two extremes--one is a kid's computer. The threat is another kid or
> his parents, and neither are going to know much about data recovery or be
> willing or able to devote much in the way of resources to the extraction
> of the data, and the cost to the kid if the data is extracted is small (by
> absolute standards--it may seem huge to the kid), so a simple erasure is
> probably sufficient. The other is Osama Bin Laden's computer--the
> potential cost is the destruction of his whole organization and the threat
> is the US Government, which wants the data _real_ bad and has vast
> resources of extremely high technological sophistication to devote to the
> task of extracting it--in that case physical destruction of the drive
> would be fully justified.

Actually c't warns to not rely on physical destruction only.
Aparently burned and otherwise physically damaged drives
are often easier targets for data recovery than overwritten
ones. I would think that melting the platters or at least bringing
them to red-hot glow should be done for secure physical destruction.

Arno Wagner

unread,
Feb 28, 2003, 3:54:14 PM2/28/03
to
Previously Mike <m...@bang.biz.ru> wrote:

> Arno Wagner <m...@privacy.net> wrote in message
> news:b3o1ld$1mvu15$1...@ID-2964.news.dfncis.de...
>> Mike <m...@bang.biz.ru> wrote

>>> A MUCH more fundamental question is why does it matter ?

>> Easy: It allows some estimation of the security level of overwrite methods.

[...]

>> And think of somebody that has to efficiently erase
>> some hundred disks, without damaging them.

> In the real world that is so rare its not worth worrying about
> and it would be stupid to risk just a single pass with data that
> the security matters with, based on what's claimed here.

LOL! Ever heard of companies giving old computers to charity?
Or selling their old computers/drives? Or throwing hundresd of the
things out as trash, without additional protection after they leave
the building?

Seems to me you have your head in the clouds.

Mike

unread,
Feb 28, 2003, 4:44:23 PM2/28/03
to

Arno Wagner <m...@privacy.net> wrote in message
news:b3oi9m$1pa2ao$2...@ID-2964.news.dfncis.de...

> Mike <m...@bang.biz.ru> wrote
>> Arno Wagner <m...@privacy.net> wrote
>>> Mike <m...@bang.biz.ru> wrote

>>>> A MUCH more fundamental question is why does it matter ?

>>> Easy: It allows some estimation of
>>> the security level of overwrite methods.

>>> And think of somebody that has to efficiently erase


>>> some hundred disks, without damaging them.

>> In the real world that is so rare its not worth worrying about
>> and it would be stupid to risk just a single pass with data that
>> the security matters with, based on what's claimed here.

> LOL! Ever heard of companies giving old computers to charity?
> Or selling their old computers/drives? Or throwing hundresd of the things
> out as trash, without additional protection after they leave the building?

I just meant that disposing of hundreds at a time is
so rare that it really doesnt matter if multiple passes
are used for a bit of insurance. No point in worrying
about 'efficiently' with something done so infrequenty.

> Seems to me you have your head in the clouds.

Best get your seems machinery seen to again.

A bit of remedial basic comprehension wouldnt go astray either.


J. Clarke

unread,
Feb 28, 2003, 5:56:06 PM2/28/03
to

Depends on how you define "physical destruction". Quick and dirty way to
destroy a drive--pull the platters, mount each one on the shaft of a power
saw, fire up the saw, apply coarse sandpaper until coating is gone, shut
down saw, flip platter over, repeat. If you have a lathe chuck the
platters in the lathe and cut them to a pile of chips. If you have access
to a foundry then throw the whole drive into an induction furnace (gives
you a double-whammy--intense oscillating magnetic field--which generates
enough ohmic heating through induced eddy currents to melt the metal). If
you know how to make Thermite (not that hard really) then toss the drive
into a bucket of Thermite and light it off (don't put the bucket on top of
anything you care about--it will do a mini China Syndrome before it's
done).

When I said "physical destruction" I wasn't thinking about a little bit of
damage, I was thinking about _destruction_.

