Real erase

Erased is not always erased
By DI. Nicolas Ehrschwendner

Why it is (almost) impossible to erase a hard disk.

When changing one system for another, more and more companies and private users are confronted with a huge problem: what will happen to the old data media generally containing also data that should not get into the wrong hands. Because whether it concerns the competitor, the own boss or the tax ministry, data in the wrong hands are a nuisance. 

For this reason there are many commercial erase programmes on the market, who do promise no less than the complete and irreversable extinguishment of data on data media. Too often however, the promise is not kept, which is due not so much to the diverse quality of these programmes as to the structure and internal functions of hard disks.

In order to be able to understand why irreversible erasing is practically impossible, one should know how a modern hard disk works. A big problem in erasing data are the faults which emerge while the disk is working. Any physical part of the disk that gets damaged, is being separated, its data being copied to another part.  The fault is being registered in the „grown defect list“, defects which originate from the disk's manufacture, are noted in the „primary defect list“. The system has no influence anymore on these faulted parts of the disk - nor has erasesoftware. The data however are still there physically and they can be read with use of a special procedure.

If one realises that in case of a disk of one Terrabyte the faulty parts can be as big as several hundreds of Megabytes, one can imagine how many data are not erased. Another problem is caused by parts of the disk which are separated and reserved by the operating system, by way of special ATA- or SCSI-commands. Laptop manufacturers like to make use of this feature in order to protect an installation medium for the operating system from the user. In case this part of the disk is not reserved until afterwards, for instance when the user puts a Recovery-CD, the data which have been there may be unreachable for commercial erasesoftware.

A popular misunderstanding holds that repeated overwriting of a hard disk makes its erasure more complete. This counts for decade-old disks who were functioning without overlapping tracks and MFM. In case of modern disks the registration procedure and the registration density have changed so much that one overwriting will do to hinder a reconstruction of data. Programs that overwrite the hard disk more times are not more reliable than those, who do that only once.

The case with the hammer

How one definitely gets rid of hard disk data

Data rescueing reminds a bit like archeology: data rescue experts are trained to save data from obscurity even in the most difficult situation. To them not one single bit is not worth the maximum effort to rescue it. During the recent years data rescue technology has leaped forward considerably (above all as a result of private research by small companies) but this also has a negative consequence: the question how to erase hard disks "for sure", that is irreparable even for a professional. Because nothing is so dangerous as sensible data leaving a company unharmed. They may get into the wrong hands.

Aside from procedures based on software, hard disks may well be definitely destroyed by ... brutal violence. Also in order to illustrate how much physical and mental power is involved in the final killing of the disk, we will dwell on this subject for a while.

First there is corrosion of data media. All magnetic materials do have a specific temperature called „Curie-temperature“, at which elementary magnets start heading again in whatever direction by themselves. That means the end of magnetism in the material and the definite end of any data. Regrettable fact is however that the  „Curie-temperature“ of the common magnetic materials in hard disks rises well over 800°C and that is a temperature never reached in domestic ovens. This means that destroyments of this kind must be organised in special ovens. Apart from that: this heating produces gasses that endangers the environment.

Another sure method to erase data is the demagnetisation of the magnetic surface layer by way of a sufficiently strong magnetic field. Commercial tools which produce such magnetic fields are being offered under the name „degausser“. Longitudinal recorded hard disks should be treated in a different way than those perpendicular recorded. However, there is no guarantee that the degausser will really erase all data. There is a reliable quality control but it can only be carried out by way of special microscopes in a laboratory. After the demagnetisation the data medium cannot be used anymore. 

Now we get to the real heavy stuff: shredding and grinding are also reliable methods to get definitely rid of your data  Because a data sector will not take more than just a few micrometers of surface, larger particles can be in theory read with special microscopes. For this reason only shredding will not do and you ought to grind hard disks in order to reach the optimal result. 

But don't worry: there are plenty of less brutal ways to a reliable data-destroyment.  We will treat these ones in the next chapter. As for the moment, just leave the heavy tools where they are and your old hard disks in a safe place.

Erase? Destroy? Lock up!

How one can keep sensible data on a hard disk only for oneself.

If you erase data from a hard disk and believe that they have really gone, you will probably be also very disappointed every Christmas. Because SantaClaus is just a fairy tale, you know. Same as a definitely erased hard disk. Data rescue experts know all about this. So what to do in order to erase sensible data such as for instance passwords, in a way that they are really not usable any more?

A good method is the locking up of data. When data cannot be erased so easily, then please try at least to avoid that specialists can make use of them: behind a password. This will work only as long as passwords are not known to datasnufflers. Because creativity in this field is far from perfect (far too often a password reads „12345“!) locking up is not a real alternative to data destroyment.

Apart from this, locking up of data has clear disadvantages. If a key gets lost, it will be in most cases impossible to get the own data into reach anymore. Also, commercial lockingprogrammes have this weakness: a local reading defect may result in the fact that the entire disk cannot get unlocked anymore, eg. in case the key is damaged by the defect. Of course this increases the risk of loss of data. Locking up of data also weakens the performance because it involves so much counting operations.

But locking up has also advantages: in case eg. your laptop was stolen, your data will not get into the wrong hands.

If you do not want to lock up, you might reach out for commercial erase-software. But these too do not always do what they have promised to do. Only recently an erase-software product which had won a test in a magazine was put to one more test in the Attingo laboratory. Not one time time this eraser was able to erase for the fully 100 per cent the visible sectors. Just guess what happens in case of those sectors marked as faulty...? These sectors are rarely erased by any software but can still be read by specialists.  Also with regard to reliability, software often brings disappointment. Often ten disks may be erased the right way but the eleventh unexpectedly not. Many erase-programs also do include an almost endless amount of options and parameters who first have to be installed in the correct way. There is no guarantee that in all cases the right type of disk has been rightly installed.

This is why in case of important data, there is only one alternative if one wants to go for sure: first lock up, than erase the disk and then have the erasement checked and verified by a specialist. Or one turns to heavy tools and erases the disk, demagnetisises it, heats it and throws it into the shredder. That should be the end of it...

The author, DI. Nicolas Ehrschwendner, is the founder and manager of Attingo Data Rescue in Vienna and a specialist in datasecurity and datareconstruction.
Information: www.attingo.com