bugtraq - RE: New Data Wipe Tools

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Mon, 13 Sep 2004 09:45:04 -0700
From: "Altheide, Cory B. (IARC)" <AltheideC@...doe.gov>
To: "'Jake Appelbaum'" <jacob@...elbaum.net>,
	"Thomas C. Greene" <thomas.greene@...register.co.uk>,
	bugtraq@...urityfocus.com
Subject: RE: New Data Wipe Tools

> -----Original Message-----
> From: Jake Appelbaum [mailto:jacob@...elbaum.net] 
> Sent: Friday, September 10, 2004 10:42 AM
> To: Thomas C. Greene; bugtraq@...urityfocus.com
> Subject: Re: New Data Wipe Tools
> 
> Magnetic force microscopy is a threat that is very real for 
> many people.
> 
> It would be of great help for you to read this paper: 
> http://www.cs.auckland.ac.nz/~pgut001/pubs/secure_del.html
> 

Yes, and pay special attention to this portion:

"Epilogue

In the time since this paper was published, some people have treated the
35-pass overwrite technique described in it more as a kind of voodoo
incantation to banish evil spirits than the result of a technical analysis
of drive encoding techniques. As a result, they advocate applying the voodoo
to PRML and EPRML drives even though it will have no more effect than a
simple scrubbing with random data. In fact performing the full 35-pass
overwrite is pointless for any drive since it targets a blend of scenarios
involving all types of (normally-used) encoding technology, which covers
everything back to 30+-year-old MFM methods (if you don't understand that
statement, re-read the paper). If you're using a drive which uses encoding
technology X, you only need to perform the passes specific to X, and you
never need to perform all 35 passes. For any modern PRML/EPRML drive, a few
passes of random scrubbing is the best you can do. As the paper says, "A
good scrubbing with random data will do about as well as can be expected".
This was true in 1996, and is still true now."

Summary: Gutmann's paper is an academic snapshot that was valid for a short
period of time 8 years ago.  While an excellent read, it is no longer
relevant with modern fixed-disk storage.  Wipe once and you've jumped
*extremely* far up the data recovery Bell curve.  Once you're dealing with
near-mythical advesaries who have the capability (budget + skill + desire)
to recover overwritten data, you're better off disappearing the meat instead
of the bits. ;)

Cory Altheide
Senior Network Forensics Specialist
NNSA Information Assurance Response Center (IARC)
altheidec@...doe.gov