As the OP asked a technical question, which was "I need to permanently erase USB sticks"
Then a technical answer should be given.
The question of can a zero'd drive be recovered is going off topic, but the answer is yes it can be recovered.
A technical answer is not going off topic because it is entirely relevant. That a 'fingerprint' is left is not technical. what do you mean a fingerprint?
if as you say a zero'd drive can be recovered, how might one go about doing it? I'll allow you some latitude here because it is impossible.
A technical answer is not going off topic because it is entirely relevant. That a 'fingerprint' is left is not technical. what do you mean a fingerprint?
if as you say a zero'd drive can be recovered, how might one go about doing it? I'll allow you some latitude here because it is impossible.
I don't think you'd be saying that if you'd read the links I posted last night, or even the quote I posted from the research paper.
I don't know much about the technicalities of these devices but....I've not long fully formatted my LG 4Gb usb drive, done a deep scan after with Recuva (free version) and there is not one item found.
Maybe there is some method out there that could find some thing, but surely for the ordinary user like myself, formatting should be enough.
Also, like all personal stuff, it should be treated as such, even if it fails and needs to be discarded.
I don't know much about the technicalities of these devices but....I've not long fully formatted my LG 4Gb usb drive, done a deep scan after with Recuva (free version) and there is not one item found.
Maybe there is some method out there that could find some thing, but surely for the ordinary user like myself, formatting should be enough.
Also, like all personal stuff, it should be treated as such, even if it fails and needs to be discarded.
Recuva is an un-delete program not an un-format program.
No, you haven't. At least not drives FULL formatted with Windows Vista or later. Such a format writes zeros to the drive.
And it doesn't matter who they are, they aren't recovering any data that's worth anything.
Well I'm happy to be corrected there, I live and learn!
My (woefully out of date) reply was based on a load of WinXP data recovery I got asked to do at work a couple years back. At least it's good to know Vista did one thing right
But anyway the simple test is to send a drive with certain data on it to a recovery company and if they cant recover it then it should pass muster at least unless you are swapping military secrets via them
Whilst it might be theoretically possible to recover data from a formatted disk or USB stick using equipment worth a fortune, in reality it's almost impossible.
For >90% of users, a 'zero write' format of a disk is sufficient. Windows even has the cipher command to multiple-write random data if you wish.
USB sticks are more problematic due to the way they work, but filling the drive with assorted files until it's full should do the trick.
That's a hard drive though, once you've written over FLASH (you have to erase first) then the original data has gone. The only way you could get data back from FLASH is if the overwriting has not been performed in some areas with data.
"This change can be read by special equipment under special conditions"
So special that even Peter Gutmann was unable to adduce any evidence that anyone (security services, FBI, criminals, private companies) had ever actually done it, even on the hard drives that were around in 1996, when he wrote the paper that popularised multiple pass overwrites. And he later wrote this:
"In the time since this paper was published, some people have treated the 35-pass overwrite technique described in it more as a kind of voodoo incantation to banish evil spirits than the result of a technical analysis of drive encoding techniques. As a result, they advocate applying the voodoo to PRML and EPRML drives even though it will have no more effect than a simple scrubbing with random data. In fact performing the full 35-pass overwrite is pointless for any drive since it targets a blend of scenarios involving all types of (normally-used) encoding technology, which covers everything back to 30+-year-old MFM methods (if you don't understand that statement, re-read the paper). If you're using a drive which uses encoding technology X, you only need to perform the passes specific to X, and you never need to perform all 35 passes. For any modern PRML/EPRML drive, a few passes of random scrubbing is the best you can do. As the paper says, "A good scrubbing with random data will do about as well as can be expected". This was true in 1996, and is still true now."
That's a hard drive though, once you've written over FLASH (you have to erase first) then the original data has gone. The only way you could get data back from FLASH is if the overwriting has not been performed in some areas with data.
