On 11/1/06, Steve Hickey <[EMAIL PROTECTED]> wrote:
Sooo... if Magnetic Force Microscopy is not a realistic method for data
recovery, is a single pass of wiping a drive with zero's enough of a
sanitizing process or are there other considerations?
STEVE
Per nist one pass is good enough.
http://csrc.nist.gov/publications/nistpubs/800-88/NISTSP800-88_rev1.pdf
Quoting the paper:
"Advancing technology has created a situation that has altered
previously held best practices regarding magnetic disk type storage
media. Basically the change in track density and the related changes
in the storage medium have created a situation where the acts of
clearing and purging the media have converged. That is, for ATA disk
drives manufactured after 2001 (over 15 GB) clearing by overwriting
the media once is adequate to protect the media from both keyboard and
laboratory attack."
The other issue you may want to consider is if all the blocks/sectors
are actually written to by the wiping software your using.
ie. HPA, DCO, Bad Blocks etc. can all conceivably cause wiping
software to miss a few sectors up to multiple GBs of sectors.
Greg
--
Greg Freemyer
The Norcross Group
Forensics for the 21st Century
