Can you restore data from a deleted file that was previously emptied?

[256bits]

Windows has a full reformat of a drive. It's my understanding that their quick format just cleans out the directory. It takes a long time to do a full reformat a large drive.
The Eraser tool that I referenced above allows you to overwrite the blocks of an individual file many times. And you can make Eraser an option for the files in Windows Explorer.

Does a full reformat write Ctrl-Z's and re-read ( or what ever the operating system uses for null data ) to the entire disk?
Or does it just read and re-write the sector information, and cluster size it.
Some older systems did not re-write the whole disk with full format, and just took samples of sector data to verify good/bad bits/sectors.

 

[sbrothy]

Look at the copyright on the link: 2016. In 2023 journalling file systems and SSD drives are ubiquitous. If you want to destroy (rather than erase) data, destroy the drive. In a fire.

I'm obviously a dinosaur.

Incidentally, I had an extremely disgusting talk with a self-confessed pedophile when I was a moderator on a filesharing network (DC++) a long time ago (I knew which keywords to look for, I never downloaded anything from him.) I soon had the authorities on the phone trying to track him down but he was a slippery customer. They never found him even though I willingly gave them all the data I had. They didn't care one bit about our piracy.

Point is:

He claimed he had a remote controlled magnesium block rigged to burn lying on top of his harddisk-stack.

Talk about a nasty experience. Obviously I don't know if he was telling the truth but he seemed very smug and perversely proud of himself.

I had to take a very long shower afterwards.

 

[FactChecker]

Does a full reformat write Ctrl-Z's and re-read ( or what ever the operating system uses for null data ) to the entire disk?
Or does it just read and re-write the sector information, and cluster size it.
Some older systems did not re-write the whole disk with full format, and just took samples of sector data to verify good/bad bits/sectors.

I'm unsure of the details, but several people (of unknown expertise) say that the full format makes the data unrecoverable. (see e.g. this ). The full format certainly takes a very long time as though something is being written to the entire disk.

 

[Nugatory]

I'm unsure of the details, but several people (of unknown expertise) say that the full format makes the data unrecoverable. (see e.g. this ). The full format certainly takes a very long time as though something is being written to the entire disk.

There’s a difference here between magnetic media and flash. Flash, once physically overwritten, is truly gone. Magnetic media can be overwritten several times but a well-funded attacker (in practice, that means a national intelligence agency) with a scanning electron microscope and possession of the media will still be able to recover much of the old data.

 

[Vanadium 50]

In a fire.

Drill press!

I will make the same comment I have elsewhere - are you trying to keep your little sister out, or major world governments out?

If the latter, I would reply with two statements:
1. You're not that important.
2, Never, ever, ever write anything to the drive that isn't encrypted.

 

[pbuk]

Flash, once physically overwritten, is truly gone.

This is true, but irrelevent. On an SSD, data at the hardware level is controlled by the device: there is no way to control the process in software so you have no way of knowing whether any particular hardware location has been physically overwritten. After dissassembling the device a specialist can access the hardware, however

1. You're not that important.

 

[Nugatory]

This is true, but irrelevent.

Not completely irrelevant, but yes, you need to make some assumptions about the wear-leveling algorithm. I would be somewhat surprised to find that writing the entire block address space many tens of times would leave any data-containing physical block untouched…. But then again in a previous life I found drive firmware doing many strange and wonderful suboptimal things, some of which were unknown and surprising to the drive manufacturers themselves.

 

[TonyStewart]

(in practice, that means a national intelligence agency) with a scanning electron microscope and possession of the
media will still be able to recover much of the old data.

MYTH #1:
This assumption that overwritten data is recoverable is extremely unlikely. Perhaps some bits can be read but not words, sentences or sectors.

The HDD magnetic overwrite specs used to be -20 dB min, it may be less now, but applying Shannon-Hartley's formula for the bit error rate, BER with the Signal/Noise Ratio, SNR and bit shift which I have personally done on HDD's with spectrum analyzers for 1f, 1.5f, 2f etc the old data is well below a reasonable probability of recovering any sectors or even strings of text over-written with RLL code.

However there exist algorithms based on MFM back in the old days for random data over-write several times. There used to be single servo surface control and other surface might have more residue from old data if off track written at a different temperature. Yet for a long time now servo has been dedicated on each track and surface with hard-sector servo dibits between tracks to eliminate the off-track errors from old technology.

 

[Nugatory]

This assumption that overwritten data is recoverable is extremely unlikely. Perhaps some bits can be read but not words, sentences or sectors.

You are considering recovery by imaging the surface of the platter with a scanning electron microscope? I’ve seen SEM images in which the magnetic domains at the edge of the track are clearly visible, and they looked very different when a write changed the value instead of putting down the same value.

But of course this was older drive technology, decade before last. I can believe that writes now leak much less information at the edge of the track.

 

[TonyStewart]

Yes we also had an SEM at Burroughs for magnetic recording experiments and I once qualified suppliers for heads with specs for ATI (adjacent track interference), OW (Overwite) with dB suppression, track and bit resolution specs. it's still a myth.