You may note from my pervious post that it was about a hard disk as it was a reply regarding a hard disk and I did say that it was off topic.
Whilst it might be theoretically possible to recover data from a formatted disk or USB stick using equipment worth a fortune, in reality it's almost impossible.
For >90% of users, a 'zero write' format of a disk is sufficient. Windows even has the cipher command to multiple-write random data if you wish.
USB sticks are more problematic due to the way they work, but filling the drive with assorted files until it's full should do the trick.
I blame too many CSI style dramas...
Sorry, I don't see that much television, but here in the real world there are people who recover data from hard disks and USB sticks everyday, yes most of them are due to legal cases.
Sorry, I don't see that much television, but here in the real world there are people who recover data from hard disks and USB sticks everyday, yes most of them are due to legal cases.
Yes a lot of stuff is recovered, but in general all people will have done is to delete the files or done a quick format. As lobster said you might have known that the files have been recovered but you probably not know how the data was 'destroyed'.
Yes a lot of stuff is recovered, but in general all people will have done is to delete the files or done a quick format. As lobster said you might have known that the files have been recovered but you probably not know how the data was 'destroyed'.
When a computer is recovered by the police, the computer is booted up by using a USB stick which has special software to detect what is on the computer hard disk and if the hard disk has been formatted it will detect the method used to erase the disk, in this case the hard disk will be sent off to have the data recovered.
When a computer is recovered by the police, the computer is booted up by using a USB stick which has special software to detect what is on the computer hard disk and if the hard disk has been formatted it will detect the method used to erase the disk, in this case the hard disk will be sent off to have the data recovered.
there are may other papers on the subject. they all say the same thing.
Theoretical papers are not the same as real life applications.
A theoretical physicist will write a paper, but then someone will have to re-write it from scratch because it is wrong when it comes to a practical application.
Theoretical papers are not the same as real life applications.
A theoretical physicist will write a paper, but then someone will have to re-write it from scratch because it is wrong when it comes to a practical application.
ffs. it's not a theoretical paper. it's an empirical paper. they actually did it and proved the extent to which it was possible.
no company, or organisation anywhere in the world has ever claimed to be able to recover data from a zero'd drive.
peter guttman's suggestion that it was possible was theoretical. you are giving me links to 'wiki answers' and i am giving you links to peer reviewed journal papers.
can you give me any evidence that suggests that all of science is wrong and your hunch is right?
Theoretical papers are not the same as real life applications.
A theoretical physicist will write a paper, but then someone will have to re-write it from scratch because it is wrong when it comes to a practical application.
But you have no evidence of anyone ever recovering HDD data that has been overwritten even once.
So your empirical evidence is worse than ours, and your belief is based on theoretical considerations that in any case applied to older disk encoding technologies than the ones currently in use.
Comments
A technical answer is not going off topic because it is entirely relevant. That a 'fingerprint' is left is not technical. what do you mean a fingerprint?
if as you say a zero'd drive can be recovered, how might one go about doing it? I'll allow you some latitude here because it is impossible.
I don't think you'd be saying that if you'd read the links I posted last night, or even the quote I posted from the research paper.
Maybe there is some method out there that could find some thing, but surely for the ordinary user like myself, formatting should be enough.
Also, like all personal stuff, it should be treated as such, even if it fails and needs to be discarded.
Recuva is an un-delete program not an un-format program.
Well I'm happy to be corrected there, I live and learn!
My (woefully out of date) reply was based on a load of WinXP data recovery I got asked to do at work a couple years back. At least it's good to know Vista did one thing right
It's ok, you're allowed to be wrong, it's not illegal or anything. :rolleyes:
http://wiki.answers.com/Q/Can_data_be_recovered_from_a_zero-filled_hard_disk
We get this topic every few months.
Whilst it might be theoretically possible to recover data from a formatted disk or USB stick using equipment worth a fortune, in reality it's almost impossible.
For >90% of users, a 'zero write' format of a disk is sufficient. Windows even has the cipher command to multiple-write random data if you wish.
