Tech Support Forum - View Single Post

**raptor_pa** · 12-15-2008, 05:28 PM

Assuming you don't have classified information on your PC, then a single pass 00 overwrite will be nearly as effective. There is no easy or cheap solution to recover the data after a 00 overwrite. For drives coming out of facilities where there is a legal requirement such as banks, medical facilities etc, then multiple passes and a few other tricks might be required. The concern is that track edges can still carry some readable impressions that aren't necessarily flipped in a single pass. A hard drive does not really record a digital 1 or zero in a discrete location, but actually records a more analog type signal that is interpretted as a 1 or 0. Three passes is DOD spec for non-classified information. For classified information the only DOD accepted destruction is physical destruction. It is unlikely that the average person is going to have the hardware required to even attempt a recovery after a single pass, let alone get anything useful LOL And it sure isn't going to happen with $100 software.
You could do multiple passes with KillDisk, or download DBan and do multiples with that. after you are done, Run GetDataBack, R-Studio, Stellar Phoenix or some of the other recovery software against the drive to see that it is clean.
It is possible for wiping software to miss some information, but it is very unusual. It is also possible to get data back from sectors marked in the G-List of the drive. The G-List is the 'grown list' of bad sectors. during normal operations sectors will become bad on a disk, these sectors are added to the g-list and remapped to spare sectors by the drives firmware. Normally these sectors are skipped during data recovery. there are tools out there that will read the g-list and attempt to read data from these sectors, or blank the glist so they can be read. Normally these procedures are reserved for higher end forensic cases. The cheapest I've seen hardware capable of this is around $2000.00 - and it goes way up from there. The bad sectors will usually only return bits and pieces of data, and they get read in the hopes of finding some useful scrap of evidence.

12-15-2008, 05:28 PM	#2 (permalink)
raptor_pa Mod Hardware Team Join Date: Dec 2008 Location: Central PA Posts: 4,539 OS: XP	Re: KILLDISK, how does it work? Assuming you don't have classified information on your PC, then a single pass 00 overwrite will be nearly as effective. There is no easy or cheap solution to recover the data after a 00 overwrite. For drives coming out of facilities where there is a legal requirement such as banks, medical facilities etc, then multiple passes and a few other tricks might be required. The concern is that track edges can still carry some readable impressions that aren't necessarily flipped in a single pass. A hard drive does not really record a digital 1 or zero in a discrete location, but actually records a more analog type signal that is interpretted as a 1 or 0. Three passes is DOD spec for non-classified information. For classified information the only DOD accepted destruction is physical destruction. It is unlikely that the average person is going to have the hardware required to even attempt a recovery after a single pass, let alone get anything useful LOL And it sure isn't going to happen with $100 software. You could do multiple passes with KillDisk, or download DBan and do multiples with that. after you are done, Run GetDataBack, R-Studio, Stellar Phoenix or some of the other recovery software against the drive to see that it is clean. It is possible for wiping software to miss some information, but it is very unusual. It is also possible to get data back from sectors marked in the G-List of the drive. The G-List is the 'grown list' of bad sectors. during normal operations sectors will become bad on a disk, these sectors are added to the g-list and remapped to spare sectors by the drives firmware. Normally these sectors are skipped during data recovery. there are tools out there that will read the g-list and attempt to read data from these sectors, or blank the glist so they can be read. Normally these procedures are reserved for higher end forensic cases. The cheapest I've seen hardware capable of this is around $2000.00 - and it goes way up from there. The bad sectors will usually only return bits and pieces of data, and they get read in the hopes of finding some useful scrap of evidence.