J. Clarke

unread,
Feb 28, 2003, 6:06:15 PM2/28/03
to
On Fri, 28 Feb 2003 21:25:23 +0100, Joep wrote:

> If well known data recovery outfits like the ones mentioned can not recover
> data from a single pass wipe then this means your data is pretty safe. C!t
> magazine is the most serious, educated, in depth magazine in Holland and
> Germany. They do not just fill their pages like some magazines, they
> investigate and know their stuff. Their editors are IT professors etc.
>
> I always read stories about labs that recover data even after multiple
> passes, but have never seen any proof. I call their bluff ... But even so:
>
> A single pass is like sending your disk to the moon, your neighbour can't
> get it, the cops can not get it and even the pope ... sure, there are
> agencies, countries that probably could afford to goto the moon and get that
> disk. After a few passes it's at Mars ...

Suppose that you were given a disk and told to erase its contents by any
means you felt appropriate. Suppose also that the deal was that if
anybody ever recovered a byte of data from that drive they were going to
cut your balls off. Now, what method of erasure would you use?

Joep

unread,
Feb 28, 2003, 7:01:57 PM2/28/03
to
Yeah, let's suppose that. So what? Can't you read? Are you as stupid as you
sound? I say basically the same thing. You can sent your data to the moon,
it's hard to get it back but some frustrated idiot that has the money may
try. Sent it to Mars and it will get even harder ... Sent it even further
and no one will get it during your life time. So basically (I'll explain as
it seems too difficult for you to understand) I say, like you have said
before: "how secure does it need to be?" The answer to that question depends

on the value of the data to an outsider, the resources available to that
outsider, and the probability that he will gain posession of the drive.

So, is he willing to and can he fly to the Moon, Mars or even further ...
Tadaaa, get it?

Now stop playing with your balls.

Folkert Rienstra

unread,
Feb 28, 2003, 8:08:37 PM2/28/03
to

"Joep" <jo...@diydatarecovery.nl> wrote in message news:3e5fc607$0$26365$6c4e...@reader.news.uudial.eu.uu.net...

> If well known data recovery outfits like the ones mentioned can not recover
> data from a single pass wipe then this means your data is pretty safe. C!t
> magazine is the most serious, educated, in depth magazine in Holland and
> Germany. They do not just fill their pages like some magazines, they
> investigate and know their stuff. Their editors are IT professors etc.

There is a saying: Those that know, do. Those that don't, teach.

Arno Wagner

unread,
Mar 1, 2003, 6:20:26 AM3/1/03
to
Previously J. Clarke <jcl...@nospam.invalid> wrote:
> On Fri, 28 Feb 2003 21:25:23 +0100, Joep wrote:

>> If well known data recovery outfits like the ones mentioned can not recover
>> data from a single pass wipe then this means your data is pretty safe. C!t
>> magazine is the most serious, educated, in depth magazine in Holland and
>> Germany. They do not just fill their pages like some magazines, they
>> investigate and know their stuff. Their editors are IT professors etc.

Side note: I had "Byte" for a year. The are not even in the
same class as c't. My personal impression id that c't is the
most competent computer magazine on this planet.



>> I always read stories about labs that recover data even after multiple
>> passes, but have never seen any proof. I call their bluff ... But even so:
>>
>> A single pass is like sending your disk to the moon, your neighbour can't
>> get it, the cops can not get it and even the pope ... sure, there are
>> agencies, countries that probably could afford to goto the moon and get that
>> disk. After a few passes it's at Mars ...

I like this. Perhaps not moon for the single pass, low
earth orbit might be all you get. Still pretty good analogy.

> Suppose that you were given a disk and told to erase its contents by any
> means you felt appropriate. Suppose also that the deal was that if
> anybody ever recovered a byte of data from that drive they were going to
> cut your balls off. Now, what method of erasure would you use?

Pretty alien scenario. Definitely Mars.

If it is just about deleting one drive, a complete deletion is
acceptable and time is not an issue, by all means spend several days
overwriting. However if it is a production environment where time is
an issue, choose something reasonabley secure and efficient. Because
"they" not be pleased if you spend several hours blanking a harddrive
when one or very few overwrites are reasonably secure.

Don't forget that e.g. blanking a current 80GB disk _once_, takes
somethning like >30 minutes under optimal conditions.

