Data Mining Used Hard Drives 695
linuxwrangler writes "One hopes the /. crowd knows the perils of discarding storage with sensitive data but this article drives home the point. Two MIT grad students bought used drives from eBay and secondhand computer stores. Among the data found on the 158 drives were 5,000 credit-card numbers, porn, love-letters and medical information."
Guess those pop up ads were right (Score:5, Funny)
Re:Guess those pop up ads were right (Score:5, Funny)
You don't really want none of this... (Score:5, Funny)
DPA (Score:5, Informative)
Re:DPA (Score:3, Funny)
Re:DPA (Score:5, Funny)
Actually, I find extensive use of sandpaper after attaching the disk to a high speed drill works wonders.
Barring that, an old fashioned bulk tape eraser also has interesting effects.
I'm thinking of other options, including battery acid, and use as a grounding rod for a Tesla Coil.
Re:DPA (Score:5, Informative)
Nope. A magnetic field that would be strong enough to erase a hard drive would probably also compress it into a lump of twisted metal. from http://www.usenix.org/publications/library/proceed ings/sec96/full_papers/gutmann/ [usenix.org]:
The only way to be really sure is to use an acetylene torch.Re:DPA (Score:5, Interesting)
This guy wrote about my g/f's mom about how he was banging her for the last 15 years. She had only been widowed for 10 years. He also complained about how she only came around when she needed money and how he was tired of banging her wrinkly ass.
Also, this guy was a principal at an elementary school. He was apparently fucking several women at the school, even getting blowjobs at work!
I was simply amazed. My g/f didn't even really know that this guy was dating her mom (some women are so stupid). She just thought he was a family friend. I couldn't tell her about what I found because I knew she would have been really upset.
I learned from that day on that simply deleting a file was not going to hide anything. I'm actually holding onto a defective laptop thathas been broken for months. I don't want to toss it out until I can either recover the harddrive data myself or until I can safely dispose of the harddrive.
Similar story (Score:5, Funny)
When I was 14 or 15 (long ago), I took a trip with my friend to visit his father and step mother for the day. We would have to help his father in his print shop for the day, but my friend promised in return we would be able to sneak access to his dads porn collection.
After we ended up working in his dads shop all day, we had dinner, went to his dads house, and his dad left us alone with his computers to play games on. We had brought a palette of 100 disks to hopefully sneak our porn home on, so we began copying all those pcx and gif files onto disks as fast as we could. We couldn't risk looking at them for fear of being caught. It wasn't that unusual to have a huge pile of disks because that was how things got copied in the olden days, his dad thought we were copying some of his games.
Low and behold, we fill all 100 disks with porn (an incredible stash in like 90 or 91). We go home for the evening to each of our houses, divide up the stash, and we both head straight to the computer to um, count our booty.
I get home, pop the first disk into the computer, and just about then I get a phone call -- its my friend, he says "dude, don't look at the pics, trust me." But he's piqued my interest so I have to. I load one up and what do I see? A big juicy cock. We had copied his dads gay porn stash.
Luckily for me, my Ebay'd hard drives are safe (Score:5, Funny)
Re:Luckily for me, my Ebay'd hard drives are safe (Score:3, Insightful)
Re:Luckily for me, my Ebay'd hard drives are safe (Score:3, Funny)
I do attempt to smear blood on the drives, though.
And I may have once ejaculated on a platter, but I was young and I needed the money.
Re:Luckily for me, my Ebay'd hard drives are safe (Score:5, Insightful)
Well, in that case, first they'll read your DNA, have uncontestable proof you (or your identical twin) had had possesion of them, and then they'll read your data.
Re:Luckily for me, my Ebay'd hard drives are safe (Score:4, Interesting)
Re:Luckily for me, my Ebay'd hard drives are safe (Score:5, Informative)
Re:Luckily for me, my Ebay'd hard drives are safe (Score:5, Funny)
That's why it's the DoD way for me: scramble the data with many passes accross the media with a stong magnet, followed by hammer strikes until it's in small pieces.
