0

We all know that if we delete a file, the operating system is recycling it but doesn't actually delete it. It just removes it from the directory indexes, and until the data is needed and overwritten, it will still remain there.

Recently, I have written a program that can wipe a entire hard drive. The program reads existing data on a hard drive, for example:

ab cd 3f 2a 39 3b 9c ab dc ef 9e

It then overwrites the data with NULL bytes:

00 00 00 00 00 00 00 00 00 00 00

It has been tested that my program overrides the file bytes with NULL which effectively purges all the data. So I think it truly deletes everything on the hard drive. But I do not want to make false claims, so I have a few questions:

  1. Can I label my program as "true deletion"?
  2. Can data recovery experts somehow recover the above data even looking at NULL bytes?
  3. If so, how might they accomplish this?
Improve this question
6
  • 5
    what research have you done?
    – marstato
    Commented Jun 17, 2021 at 12:43
  • 1
    We all haven't ever heard of "recycling a file". What you have seems very dependent on the operating system. If I want to erase a hard drive, I use Disk Utility. And my hard drives are always encrypted, and Disk Utility will just erase the encryption keys. Everything is still there, but nobody can ever read it.
    – gnasher729
    Commented Jun 17, 2021 at 14:22
  • 1
    @marstato although the initial wording of the question could give the impression of poor research, in all objectivity, OP has made research on basic deletion mechanisms by OS, and has experimentally tried and tested a strategy which seems to work. In particular OP wants to know that if he/she verifies erasure and reads a NULL byte, if there are not means to read the original data. This suggests that OP has also found out that others write something else than NULL, and demonstrates in any case a high sense for producing reliable software. I therefore vote fore reopen the question.
    – Christophe
    Commented Jun 17, 2021 at 22:49
  • 2
    @DocBrown to OP's defense: when I was young, I really believed that writing once a set of 0 was sufficient to shred drives before throwing them away. I knew that some tools wrote several passes of random data but I thought this was pure marketing and loss of time. It's only later in specialized seminars that I discovered about existence of some advanced recovery techniques i could not have googled for because I never ever heard the terms (remanence was only the most striking one). OP did more than googling: he/she wrote & tested code; Doesn't his/her engineering prudence deserve answers?
    – Christophe
    Commented Jun 17, 2021 at 23:05
  • 1
    @Christophe: when you and me were young., Google did not even exist, and resources for this topic were sparse and much harder to find ;-) My comment above was honest: I wanted to know if the OP had anything done to prevent reinventing the wheel, so it could be used to improve the question (and the fact they ignored me isn't really motivating me to reopen the question). But alas, in the light of your answer and your last edit to the question, I will vote to reopen, either.
    – Doc Brown
    Commented Jun 18, 2021 at 5:03

2 Answers 2

Reset to default
7

You can very difficultly obtain a true irrecoverable deletion of data. This is not related to algorithms but to physical properties of storage media.

You can only hope to reduce the risk (or opportunity) making data recovery improbable. But improbable is not impossible and the difference between the two depends on the means that the potential recoverer has at its disposals and the value of the recovered information.

A concrete example is hard drives: magnetic remanence creates a risk of undesired traces around the magnetic track. Writing random data several times reduces significantly the risk. Writing only 0 is for forensic experts like if you put a blank sheet of paper above printed page: it may be difficult to read, but with the right light you can start to guess the content. Moreover, very powerful people having atomic microscopes and plenty of patient and skilled staff at their disposal could still recover (at disproportionate costs) some data that you could no longer recover with ordinary reading heads ( using microscopic imagery of the surface combined with image analysis, two scientific fields that have made plenty of progress in the last years).

Another example are solid state disks. These usually try to avoid to physically overwrite data. SSD try to reduce reuse of storage elements because they are limited on the number of physical rewrites they can reliably deal with. So drives are designed to perform logical rewrites elsewhere whenever possible, to increase life time. You never really overwrite anything if you just overwrite a single file on an SSD. You can be sure of an overwrite only if you force the SD to reuse all available space, for example by overwriting the full SSD.

This being said, why trying to write such a program when there is already sdelete. and similar products that were designed by experts in this field?

Improve this answer
4
  • I'm told that with modern spinning hard drives you don't need to worry about magnetic remanence anymore. Bits are much, much smaller. And if you worry about security, then surely your drive was encrypted?
    – gnasher729
    Commented Jun 17, 2021 at 14:24
  • @gnasher729 Indeed, before going to the microscope, the change of reading head made remanence more tangible. Spinning drives reach some physical limits here. I do not worry: my personal data is definitively not worth the multi-million dollar of that would cost the experts using advanced image analysis algorithms and computing time to analyse the full surface of my drive at atomic scale guessing on the traces after sdelete. not to say that most of this data will be obsolete once recovered. The risk is rather theoretical. But science advances. What was impossible yesterday may soon be ordinary
    – Christophe
    Commented Jun 17, 2021 at 14:48
  • 1
    @Christophe - you've got the right idea: it's a cost-benefit analysis and for most of us the fast mode of any wipe program is good enough - no need to do the 15-pass DOD certified wipe or much of anything else either! As for me: I always take my old hard drives to an electronics recycling place nearby that has a special punch machine - $5 and they poke a 1" hole through the drive, breaking or tearing everything in it that's breakable and bending everything else that isn't. I don't do it because the data needs that protection. I do it because it is satisfying!
    – davidbak
    Commented Jun 21, 2021 at 23:26
  • 1
    @davidbak Thank you for this feedback. And with „because it is satisfying“, you made my day :-)
    – Christophe
    Commented Jun 22, 2021 at 0:18
3
  1. This is a matter of opinion and/or marketing. In Linux such a program is called a shredder.
  2. Overwriting with random data prior to overwriting with 0s is recommended
  3. Such programs don't usually claim to garantee the data will be 100% unrecoverable, they only claim they make it very hard to recover.
Improve this answer
2
  • This is probably more of a user preference than anything, but why do you need to over write with zeroes after you have overwritten with random data? (Cue Dilbert Random number generator )
    – Peter M
    Commented Jun 21, 2021 at 12:38
  • @PeterM I would imagine they are afraid that changing a bit once may leave a trace of its prior state. If you change it multiple times it would be harder to determine the original state.
    – Martin Maat
    Commented Jun 21, 2021 at 14:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.