Arno Wagner

unread,
Mar 1, 2003, 6:28:00 AM3/1/03
to
Previously Folkert Rienstra <see_Re...@myweb.nl> wrote:

> "Joep" <jo...@diydatarecovery.nl> wrote in message news:3e5fc607$0$26365$6c4e...@reader.news.uudial.eu.uu.net...
>> If well known data recovery outfits like the ones mentioned can not
>> recover data from a single pass wipe then this means your data is
>> pretty safe. C!t magazine is the most serious, educated, in depth
>> magazine in Holland and Germany. They do not just fill their pages
>> like some magazines, they investigate and know their stuff. Their
>> editors are IT professors etc.

> There is a saying: Those that know, do. Those that don't, teach.

Coined, no doubt by those that the teachers had no chance with.
And still popular in that group. I don't deny that there are many
bad teachers around, but there surely are many bad pupils/students
around! Blaming it on others (the teachers, the parents, the
society,...) is always a popular way around admiting to and dealing
with your own shortcommings.

A very cheap shot.

Arno Wagner

unread,
Mar 1, 2003, 6:42:32 AM3/1/03
to
Previously J. Clarke <jcl...@nospam.invalid> wrote:
> On Fri, 28 Feb 2003 20:50:36 +0000, Arno Wagner wrote:

>> Previously J. Clarke <jcl...@nospam.invalid> wrote:
>>> On Fri, 28 Feb 2003 16:10:21 +0000, Arno Wagner wrote:
>>

[...]


>> Actually c't warns to not rely on physical destruction only.
>> Aparently burned and otherwise physically damaged drives
>> are often easier targets for data recovery than overwritten
>> ones. I would think that melting the platters or at least bringing
>> them to red-hot glow should be done for secure physical destruction.

> Depends on how you define "physical destruction". Quick and dirty way to
> destroy a drive--pull the platters, mount each one on the shaft of a power
> saw, fire up the saw, apply coarse sandpaper until coating is gone, shut
> down saw, flip platter over, repeat.

Not that quick, but should do the trick. But make sure to have
good protection against the possibly toxic coating and metal dust.

> If you have a lathe chuck the
> platters in the lathe and cut them to a pile of chips.

Not secure unless the chips are _very_ small.

> If you have access
> to a foundry then throw the whole drive into an induction furnace (gives
> you a double-whammy--intense oscillating magnetic field--which generates
> enough ohmic heating through induced eddy currents to melt the metal).

That works and is fast, but has very special aequipment needs.
I expect that organizations that need to frequently securely destroy
disks will have one of those somewhere in the basement.

> If you know how to make Thermite (not that hard really) then toss
> the drive into a bucket of Thermite and light it off (don't put the
> bucket on top of anything you care about--it will do a mini China
> Syndrome before it's done).

Making Termite is a lot of effort. Most of these pesky iron ozydes
will not burn, you need to refine it. (We tried in chemistry
class. Pretty disappointing.) Only an option if you can burn things
(e.g. not in a city environment) and you can get termite or the right
kind or iron oxyde and fine aluminium powder. In the US, trying to
get this kind of supplies might get you a long-term visit
to a certain installation on Kuba.

> When I said "physical destruction" I wasn't thinking about a little
> bit of damage, I was thinking about _destruction_.

Accepted. You will probably get it right. But there are those that
think throwing a harddrive into a fire is enough. Or throwing it into
a lake. Or putting it into the oven. Or kicking it around. Or
throwing it off a cliff.

One none-violent thing that works with aluminium platters (not
the new glass ones) it to use chemicals (e.g. FeCl3 like is used
to make printed circuits or printing plates on a hobbyist level)
to dissolve them (filter of the coating afterwards and grind it
to dust).

Joep

unread,
Mar 1, 2003, 9:32:25 AM3/1/03
to
All I am trying to indicate that C't is a rock solid in depth magazine.
There is magazines that just fill pages and there's magazines you can
actually learn something from. C't fits the last group.

As a reader and contributor to this news group I would like to request you
now go in peace and find another audience for your 'sayings'. Thank you.

--
Joep

"Folkert Rienstra" <see_Re...@myweb.nl> wrote in message
news:b3p1b3$1omda3$2...@ID-79662.news.dfncis.de...

Mike

unread,
Mar 1, 2003, 2:07:46 PM3/1/03
to

Arno Wagner <m...@privacy.net> wrote in message
news:b3q51q$1olq40$1...@ID-2964.news.dfncis.de...