You may find this lowers its value slightly in the "Computers & Office Products" category, while raising it dramatically in the "Art - Sculpture, Carvings" category (as glue as needed).
-RB
Re:Luckily for me, my Ebay'd hard drives are safe (Score:3, Interesting)
Random Bit Overwrite (Score:5, Interesting)
German DoD Spec: 7 passes
(from http://www.ontrack.com/library/dataeraser.pdf)
-- R
Re:Random Bit Overwrite (Score:3)
Re:Random Bit Overwrite (Score:5, Informative)
Can anyone tell my why there has to be numerous random-bit passes when one could do something like this:
dd if=/dev/zero of=/dev/hda bs=512
What's wrong with just zeroing out the drive once?
Say the child porn file has a one bit and a zero bit. You overwrite it with two zero bits. The magnetic domains where the one bit was are presumably weaker or smaller because they were flipped, not reinforced like the zero bit domains. Of course the drive's read head itself won't be useful for extracting this information, because it's only designed to determine the last bit written by the write head- a binary zero/one determination. But with special equipment you can measure domain strengths carefully, and pull more information than a single bit out of them. You can tell which domains were flipped by the zero-out process and which were reinforced. (Of course this is a simplification because each bit is composed of multiple domains.)
So there are a few trivially obvious considerations when writing an erasing program-
-Don't write zeroes, write ones and zeroes.
-Go in more than one pass. A single pass leaves the bits in 4 possible states- (0,0), (0,1), (1,0), and (1,1) (where (c,r) are the child-porn and random-overwrite bits, respectively). An attacker can in theory tell all four states apart by close physical examination, so he knows c. Two passes (c,r1,r2) leaves 8 possible states- (0,0,0), (0,0,1), (0,1,0), (0,1,1), (1,0,0), (1,0,1), (1,1,0), and (1,1,1). Now the attacker's equipment needs more than twice as much precision, because some of them, like (0,0,1) and (1,0,1), are starting to look physically similar. 10 passes leaves 1024 possible domain states, many of which are indistinguishable.
-Writing zeroes over the file ten times is much better than writing zeroes over it once, but still leaves it in one of only four possible states. (Which are admittedly harder to tell apart, but you never know.)
-Do not allow the content of the file you're erasing to influence your decision of what bits to overwrite it with. You avoid a whole class of problems this way.
-Be aware that when you are writing random numbers, you are actually encrypting, not erasing, the file. The seed you used for your random number generator becomes a key for decrypting the file (given special equipment).
-You want to prevent the attacker from knowing what bits you wrote and in what order you wrote them. You will favor erasure over encryption if you can continually introduce entropy into the process. But entropy is scarce in most software environments. The variations in the timings of the drive's mechanical movements, ping responses from remote servers, mouse movements, and keypresses are well-known sources.
-Don't use a lousy random number generator. There are many ways for a random number generator to be bad. The simplest type produces numbers where n-tuples fall on a regular lattice when plotted in n dimensions. Generators like that are used a lot in scientific and graphics applications, but have no business being in security applications. If an attacker gains access to a few of the numbers in the generator's sequence, he can predict the rest of the sequence. They also loop after generating 2^N numbers.
-If applying this process to a single file, hide the size of the file.
-Ideally you should hide all traces of the file's existence. This means clean up after yourself by writing zeroes in the last several passes, so that even the domain randomness is physically removed (its presence implies that something was erased).
That Rarely Works Any More (Score:3, Informative)
Re:That Rarely Works Any More (Score:4, Interesting)
If you have a HD that has sectors that go bad, many HDs (or operating systems) will mark the block as bad and off-limits so it doesn't get used any more.
This of course poses a problem with most "erase" type programs, as there may not be a way that the eraser can override either the operating system "bad block" mark, or the drive's "bad block" internal mapping.
If something critical happens to be in a block marked bad on the HD, there may not be any way to securely erase it 100% via software and you'd need to destroy it physically.
Re:That Rarely Works Any More (Score:3)
MIT Grad students (Score:5, Funny)
Don't I feel inferior. I've done the same with used HD's in the past and I only have a HS edumacation.
