Re: 'Shredding' a hard disk

2002-06-14 Thread Ivo Wever

Philipp Lehman wrote:

Ivo Wever [EMAIL PROTECTED] wrote:


Some people advise to repeat this procedure several times. Can anyone
explain why? I see no reason why one pass doesn't suffice.


[..] 
http://www.cs.auckland.ac.nz/~pgut001/pubs/secure_del.html


Thanks for the replies and especially this last link. A nice example of 
applied

solid state physics ;)

regards,
--
Ivo Wever
[EMAIL PROTECTED]


--
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]




Re: 'Shredding' a hard disk

2002-06-13 Thread Alvin Oga

hi ya philip

pick the method best for your paranoia level...
( more paranoia.. -- more time/$$$ to securely shred the disks

http://www.Linux-Sec.net/Txt/erase.txt

c ya
alvin

- 100% sure way...
take a hammer... and make itty=bitty pieces of the disks
and than burn it at high temp... melt down disks down to a big
blob...

On Thu, 13 Jun 2002, Philipp Lehman wrote:

 I want to sell an old machine that I don't use any more but there's 
 still sensitive stuff like personal emails, gpg keys, and passwords on 
 the hdd. What's the recommended way to securely 'shred' this data so 
 that it cannot be undeleted by the next owner?
 
 I assume I need to do something like overwriting the whole drive 
 serveral times with random data before finally erasing and reformating 
 the whole drive. Are there any apps out there that do this or do I have 
 to roll my own solution using something like cat /dev/urandom | dd? 
 Any suggestions?
 
 Any pointers and suggestions appreciated.
 


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]



Re: 'Shredding' a hard disk

2002-06-13 Thread Robert Waldner

On Thu, 13 Jun 2002 13:37:04 +0200, Philipp Lehman writes:
I want to sell an old machine that I don't use any more but there's 
still sensitive stuff like personal emails, gpg keys, and passwords on 
the hdd. What's the recommended way to securely 'shred' this data so 
that it cannot be undeleted by the next owner?

Depends.

But, for all practical values, a simple `dd if=dev/urandom bs=1M \
 of=/dev/hdX` should be quite sufficient.

I assume I need to do something like overwriting the whole drive 
serveral times with random data before finally erasing and reformating 
the whole drive. Are there any apps out there that do this or do I have 
to roll my own solution using something like cat /dev/urandom | dd? 
Any suggestions?

Use dd.

cheers,
rw
-- 
/ Ing. Robert Waldner | Security Engineer |  CoreTec IT-Security  \
\   [EMAIL PROTECTED]   | T +43 1 503 72 73 | F +43 1 503 72 73 x99 /



-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]



Re: 'Shredding' a hard disk

2002-06-13 Thread Joris
 I want to sell an old machine that I don't use any more but there's
 still sensitive stuff like personal emails, gpg keys, and passwords on
 the hdd. What's the recommended way to securely 'shred' this data so
 that it cannot be undeleted by the next owner?
 
 I assume I need to do something like overwriting the whole drive
 serveral times with random data before finally erasing and reformating
 the whole drive. Are there any apps out there that do this or do I have
 to roll my own solution using something like cat /dev/urandom | dd?
 Any suggestions?
 
 Any pointers and suggestions appreciated.

# mke2fs -c -c /dev/hda1
will make any undeletion (not involving very expensive recovery hardware)
impossible


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]



Re: 'Shredding' a hard disk

2002-06-13 Thread Colin Watson
On Thu, Jun 13, 2002 at 01:37:04PM +0200, Philipp Lehman wrote:
 I want to sell an old machine that I don't use any more but there's 
 still sensitive stuff like personal emails, gpg keys, and passwords on 
 the hdd. What's the recommended way to securely 'shred' this data so 
 that it cannot be undeleted by the next owner?

If it's only some files, shred(1)?

-- 
Colin Watson  [EMAIL PROTECTED]


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]



Re: 'Shredding' a hard disk

2002-06-13 Thread Ivo Wever

Robert Waldner wrote:

Philipp Lehman writes:
I want to sell an old machine that I don't use any more but there's
still sensitive stuff like personal emails, gpg keys, and passwords on
the hdd. What's the recommended way to securely 'shred' this data so
that it cannot be undeleted by the next owner?

Depends.

But, for all practical values, a simple `dd if=dev/urandom bs=1M \
 of=/dev/hdX` should be quite sufficient.

Some people advise to repeat this procedure several times. Can anyone
explain why? I see no reason why one pass doesn't suffice.

sincerely,

Ivo Wever
[EMAIL PROTECTED]


--
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]




Re: 'Shredding' a hard disk

2002-06-13 Thread Ross Burton
On Thu, 2002-06-13 at 13:54, Ivo Wever wrote:
 But, for all practical values, a simple `dd if=dev/urandom bs=1M \
   of=/dev/hdX` should be quite sufficient.
 Some people advise to repeat this procedure several times. Can anyone
 explain why? I see no reason why one pass doesn't suffice.