Sure, but doing it a couple of times for insurance with a ute
optimised to do it as fast as possible is the only thing that
makes sense in the rare situation where you are getting rid
of a raft of PCs because they are being replaced at once etc.

Mike

unread,
Mar 1, 2003, 2:11:19 PM3/1/03
to

Arno Wagner <m...@privacy.net> wrote in message
news:b3q5fv$1olq40$2...@ID-2964.news.dfncis.de...

> Folkert Rienstra <see_Re...@myweb.nl> wrote
>> Joep <jo...@diydatarecovery.nl> wrote

>>> If well known data recovery outfits like the ones mentioned


>>> can not recover data from a single pass wipe then this means
>>> your data is pretty safe. C!t magazine is the most serious,
>>> educated, in depth magazine in Holland and Germany. They
>>> do not just fill their pages like some magazines, they investigate
>>> and know their stuff. Their editors are IT professors etc.

>> There is a saying: Those that know, do. Those that don't, teach.

> Coined, no doubt by those that the teachers had no chance with.

Fraid not. Coined by those that do it in fact.

> And still popular in that group. I don't deny that
> there are many bad teachers around, but there
> surely are many bad pupils/students around!

It wasnt pupils/students being discussed,
it was those who do it instead of teaching it.

> Blaming it on others (the teachers, the parents,
> the society,...) is always a popular way around
> admiting to and dealing with your own shortcommings.

Yes, but that doesnt apply to those who DO it instead of teaching it.

> A very cheap shot.

With a grain of truth in it anyway.


Rod Speed

unread,
Mar 1, 2003, 2:19:07 PM3/1/03
to

Arno Wagner <m...@privacy.net> wrote in message
news:b3q6b8$1p9avk$1...@ID-2964.news.dfncis.de...
> J. Clarke <jcl...@nospam.invalid> wrote
>> Arno Wagner wrote
>>> J. Clarke <jcl...@nospam.invalid> wrote:
>>>> Arno Wagner wrote

> >> Actually c't warns to not rely on physical destruction only.
> >> Aparently burned and otherwise physically damaged drives
> >> are often easier targets for data recovery than overwritten
> >> ones. I would think that melting the platters or at least bringing
> >> them to red-hot glow should be done for secure physical destruction.
>
> > Depends on how you define "physical destruction". Quick and dirty way to
> > destroy a drive--pull the platters, mount each one on the shaft of a power
> > saw, fire up the saw, apply coarse sandpaper until coating is gone, shut
> > down saw, flip platter over, repeat.

> Not that quick, but should do the trick. But make sure to have
> good protection against the possibly toxic coating and metal dust.

> > If you have a lathe chuck the
> > platters in the lathe and cut them to a pile of chips.

> Not secure unless the chips are _very_ small.

Fraid so. While the data might be there
on the swarf, there is no way to retrieve it.

> > If you have access
> > to a foundry then throw the whole drive into an induction furnace (gives
> > you a double-whammy--intense oscillating magnetic field--which generates
> > enough ohmic heating through induced eddy currents to melt the metal).

> That works and is fast, but has very special aequipment needs.
> I expect that organizations that need to frequently securely destroy
> disks will have one of those somewhere in the basement.

> > If you know how to make Thermite (not that hard really) then toss
> > the drive into a bucket of Thermite and light it off (don't put the
> > bucket on top of anything you care about--it will do a mini China
> > Syndrome before it's done).

> Making Termite is a lot of effort. Most of these
> pesky iron ozydes will not burn, you need to refine
> it. (We tried in chemistry class. Pretty disappointing.)

Plenty have done it with rather spectacular results.

> Only an option if you can burn things
> (e.g. not in a city environment)

Most of the rest of the world hasnt
been as silly as you europeans on that.

> and you can get termite or the right kind or iron
> oxyde and fine aluminium powder. In the US, trying
> to get this kind of supplies might get you a
> long-term visit to a certain installation on Kuba.

Fantasy.

>> When I said "physical destruction" I wasn't thinking about
>> a little bit of damage, I was thinking about _destruction_.

> Accepted. You will probably get it right. But there are
> those that think throwing a harddrive into a fire is enough.
> Or throwing it into a lake. Or putting it into the oven.
> Or kicking it around. Or throwing it off a cliff.

Sure, there's always those pig ignorant of the specifics.