Re:MIT Grad students (Score:5, Funny)
HD Abuse (Score:3, Funny)
Take them outside, and throw them as high into the air as possible. Then watch them land on concrete.
I think that render the drive useless. =)
Re:HD Abuse (Score:5, Interesting)
Re:HD Abuse (Score:3, Funny)
My guess would be a glass or ceramic. The first time I opened up a hard drive I assummed the platters were metal because of their reflectivity. After trying to bend one of them and having it shatter into a million pieces in my face, I discovered that they are not.
Re:HD Abuse (Score:3, Funny)
Data worth more than the computer (Score:5, Interesting)
Some computers sold on eBay are sold for the data [ebay.com].
Gary Glitter (Score:3, Funny)
I can relate (Score:5, Interesting)
Your old HD is safe. (Score:5, Funny)
Re:Your old HD is safe. (Score:3, Interesting)
On the third disk I noticed a file named "Moms Credit Card". We can all guess what the file contained.
Fortunately for that poor student, I'm a nice guy and I wiped the disk so that the information wouldn't be abused. However, the next disk contained Frat Party planning meeting minutes that were quite entertaining. (Someone was violating campus alcohol rules.)
Anyway, I stopped looking after the 5th disk, and there were over 500 lost disks in that lab. All of the disks were found withing the last 4 months. If you want to get dirt to use on people, visit a college lab, shuffle through the lost disks, hold onto the information for a few years and then see how much that lost disk is worth to them.
Not so bad. (Score:5, Interesting)
I should really do the honost thing and reformat it but its always fun to flip the thing on and just page through stuff.
Re:Not so bad. (Score:3, Interesting)
and if there is a class action suit, then be
a witness.
Re:Not so bad. (Score:4, Informative)
Also that same year, the school councilor retired his trusty quadra 610(?) and he had all the psychological, academic, and disciplinary records on there from 1993 and up on there. No password. No encryption. No attempts to even get rid of data.
A few months back, my brother picked up an old computer for $8 at a garage sale. He wanted me to fix it up for him and get it to do something. I was in for a nasty suprise when I found about 200 MB of gay pr0n jpegs on there.
When I was taking my A+ class at my HS, we were given some old computers from the county office of education to get in working order to give to people who couldn't afford computers. There was a small text file on it that contained passwords for most of the servers in the COE.
You can get quite a bit without even recovering files. People are idiots.
Re:Not so bad. (Score:3, Informative)
PGP! (Score:5, Informative)
That said, experts would tell you that the only reliable way to make sure sensitive data doesn't get out is to thermite your drive.
Also, what's the one-line unix command (running MacOS X here).
Re:PGP! (Score:5, Informative)
Ah, the joys of *nix.
Re:PGP! (Score:3, Informative)
Re:PGP! (Score:3, Interesting)
Roughly speaking that'll do it. I'm sure there's nice trickery you can do to, say, get the equivalent of
Re:PGP! (Score:3, Informative)
PGP (for windows or mac, ie not GPG) has two commands related to this: wipe file and wipe free space.
And for those wishing for only mid-grade free space wiping, check out "cipher" which comes with Win XP and Win2K SP3. 'cipher /w:c:' will wipe all the free space on c: with 0s, then with 1s, then with random data.
I have mine cron'ned - er, "Task Scheduled" - to run several times a week, just to keep things on the sanitary side. You never know when the layoffs will leave you wondering who is looking at your old hard drive.
Wiping and physics (Score:3, Informative)
If you wipe, remember to take your device's physics into account.
Wipe it once when it is completely "cold" (computer has been turned off for at least several hours), then wipe it again after it has been running for an hour or so, and wipe it a third time after you've giving the disk some serious thrashing (that is, disk activity that moves the head around quite a bit).
The reason is temperature. Data is saved on circles on a magnetic medium. The read/write head has a certain amount of thickness, and so have the tracks on the platter (the tracks have to be a bit widther than the head is, to take thermal expansion into account so the head won't overwrite data on neighbour tracks).
