Forensics: Wiping Hard Drives….Do you need thermite?

Every week, or possibly every day, there are new forums where people (with little to no experience of data recovery) discuss the merits of different methods of wiping data and destroying hard drives. One of the the frequent conclusions is that data cannot be deleted or wiped and  thermatie is the only answer.

Some people will discuss, at length, the number of wipes that are required to wipe a hard drive, with answers varying from  7 to 32.  Some insist that once you wipe it 32 times you then need to grind the hard drive to a find powder, and then, of course, use thermite.

These answers, as anybody who actually works in the data recovery industry will attest to are complete rubbish.

Once data has been overwritten i.e. a 0 is converted to a 1, or vice versa, then that data is gone. It cannot be recovered by software, electron microscopes, or men in dark suits.  It is gone.

In addition to this, the moment that the platters of a hard drive are scratched, recovering data from them is very hard, and can be impossible. Hard drive platters are surprisingly sensitive, its just that the hard drive itself is a very good design. Anyone doubting this can perform a simple test, take an old hard drive out of your computer (one with data on, but data you don’t want), open the drive and put a long deep a scratch along the platters. Then, send the drive to a data recover company and see who can recover the data. Most data recovery companies offer a free diagnoses, i.e. you can find out for free if they can recover it.

Or, if you want to use the same service the CIA, MI5, and all the other spooks use, you can pay £100 for a diagnosis and send it to Ontrack, the worlds biggest data recovery company.

KrollOntrack recovered the data from the Shuttle, they are the company that governments use when is a major case, from the  Madrid bombing to old backup tapes that contain critical data.

To wipe data do you need thermite? No. [But that would definately work!]


4 Responses to “Forensics: Wiping Hard Drives….Do you need thermite?”

  1. AB Says:

    I was trying to restore data on a formatted disk and somehow in the process, I got a prompt that it will wipe D partition (I have two partitions, C & D), I accidentally clicked and next when I restarted my computer, partition D shows but there is no data in it. It can’t be accessed also, shows error that the drive is not formatted and when tried formatting it again error says it can’t be formatted. Please help.

    • 585 Says:

      Its sounds like you may have deleted your partition, not formatted, if that’s the case the data is still there, you just can’t access it. If you have started writing data into the D partition , over the actual data, then is may be partially overwritten. Depending on the volmes involved you may have lost some or all of the D drive.

      What tool where you using for this?

  2. MozyMan Says:

    I have argued with other computer technicians about this on a number of occasions. There seems to be a gross misunderstanding as to what it takes to destroy data contained on a Hard drive.

    Hollywood would have us believe anything is recoverable, or men in black suites can somehow resurrect data from a multi-formatted disk. Not true at all… format the disk and 1/0 the entire thing and be done with it… data gone.

  3. Andrew Moriyama Says:

    Thermite offers a certain and rapid means to eliminate all data, a 1 pass wipe takes a substantial amount of time

    and formatting a hard-drive does not render data unrecoverable, formatting and overwriting the drive does.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s

%d bloggers like this: