I understand that various people have claimed they can read erased data. I know of no examples where such evidence has been offered in a public forum. The examples I am aware of where erased data has been used always refer to reading data from the free block list that has not been overwritten. As has been noted in this thread, there may also be data in the bad block list.
There is a difference between picking up a few bytes here and there by analysis with an osciliscope and actually reading a file. If patches of data smaller than those written by the drive head could be reliably read then wouldn't drive makers would be offering much higher drive densities? As for DoD rules for classified data, they may be more concerned with verifiability of data destruction than with anything else. It is possible to confirm by quick visual inspection that a drive has been smashed, while it would require skilled labor to distinguish "rm -r *" from true overwriting. They are also concerned with a situation where a disloyal insider would deliberately allow a drive to be physically exported with data on it. You will recall that despite many claims that audio tapes could be read after erasure, nothing was every retrieved from the famous 18 minute gap in the Watergate affair, other than couting the number of erasures. While parts of the tape were erased multiple times, parts were not. Nothing was recovered from any part, not even some suggestive noise. Extraordinary claims require extraordinary proof. I haven't seen it. If anyone on the list has, could they post a URL? On Mon, 6 May 2002, John C. Orthoefer wrote: > A few things to add. I've never heard of media once it's held > classified data being able to be removed without being physcaly > destoryed. Classified is basicly a one way, unclassified -> Classified. > > But it's worth tossing out there too, you HAVE to do cost-benefit on > whats on the media. Assumeing the data gets out, worst case published > on the front page of the WSJ or what ever, is it going to cause more > than the cost of the disk in damages? If it is/could then you should > just buy a replacement disk and destory the old one. > > If you decide to go with the rewriting method, that those of us who are > apparently "Truely Paranoid" don't put much faith in, you should pay a > recovery company to try and get your data back. See how good your > erasure is/was. And depending on the number of disks you and the > frequenacy you have to do it, you should repeat the process frequently. > > Again this is all going to cost money, there is no way to do what you > ask for the price of $70 PC program. This is why I called them "Snake > Oil" earlier. They basicly do a few passes of random or patterned > writes, and call it good enough. And if that is good enough for you > based on your cost-benefit then you can use the low level verify > commands (atleast on Suns you could, I bet SGI has the same thing.) > > johno > > > --- > Send mail for the `bblisa' mailing list to `[EMAIL PROTECTED]'. > Mail administrative requests to `[EMAIL PROTECTED]'. > > > --- Send mail for the `bblisa' mailing list to `[EMAIL PROTECTED]'. Mail administrative requests to `[EMAIL PROTECTED]'.