So, for some specialized data recovery company, it may even be possible to recover different data from the same track, because after a while of use, a track can look like this:
---------------- Outer track end
AAAAAAAAAAAAAAAA Older data 1
BBBBBBBBBBBBBBBB
BBBBBBBBBBBBBBBB Actual data
BBBBBBBBBBBBBBBB
CCCCCCCCCCCCCCCC Older data 2
---------------- Inner track end
So, your drive will always read the data in 'B'. In 'C' there might still be data your computer saved when the drive had just spun up and was cold, while 'A' might still hold a copy of data that was written on very heavy disk activity when the drive was really hot.
To overwrite all of this data, you need to have the drive write in any of the temperature states that it has been in within this life.
"Simple" writing might only destroy all 'B' data and leave all 'A' and 'C' data intact on the drive, where they can be recovered.
multiple writes (Score:3, Interesting)
There doesn't seem to be much point in overwriting more than once with the same zero pattern (the article makes this mistake too, though the original authors probably don't). There are really two levels of sophistication we're hoping to elude here:
a) People using the drive's own interface to retrieve "deleted" datab) People doing direct signal analysis of the magnetic media to find successive generations of overwritten data
Once you've overwritten the disk once (whether with dd, a real SCSI low-level format, or some other means), you're in regime (b). Assuming you're paranoid and/or justifiably concerned enough to bother with repeated writes, using the same bit pattern does little - and zeroing is especially non-optimal, from what I've read. Random bit patterns seem a likely candidate, but randomness is actually particularly easy to divine in a signal.
People have experimented with instead writing various repetitions of constant strings with good success, but what might be ideal is a chaotic pattern that approximates the look of the expected data without divulging anything real (interesting thought - perhaps this is what some of the porn they found was for!). Write that a few times and you have a honeypot that might mislead a naive investigator into thinking there's nothing more to be found - but even this is difficult because the "freshness" of the bit patterns can be determined by their relative signal strength, and you can't simulate age using the default write current no matter how many new patterns you lay on. You can only hope you've made the old, real data so faint that it disappears into the background noise. Since there's no real way to guarantee this, people with real secrets to hide have to physically destroy the media. So much for reduce, reuse, recycle. ;)
The technique of extracting the data is akin to the work of deep-sky astronomers, military listening posts, or even sedimentary archaeology. It's quite an interesting problem, as is making the data unrecognisable. The parallel with copy-protection is obvious, and the outcome is the same - an escalating war of technique between intrigued hackers, where the party acting later in time (the deprotector / signal analyst) always has an advantage.
As an aside, when using dd to copy large amounts of data to disk you can often speed things up immensely by tailoring the (output) block size to the destination device.
On par for Ebay.. (Score:3, Interesting)
Everyone knows that HD's contain data.. I would be more impressed if they broke down the numbers of where the BAD drives came from. That would make a much more informative story. I've bought as-is before in person but never online.
Old news or not... (Score:5, Funny)
I tried to explain the concept to her, but for an IT manager, she was woefully bad at technology.
Actually, come to think of it, she was about average...
Above average. (Score:3, Funny)
start an extortion & blackmail company.. (Score:5, Funny)
icanstilltellyourwifebill.com [icanstillt...febill.com]
he brought a hard drive, found all this cool stuff on it.. & put it to DVD for the masses
Re:start an extortion & blackmail company.. (Score:3, Informative)
*sigh*
From the terms of use page [icanstillt...febill.com] on this site:
"Please note, the content of this interactive movie, including characters and any and all elements, hereof, is entirely fictional, and is not based upon any actual individual or of any other legal entity"
grib.
Comment removed (Score:4, Interesting)
Re:You don't need any external software! (Score:4, Informative)
This isn't exactly news... (Score:5, Insightful)
Personally, I have a standing policy in my department to take apart every HDD, take a magnet to each platter, and send the platters to Iron Mountain for destruction. Then again, we deal with large financial institutions, so we have to be extreme and obsessive-compulsive, which brings me to my actual point;
This stuff should be regulated. If you store personal info on an HDD for business purposes, you should have a legal responsibility (i.e. one that comes with repricussions if not met) to ensure that even after a drive is retired, the data is safe.
Just my $.02
Shouldn't the title be... (Score:3, Interesting)
CIA (Score:5, Informative)
In regards to Wiping data, do yourself a favor and check out http://www.heidi.ie/eraser/
Beyond the wonderfull wiping the program does, there is the option to make an emergency boot floppy that wipes the HD with DOD style 7-pass or a GutherSomething 36 pass! Niffty for the paranoid.
we destroyed our harddrives right (Score:3, Funny)
btw, has anyone seen my old ti calculator? it was on the 21st floor of two.
Re:we destroyed our harddrives right (Score:4, Funny)
I sledge them! (Score:3, Interesting)
However, I *always* remove the hard disk drive, disassemble it, and give it the sledge hammer treatment. I just don't have the time to get them running again, and write the erase patterns to every track and sector.
Maybe if there's ever a good, transparent, drive-level PGP available, I'll rethink this strategy, but until then, I put on the safety glasses and hammer away, after opening the drive case to expose the platters.
Here's a sugesstion to drive manufacturers--make a convention where if certain pins on the IDE connector are jumpered together, and the drive powered up, it will do a low-level format automatically. Then I might choose to erase the disks, so long as I didn't have to hook them up to a computer and run a program.
Re:I sledge them! (Score:4, Interesting)
Re:I sledge them! (Score:3, Informative)
This is why I always mark my used drives... (Score:3, Funny)
I just shoot mine. (Score:5, Funny)
They're great target practice when set up at 50 yards. Plus, they're rendered more or less ultra-highly unreadable, with half the platters coated in vaporized lead spall, and then with the platters dramatically warped, penetrated, stretched and shattered. Many areas are complete and totally lost, the ones that arent, would require precise magnetic microscopy to observe the actual state.
These pictures [squeep.com] were of a seagate 40mb eide, splashed with a 158grn jacketed hollowpoint in
Shoot a drive while it is spinning? (Score:3, Interesting)
Should produce some interesting results. It'd be interesting to see the different effect from hitting dead center on the hub as compared to (on a different, identical drive) the outermost rim.
It's not just hard drives (Score:5, Interesting)
No database code or data, just typical home directories and stuff. And they were running SCO, but boot blocks and stuff don't generally get written to tapes, so no chance of warezzing from it.
I also snag SCSI hard drives and SyQuest cartridges when they show up for five bucks or less at thrift stores, since most of that is Mac stuff and I'm a Mac-head.
Once I got a 6100 at a thrift store. I presume the owner stopped using it when the PRAM battery died. (When a 6100's PRAM battery dies, the video settings go with it, and unless you're using a fixed-frequency monitor, you get no video unless you hold down command-option-P-R. Looks like real bad a hardware problem when it's just the battery.) I could tell it was used by some college guy, studying to be a lawyer, I think.
"Thrift store hard drives are like a box of chocolates... you never know what you'll find!"
this is also a problem for warranty. (Score:5, Interesting)
Re:this is also a problem for warranty. (Score:3, Informative)
This is a big problem for DoD-type datacenters; for non-classified (as in "this stuff shouldn't get out") stuff, they open the disk up, sand-blast the platters to remove the magnetic material, then return the carcass to the manufacturer for a warranty claim. For the really secret stuff (as in "people will die if this stuff gets out"), they just destroy the disk completely, then buy a new drive.
Of course, if you kept all the data on the disk encrypted, you'd be fairly safe, but once you're making a warranty claim, the disk probably isn't working well enough for you to wipe using 'dd'...
Speaking of 'dd': Beware of sector remapping. Any sectors on the disk which the firmware has marked 'bad' won't be touched by any user-level command - and those 'bad' sectors could still be recovered if they open the disk up. For most people, 'leaking' a couple of sectors wouldn't be the end of the world, but for (say) VISA's customer records, there are probably a couple of valid CC numbers and other info in those sectors...
Scary Thought (Score:3, Interesting)
a few minutes with tomsrtbt (Score:5, Informative)
- Get out your favorite Linux installer CD or download a copy of Tom's RTBT [toms.net] and write it to floppy or CD-R.
- Boot from the floppy or CD.
- Log in as root.
- Run dd if=/dev/zero of=/dev/hda to erase the master drive on the primary IDE controller (/dev/hdb etc. for the remaining disks)
That's all. It erases all the blocks normally accessible by the disk controller and is probably safe enough for most people. Bad blocks that have been replaced may still contain a little bit of data, and inter-track data may be recoverable by analog means.This does not surprise me at all. (Score:3, Interesting)
I run a computer shop in the southeastern United States, much of my work involves the local school systems.
Several years ago (Long before 9-11) a local school received a donation of several pallets of computers, monitors, printers, and other equipment from a local military installation. The donation was properly processed through the Defense Reutilization and Marketing Service (DRMS) and should have been cleared of any sensitive materiel.
I was contracted by the school to take the entire load and build as many working systems as I could out of the parts. As I begin to put systems together and power them up I was staggered by the fact that at least half of the hard drives were FULLY intact and no attempt at all had been made to remove sensitive data.
I of course had to take a closer look. Much of the data concerned simple day to day non-sensitive routine base operations (I am x-military so much of it was familiar to me). HOWEVER on one of the intact drives I found something that KNOCKED MY SOCKS OFF! Setting there on that hard drive spinning on my work bench was pile of data concerning the moving of NUCLEAR weapons and other nuclear materials and conventional weapons around the United States. The data contained information such as routes, schedules, manifests, and duty rosters. I WAS DUMBSTRUCK. How could this have happened? This drive should never have left a controlled area, EVER, it should have been destroyed. This was inexcusable!
Of course in a situation such as this all manner of thoughts go though your head. Thoughts such as; What kind of damage could a enemy of the U.S. do with this data. What would this data be worth to someone unethically inclined. If they knew I saw this data they would probably lock me up and throw away the key just for good measure, and of course WHAT SHOULD I DO WITH THIS DATA?
In the end I destroyed the hard drive and the data it contained and kept my mouth shut. That has been at least 8 or 9 years ago and until this day I have never told anyone and thank God that due to the passage of time I have forgotten most of the particulars of the data I saw.
shred(1) will securely delete files (Score:5, Informative)
http://btr0xw.rz.uni-bayreuth.de/cgi-bin/manpag
See also http://www.cs.auckland.ac.nz/~pgut001/pubs/secure
Re:shred(1) will securely delete files (Score:5, Informative)
$ man shred
[snip]
CAUTION: Note that shred relies on a very important assumption: that the filesystem overwrites data in place. This is the traditional way to do things, but many modern filesystem designs do not satisfy this assumption. The following are examples of filesystems on which shred is not effective:
* log-structured or journaled filesystems, such as those supplied with AIX and Solaris (and JFS, ReiserFS, XFS, Ext3, etc.)
[snip]
FYI: HOWTO: Secure HD for Donation or Disposal. (Score:5, Funny)
Re-format HD using the NTFS file system if the drive is larger than 2 GB, otherwise install NT Server from the earliest available service pack.
Install Windows NT 4 Server, apply service patch 6. Make sure you use a meaningless administrator password.
Upgrade MS Internet Information Server to version 4.0 from NT Option Pack. Create a default web site using the following as the index page (*.htm, *.html, *.shtml):
Why are Chinese, Dutch, German, and Russian Hackers So Homosexual?"
Chinese, hackers, IIS rules, Counterstrike, Dutch, mothers, US ALL THE WAY, Germany sucks, script kiddie, porn, pr0n, disable X10 ads, warez, firewall, Bill Clinton, rar, zip, romz, roms, direct downloads, Long Live Pakistan, How do I secure III?, index of, Ronald Reagan Library
Boot the HD in a computer with an internet connection.
Wait about four days.