> One none-violent thing that works with aluminium platters (not
> the new glass ones) it to use chemicals (e.g. FeCl3 like is used
> to make printed circuits or printing plates on a hobbyist level) to
> dissolve them (filter of the coating afterwards and grind it to dust).

It aint that hard to melt aluminium.


Mike

unread,
Mar 1, 2003, 2:19:42 PM3/1/03
to

Arno Wagner <m...@privacy.net> wrote in message
news:b3q6b8$1p9avk$1...@ID-2964.news.dfncis.de...
> J. Clarke <jcl...@nospam.invalid> wrote
>> Arno Wagner wrote
>>> J. Clarke <jcl...@nospam.invalid> wrote:
>>>> Arno Wagner wrote

> >> Actually c't warns to not rely on physical destruction only.


> >> Aparently burned and otherwise physically damaged drives
> >> are often easier targets for data recovery than overwritten
> >> ones. I would think that melting the platters or at least bringing
> >> them to red-hot glow should be done for secure physical destruction.
>
> > Depends on how you define "physical destruction". Quick and dirty way to
> > destroy a drive--pull the platters, mount each one on the shaft of a power
> > saw, fire up the saw, apply coarse sandpaper until coating is gone, shut
> > down saw, flip platter over, repeat.

> Not that quick, but should do the trick. But make sure to have
> good protection against the possibly toxic coating and metal dust.

> > If you have a lathe chuck the
> > platters in the lathe and cut them to a pile of chips.

> Not secure unless the chips are _very_ small.

Fraid so. While the data might be there
on the swarf, there is no way to retrieve it.

> > If you have access
> > to a foundry then throw the whole drive into an induction furnace (gives
> > you a double-whammy--intense oscillating magnetic field--which generates
> > enough ohmic heating through induced eddy currents to melt the metal).

> That works and is fast, but has very special aequipment needs.
> I expect that organizations that need to frequently securely destroy
> disks will have one of those somewhere in the basement.

> > If you know how to make Thermite (not that hard really) then toss
> > the drive into a bucket of Thermite and light it off (don't put the
> > bucket on top of anything you care about--it will do a mini China
> > Syndrome before it's done).

> Making Termite is a lot of effort. Most of these
> pesky iron ozydes will not burn, you need to refine
> it. (We tried in chemistry class. Pretty disappointing.)

Plenty have done it with rather spectacular results.

> Only an option if you can burn things


> (e.g. not in a city environment)

Most of the rest of the world hasnt


been as silly as you europeans on that.

> and you can get termite or the right kind or iron


> oxyde and fine aluminium powder. In the US, trying
> to get this kind of supplies might get you a
> long-term visit to a certain installation on Kuba.

Fantasy.

>> When I said "physical destruction" I wasn't thinking about
>> a little bit of damage, I was thinking about _destruction_.

> Accepted. You will probably get it right. But there are
> those that think throwing a harddrive into a fire is enough.
> Or throwing it into a lake. Or putting it into the oven.
> Or kicking it around. Or throwing it off a cliff.

Sure, there's always those pig ignorant of the specifics.

> One none-violent thing that works with aluminium platters (not


> the new glass ones) it to use chemicals (e.g. FeCl3 like is used
> to make printed circuits or printing plates on a hobbyist level) to
> dissolve them (filter of the coating afterwards and grind it to dust).

It aint that hard to melt aluminium.


J. Clarke

unread,
Mar 1, 2003, 9:22:34 PM3/1/03
to
On Sat, 01 Mar 2003 11:28:00 +0000, Arno Wagner wrote:

> Previously Folkert Rienstra <see_Re...@myweb.nl> wrote:
>
>> "Joep" <jo...@diydatarecovery.nl> wrote in message news:3e5fc607$0$26365$6c4e...@reader.news.uudial.eu.uu.net...
>>> If well known data recovery outfits like the ones mentioned can not
>>> recover data from a single pass wipe then this means your data is
>>> pretty safe. C!t magazine is the most serious, educated, in depth
>>> magazine in Holland and Germany. They do not just fill their pages
>>> like some magazines, they investigate and know their stuff. Their
>>> editors are IT professors etc.
>
>> There is a saying: Those that know, do. Those that don't, teach.
>
> Coined, no doubt by those that the teachers had no chance with.
> And still popular in that group. I don't deny that there are many
> bad teachers around, but there surely are many bad pupils/students
> around! Blaming it on others (the teachers, the parents, the
> society,...) is always a popular way around admiting to and dealing
> with your own shortcommings.