Data can be recovered from a disk by looking at the levels of magnetic
charge on the disk.  Data on the disk is binary but of course the actual
charges are not just two levels, but a range of values.  These values
can betray what the original data was, and how long ago it was changed.
I remember reading about a data recovery team that recovered files after
the data had supposedly been removed with a 'dd' command like above.

Ross
-- 
Ross Burton mail: [EMAIL PROTECTED]
   jabber: [EMAIL PROTECTED]
diary: http://advogato.org/person/RossBurton
 PGP Fingerprint: 1A21 F5B0 D8D0 CFE3 81D4 E25A 2D09 E447 D0B4 33DF


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]



Re: 'Shredding' a hard disk

2002-06-13 Thread Colin Watson
On Thu, Jun 13, 2002 at 02:54:44PM +0200, Ivo Wever wrote:
 Robert Waldner wrote:
 But, for all practical values, a simple `dd if=dev/urandom bs=1M \
  of=/dev/hdX` should be quite sufficient.
 
 Some people advise to repeat this procedure several times. Can anyone
 explain why? I see no reason why one pass doesn't suffice.

If you have good enough equipment, it's possible to retrieve even
overwritten data from magnetic disks.

-- 
Colin Watson  [EMAIL PROTECTED]


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]



RE: 'Shredding' a hard disk

2002-06-13 Thread Jan Johansson
 I remember reading about a data recovery team that recovered 
 files after
 the data had supposedly been removed with a 'dd' command like above.

www.ibas.no they claim to be able to see under 3 layers of overwrites. And 
since they are a public contractor.. wonder what the not-so-public people can 
do.


--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]



Re: 'Shredding' a hard disk

2002-06-13 Thread Nicos Gollan
On Thursday 13 June 2002 14:54, Ivo Wever wrote:
 Some people advise to repeat this procedure several times. Can anyone
 explain why? I see no reason why one pass doesn't suffice.

IIRC, this has to do with minor mis-calibrations of the read/write heads 
that may leave tiny traces of the old data readable with highly 
sensitive and expensive equipment. Professional erase tools like the 
one that was part of the PGP suite recommend something like 64 passes 
with different patterns as secure.

-- 
Embedded Linux -- True multitasking!
TWO TOASTS AT THE SAME TIME!


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]



Re: 'Shredding' a hard disk

2002-06-13 Thread Ian D. Stewart

On 2002.06.13 09:16 Jan Johansson wrote:

 I remember reading about a data recovery team that recovered
 files after
 the data had supposedly been removed with a 'dd' command like above.

www.ibas.no they claim to be able to see under 3 layers of overwrites.
And since they are a public contractor.. wonder what the not-so-public
people can do.


When I was in the (US) Navy, a hard drive that contained classified 
data wasn't considered clean until after 7 swipes.



Ian


--
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]




Re: 'Shredding' a hard disk

2002-06-13 Thread Loren Jordan

At 10:38 AM 6/13/2002 -0400, Ian D. Stewart wrote:

On 2002.06.13 09:16 Jan Johansson wrote:

 I remember reading about a data recovery team that recovered
 files after
 the data had supposedly been removed with a 'dd' command like above.
www.ibas.no they claim to be able to see under 3 layers of overwrites.
And since they are a public contractor.. wonder what the not-so-public
people can do.


When I was in the (US) Navy, a hard drive that contained classified data 
wasn't considered clean until after 7 swipes.


There are places that only consider a smoldering pile of slag to be secure 
again... :)





Ian


--
To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a 
subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]


--
Loren Jordan

Network Security Admin
National White Collar Crime Center
Internet Fraud Complaint Center
Phone (304)363-4312 Ext 2011

http://www.nw3c.org
http://www.ifccfbi.gov
mailto:[EMAIL PROTECTED]


--
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]




Re: 'Shredding' a hard disk

2002-06-13 Thread Dave Sherohman
On Thu, Jun 13, 2002 at 12:21:33PM -0400, Loren Jordan wrote:
 At 10:38 AM 6/13/2002 -0400, Ian D. Stewart wrote:
 When I was in the (US) Navy, a hard drive that contained classified data 
 wasn't considered clean until after 7 swipes.
 
 There are places that only consider a smoldering pile of slag to be secure 
 again... :)

Optimists.

-- 
When we reduce our own liberties to stop terrorism, the terrorists
have already won. - reverius

Innocence is no protection when governments go bad. - Tom Swiss


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]