Repeat the process three times.
Reformat the drive.
Donate/Discard.
Hey, at least it won't have -YOUR- important data on it.
-dameron
What about RAM? (Score:3, Interesting)
When they moved some of these labs all of the equipment was shrinkwrapped and escorted to the new location to prevent tampering while in transit.
I think I had something to say. Oh yeah. Ok, when hard drives and backup tapes got old they had to format them X number of times (I forgot the exact number), then physically smash them and then burn the remains. All in a secure manner (ie: not taking them to the local Springfile Tire Fire).
Anywho, a friend of mine had to replace RAM from one of their Suns, and I went with him. They let us leave with the RAM and didn't think twice about it. 2 or 3 minutes after we left my friend realized he may be able to take the RAM and actually read the data off of it somehow, assuming it was still saved.
Perhaps this could be applied to other things including external processor caches and VRAM as well.
The proper way (Score:3, Funny)
Everyone knows you must write zeros over old drives 137 times, then bulk erase them then dip them in acid, smash them to teeny tiny bits, incorporate those bits into construction concrete for buildings on three separate continents and only then your data will be safely gone.
Though there is this one data recovery firm in Wisconsin that can get data off the drive even after all that...
Use encryption such as Linux Crypto API (Score:3, Insightful)
This is NOT Data Mining! (Score:5, Informative)
GNU shred is your friend (Score:3, Informative)
Enter GNU shred. Its default operation does 25 passes at the drive, with passes such as random data, random patterns and all zeros. Theoretically, the drive has been overwritten so many times that there is almost no chance of recovering data.
Of course, just to play it safe I'll also run it across my stereo speakers a few times too
This is not data mining (Score:3, Insightful)
At best, this is voyeurism. At worst, it's espionage.
Interesting reaction on hard drive wiping (Score:4, Interesting)
Being the IT director, I helped the owner, my friend, with the office computers. I planned on wiping all the hard drives and I informed the owner of my plan. He agreed that it was a good idea.
From the next three months, watching the bankruptcy process unfold, I got questioned left and right as to why I wiped the data. The accountants wanted to know why...the lawyers wanted to know why...the liquidators wanted to know why...the court wanted to know why. I understand that a system with an installed OS is more valuable than one that has been wiped clean(the data had been backed up so there was no question of whether data had been destroyed) but this should not be unusual. Nobody asking me these questions were newbies--their jobs involved dealing with bankrupt companies and it was as if they had never seen this before!
Simson Garfinkel (Score:3, Interesting)
How do I destroy an HD? (Score:4, Funny)
I built a time capsule! (Score:3, Funny)
So I went down into the basement and pulled out all the old computer crap I could find -- old hard disk drives, AOL CD's, ISA boards of various types, etc. and just threw them into the cement mix until the level rose to where I wanted the wall to be.
Perhaps someday after I die (or move) someone will dismantle that wall. When they do, they'll unearth some hard disk drives, complete with a 1997 or 1998 vintage of Red Hat Linux and other software of the time.
Book and Nuke (Score:3, Interesting)
Burn the ISO, boot to the CD, then wait a *really* fucking long time for it to scamblefuck the drive. (You can also use a floppy disk...but nowawayd why use something that a magnet could possibly fuck?)
(I have no idea whether or not this is military-grade. Can anyone comment? And if not, provide something *better*?)
Here's a question: (Score:4, Interesting)
Some sort of explosive device on a trigger next to your mouse?
A shotgun blast? (Hoping you hit the drives and don't get shot...)
Fast acting fantasy software to write random data 144 times over the disk in mere milliseconds?
Re:Here's a question: (Score:3)
I suppose what remains of those filesystems will be subject to cryptanalyis but it should be a bit more difficult at least. The only other option would be coming up with something to physically destroy the hard drive in a hurry that won't physically destroy the operator as well.
I like the idea of digging a fire pit in the basement and having the system rigged to be burned by a panic trigger. The shotgun would work too but it needs to be permanently mounted on the machine. You won't have time to aim. You'll be lucky if you have time to reach over and pull the trigger.