I made an interesting experiment where I would use the PES position error signal and inject an error from the Y axis output of a scope and then using the X axis ramp on Y Ch1 I could scale any offtrack pattern I wanted like +/-10% then write 1f then repeat with 2f and look for 1f residual on a spectrum analyzer with the output synchronized to the scope which was synchronized to the RPM index pulse of the spindle. So I could get a transfer function of overwrite residual vs offtrack ramp wave or adjacent offtrack interference. Then I could adjust the magnitude and offset of the heads using Ch1 DC and gain. This way I could measure SNR in dB as a function of any disturbance.

 

[Vanadium 50]

Burroughs

Good heavens - they haven't been around in what, 35-40 years?

In those days. weren'y drives powered by steam?

 

[TonyStewart]

Good heavens - they haven't been around in what, 35-40 years?

In those days. weren'y drives powered by steam?

they did consume massive amounts of power in our Winnipeg plant , I had a dozen mainframes, a dozen ATE's , 2 clean rooms and hundreds of products while testing all the OEM's like Maxtor Hitachi, Seagate, Toshiba from the inside out, so I invented new test methods as TE Mgr while my staff wrote procedures and setup all peripheral types in production. We also were Air Canada's biggest customer and I had over $10m in test equipment. and that was only my 3rd career in high tech after Aerospace and Telecom.

 

[Vanadium 50]

On an SSD, data at the hardware level is controlled by the device

HDDs - regular spinning ones - also do it, to a lesser degree. If the firmware think a sector is questionable, it will remap it. The old data is still on the platter, just not visible to the user.

If you don't want people looking at your daat on your drive when you throw it out, mechanically break it first. Not good enough? Then encrypt it when you get it and ensure that unencrypted data never touches it. Still not enough? Seek professional help.

 

[TonyStewart]

A low level format is adequate, a secure format is for those who prefer. A hammer to the lid is effective. They can withstand significant levels of extreme magnetic forces without erasure in the sealed unit.

 

[Vanadium 50]

It's not the time of Burroughs any more, and it is not clear to me what a "low level format utility" does today. They exist, so they surely do something, but it's not like the old days - for instance, they can't change capacity (downward, obviously)

They promise a lot of questionable things - make your drive faster! Make it last longer! So far as I can tell, they will zero-erase the drive's sectors via the firmware. Whether this includes formerly reallocated sectors is unclear.

But let's step back a moment. People often replace drives because they are failing - or have failed. By then, it may be too late to erase things. That's why I argued for encryption before getting this far along.

 

[TonyStewart]

“zero-filling” is essentially the modern-day version of the old process of “low-level formatting” and that you should be completely certain that you’re happy to lose the data on your hard drive forever when you do it.

Windows might have a empty box for [ ] quick-format.
Regardless of the soft format, modern drives use 4k hard sectors with 100 B of ECC then 16 B sector addressing and inter-track servo di-bits.

I only stated multiple pass over-writes was designed for older dedicated servo technology and still available today, but my experience with embedded servo drives today, is that it is overkill.

This has nothing to do with alternative methods of dealing with security.

Multiple pass random data over-writes: Not required

(It's paranoia.)

 

[.Scott]

Here's the advice from the CISA (Cybersecurity and Infrastructure Security Agency).
CISA is part of the US Department of Homeland Security.

If a magnetic drive contains US National Security Information, it requires physical destruction of the magnetic platters before disposal.

 

[Vanadium 50]

it requires physical destruction

Drill press!

 

[sbrothy]

TL;DR Summary: Does erasing the content of a file before deleting it offer any advantages to making the content unrestorable?

Say you have a large text file on your hard drive that you edit such that its content is fully erased and you save it that way. Then you delete the file. Is the content still on the hard drive?

Usually, deleting a file only deletes the address where the file is on the hard drive and the content of the file can be restored as long as nothing is written over it. But in the case of erasing the content before deleting the file, can the content still be retrieved? If so, would it at least make it a little bit harder to find or would the computer overwrite the erased content faster?

I mentioned the linux command "shred" in this thread but was told it's out of date. Depend on the drive type was the point I think.

 

[Rive]

I mentioned the linux command "shred" in this thread but was told it's out of date.

I think you have accidentally linked this very thread

BADBLOCKS in destructive mode will do for old style drives.

 

[sbrothy]

TL;DR Summary: Does erasing the content of a file before deleting it offer any advantages to making the content unrestorable?

Say you have a large text file on your hard drive that you edit such that its content is fully erased and you save it that way. Then you delete the file. Is the content still on the hard drive?

Usually, deleting a file only deletes the address where the file is on the hard drive and the content of the file can be restored as long as nothing is written over it. But in the case of erasing the content before deleting the file, can the content still be retrieved? If so, would it at least make it a little bit harder to find or would the computer overwrite the erased content faster?

I mentioned the linux command "stress in [URLhttps://www.physicsforums.com/threads/can-you-restore-data-from-a-deleted-file-that-was-previously-emptied.1049857/#post-6879067]this thread

I think you have accidentally linked this very thread

BADBLOCKS in destructive mode will do for old style drives.

DUH! :P