Lemme guess. You're a teacher?


>
> A very cheap shot.
>
> Regards,
> Arno

--

J. Clarke

unread,
Mar 1, 2003, 9:19:58 PM3/1/03
to

There is an electrolytic process for making the correct oxide that
requires no special equipment. And if one is a criminal destroying
evidence of a crime, then getting ticketed for illegal burning is not
something that one is likely to worry about overly much.

>> When I said "physical destruction" I wasn't thinking about a little
>> bit of damage, I was thinking about _destruction_.
>
> Accepted. You will probably get it right. But there are those that
> think throwing a harddrive into a fire is enough. Or throwing it into
> a lake. Or putting it into the oven. Or kicking it around. Or
> throwing it off a cliff.
>
> One none-violent thing that works with aluminium platters (not
> the new glass ones) it to use chemicals (e.g. FeCl3 like is used
> to make printed circuits or printing plates on a hobbyist level)
> to dissolve them (filter of the coating afterwards and grind it
> to dust).

Something that I've been curious about is the efficacy of an induction
hotplate.

Arno Wagner

unread,
Mar 2, 2003, 8:48:08 AM3/2/03
to
Previously J. Clarke <jcl...@nospam.invalid> wrote:
> On Sat, 01 Mar 2003 11:28:00 +0000, Arno Wagner wrote:

>> Previously Folkert Rienstra <see_Re...@myweb.nl> wrote:
>>
>>> "Joep" <jo...@diydatarecovery.nl> wrote in message news:3e5fc607$0$26365$6c4e...@reader.news.uudial.eu.uu.net...
>>>> If well known data recovery outfits like the ones mentioned can not
>>>> recover data from a single pass wipe then this means your data is
>>>> pretty safe. C!t magazine is the most serious, educated, in depth
>>>> magazine in Holland and Germany. They do not just fill their pages
>>>> like some magazines, they investigate and know their stuff. Their
>>>> editors are IT professors etc.
>>
>>> There is a saying: Those that know, do. Those that don't, teach.
>>
>> Coined, no doubt by those that the teachers had no chance with.
>> And still popular in that group. I don't deny that there are many
>> bad teachers around, but there surely are many bad pupils/students
>> around! Blaming it on others (the teachers, the parents, the
>> society,...) is always a popular way around admiting to and dealing
>> with your own shortcommings.

> Lemme guess. You're a teacher?

No. Another cheap shot.

Arno Wagner

unread,
Mar 2, 2003, 8:57:27 AM3/2/03
to
Previously J. Clarke <jcl...@nospam.invalid> wrote:
> On Sat, 01 Mar 2003 11:42:32 +0000, Arno Wagner wrote:

>> Previously J. Clarke <jcl...@nospam.invalid> wrote:
>>> On Fri, 28 Feb 2003 20:50:36 +0000, Arno Wagner wrote:
>>
>>>> Previously J. Clarke <jcl...@nospam.invalid> wrote:
>>>>> On Fri, 28 Feb 2003 16:10:21 +0000, Arno Wagner wrote:
[...]

>> Making Termite is a lot of effort. Most of these pesky iron ozydes
>> will not burn, you need to refine it. (We tried in chemistry
>> class. Pretty disappointing.) Only an option if you can burn things
>> (e.g. not in a city environment) and you can get termite or the right
>> kind or iron oxyde and fine aluminium powder. In the US, trying to
>> get this kind of supplies might get you a long-term visit
>> to a certain installation on Kuba.

> There is an electrolytic process for making the correct oxide that
> requires no special equipment. And if one is a criminal destroying
> evidence of a crime, then getting ticketed for illegal burning is not
> something that one is likely to worry about overly much.

Agreed. (And it seems my chemistry teacher was less competent
than I though. He never mentioned this electrolytic process.)

However if you are a criminal destroying evidence, it might
be wise to avoid being noticed while destroying the evidence.

And if you destroy data that is not crimimal at all in a spectacular
and a visible way, your concerned neighbour might just think that
maybe you are a criminal or terrorist and maybe authorities should be
notified...

Regards,

0 new messages