In all though, if the MIBs bust your door down you have much larger problems than what they are going to find on your computer.
I guess you really SHOULDN'T sell anything on eBay (Score:3, Funny)
It could be some smart ass college kid who is going to get your old porn collection you thought was lost.
A story of DISK, SRAM and DRAM data recovery (Score:5, Interesting)
First, a little background:
Regarding disk recovery:
Regarding SRAM recovery:
Regarding DRAM recovery:
Based in part on the recovered data, we concluded that candidate A was declared the winner due to a ''mistake'' in mapping ballot slot numbers to candidates. In some cases the slots for candidate A and B were reversed.
An incorrect vote count was reported by the election officials. It is our guess that when we came around asking for the raw data, someone began to collect it. At some point some official(s) discovered the blunder. The system was left on while they stalled for time. When it was clear that we were going to force them to turn over the data someone wiped the system and shut it down.
BTW: The majority of the election officials involved were supporters of candidate B. Even though their blunder caused them to declare candidate A the winner, they still tried to coverup their mistake.
Our conclusion was that the attempt to coverup the mistake was motivated by not wanting to admit the major blunder instead of because of candidate A's influence. This conclusion was reached in part because of messages that we recovered on another system that was not wiped. However we would have never been able to find that other system, nor would we have been able to match the raw slot numbers with the reported vote counts by candidate name without the help of the data recovery consultant and the critical data that they recovered.
I'll offer a few observations:
P.S. I know that some people doubt [slashdot.org] that one can obtain old data from SRAM and DRAM after poweroff. I did too until it was done for our group. To those who still doubt this: I will refer you to Peter Gutmann's paper on Secure Deletion of Data from Magnetic and Solid-State Memory [auckland.ac.nz] for another source on data recovery methods.
Secure Harddisk Eraser (boot floppy, GPL) (Score:3, Informative)
Secure Harddisk Eraser implements these 35 or 3 passes on a single floppy. Just boot from the floppy, wait 60 seconds and the harddisk will start to erase.
The homepage [linux-kurser.dk]
Re:How many credit cards per hard disk??? (Score:5, Funny)
RTFA (Score:4, Insightful)
Re:just shoot the drive (Score:5, Informative)
Becuase these, at least for the most part weren't personal drives, but drives companies had thrown away.
From the article:
"As it turned out, most of the hard drives acquired by the MIT students came from businesses that apparently had a misplaced confidence in their ability to "sanitize" old drives."
Scary.
Re:yes (Score:3, Interesting)
Re:yes (Score:4, Interesting)
Your wayback machine is broken (Score:5, Funny)
50 MB? Try 5 MB.
SCSI? Not in production.
Sun? Sure...
Linux? Try CP/M.
hexedit? Try debug.
Asian Students? First wave Vietnamese refugees, maybe.
E-mails? If you were working on ARPA.
Porn? Maybe PG rated adventure games...
Tax dollars at work? In 1979, we had to walk
10 miles up hill (both ways) to pay our taxes, and they only accepted krugerrands and virgins without
herpes, both of which were in even shorter supply
and higher demand than they are now.
Re:Oh, man. Hear it comes. (Score:5, Informative)
Re:Oh, man. Hear it comes. (Score:3, Interesting)
Tim
Re:Oh, man. Hear it comes. (Score:5, Informative)
Re:Oh, man. Hear it comes. (Score:4, Interesting)
I have one, honest to god..
It literally removes the magnetic code/signatures from the HDD. I used to work at a data recovery shop (yes one with static room where we physically remove the data etc...) and even we couldn't recover anything off a HDD that has been passed through one...
The only bummer is they draw lots of amperage on a 220... (meaning they literally dim the lights even on my very well powered home...)
The NSA/DOD/Whatever probably uses these when they erase a HDD for redistro/etc...
Re:DOD has specific guidelines that define Overkil (Score:3, Funny)
Re:yeah right (Score:3, Funny)
If it's good enough for Doogie Howser, it's good enough for me.