> -----Original Message----- > From: Jake Appelbaum [mailto:jacob@xxxxxxxxxxxxx] > Sent: Friday, September 10, 2004 10:42 AM > To: Thomas C. Greene; bugtraq@xxxxxxxxxxxxxxxxx > Subject: Re: New Data Wipe Tools > > Magnetic force microscopy is a threat that is very real for > many people. > > It would be of great help for you to read this paper: > http://www.cs.auckland.ac.nz/~pgut001/pubs/secure_del.html > Yes, and pay special attention to this portion: "Epilogue In the time since this paper was published, some people have treated the 35-pass overwrite technique described in it more as a kind of voodoo incantation to banish evil spirits than the result of a technical analysis of drive encoding techniques. As a result, they advocate applying the voodoo to PRML and EPRML drives even though it will have no more effect than a simple scrubbing with random data. In fact performing the full 35-pass overwrite is pointless for any drive since it targets a blend of scenarios involving all types of (normally-used) encoding technology, which covers everything back to 30+-year-old MFM methods (if you don't understand that statement, re-read the paper). If you're using a drive which uses encoding technology X, you only need to perform the passes specific to X, and you never need to perform all 35 passes. For any modern PRML/EPRML drive, a few passes of random scrubbing is the best you can do. As the paper says, "A good scrubbing with random data will do about as well as can be expected". This was true in 1996, and is still true now." Summary: Gutmann's paper is an academic snapshot that was valid for a short period of time 8 years ago. While an excellent read, it is no longer relevant with modern fixed-disk storage. Wipe once and you've jumped *extremely* far up the data recovery Bell curve. Once you're dealing with near-mythical advesaries who have the capability (budget + skill + desire) to recover overwritten data, you're better off disappearing the meat instead of the bits. ;) Cory Altheide Senior Network Forensics Specialist NNSA Information Assurance Response Center (IARC) altheidec@xxxxxxxxxx