USB sticks are more problematic due to the way they work, but filling the drive with assorted files until it's full should do the trick.
I blame too many CSI style dramas...
That's a hard drive though, once you've written over FLASH (you have to erase first) then the original data has gone. The only way you could get data back from FLASH is if the overwriting has not been performed in some areas with data.
"This change can be read by special equipment under special conditions"
So special that even Peter Gutmann was unable to adduce any evidence that anyone (security services, FBI, criminals, private companies) had ever actually done it, even on the hard drives that were around in 1996, when he wrote the paper that popularised multiple pass overwrites. And he later wrote this:
"In the time since this paper was published, some people have treated the 35-pass overwrite technique described in it more as a kind of voodoo incantation to banish evil spirits than the result of a technical analysis of drive encoding techniques. As a result, they advocate applying the voodoo to PRML and EPRML drives even though it will have no more effect than a simple scrubbing with random data. In fact performing the full 35-pass overwrite is pointless for any drive since it targets a blend of scenarios involving all types of (normally-used) encoding technology, which covers everything back to 30+-year-old MFM methods (if you don't understand that statement, re-read the paper). If you're using a drive which uses encoding technology X, you only need to perform the passes specific to X, and you never need to perform all 35 passes. For any modern PRML/EPRML drive, a few passes of random scrubbing is the best you can do. As the paper says, "A good scrubbing with random data will do about as well as can be expected". This was true in 1996, and is still true now."
You may note from my pervious post that it was about a hard disk as it was a reply regarding a hard disk and I did say that it was off topic.
Sorry, I don't see that much television, but here in the real world there are people who recover data from hard disks and USB sticks everyday, yes most of them are due to legal cases.
robertcrowther - your computer services website appears to be broken.
Yes a lot of stuff is recovered, but in general all people will have done is to delete the files or done a quick format. As lobster said you might have known that the files have been recovered but you probably not know how the data was 'destroyed'.
That website is not in use anymore, I just have not removed the link
When a computer is recovered by the police, the computer is booted up by using a USB stick which has special software to detect what is on the computer hard disk and if the hard disk has been formatted it will detect the method used to erase the disk, in this case the hard disk will be sent off to have the data recovered.
If it is always possible to recover data how come the MOD has authorised software for industry to wipe classified discs.
http://news.softpedia.com/news/Data-Wiping-Myth-Put-to-Rest-102376.shtml
well 1) that is referring to a magnetic HDD. 2) it's wrong.
that was the theory proposed by peter guttman. it was just a theory he never did it and i has been shown to be wrong.
wiki answers does not constitute proof.
here is an academic paper on the subject that involves actual research. http://computer-forensics.sans.org/blog/2009/01/15/overwriting-hard-drive-data/
if you read it it shows that the probability of recovering a sequential string of just 32bits 8.75x10^-9
we all know how forensic data recovery works.
but the fact remains that no data can be recovered from a zero'd drive. read the paper http://computer-forensics.sans.org/blog/2009/01/15/overwriting-hard-drive-data/
there are may other papers on the subject. they all say the same thing.
Theoretical papers are not the same as real life applications.
A theoretical physicist will write a paper, but then someone will have to re-write it from scratch because it is wrong when it comes to a practical application.
The MOD physically destroy disks that need to be wiped if they hold highly classified data.
ffs. it's not a theoretical paper. it's an empirical paper. they actually did it and proved the extent to which it was possible.
no company, or organisation anywhere in the world has ever claimed to be able to recover data from a zero'd drive.
peter guttman's suggestion that it was possible was theoretical. you are giving me links to 'wiki answers' and i am giving you links to peer reviewed journal papers.
can you give me any evidence that suggests that all of science is wrong and your hunch is right?
So your empirical evidence is worse than ours, and your belief is based on theoretical considerations that in any case applied to older disk encoding technologies than the ones currently in use.