Bulk erased drives
in [Design]
|
Prev: Trailer and Power Generator
Next: Bad Resistors
From: Robert Baer on 26 Jun 2010 01:50 D Yuniskis wrote: > Hi Grant, > > Grant wrote: >> On Fri, 25 Jun 2010 16:57:11 -0400, "Michael A. Terrell" >> <mike.terrell(a)earthlink.net> wrote: >> >>> Grant wrote: >>>> On Thu, 24 Jun 2010 23:40:18 -0400, "Michael A. Terrell" >>>> <mike.terrell(a)earthlink.net> wrote: >>>> >>>>> D Yuniskis wrote: >>>>>> Hi, >>>>>> >>>>>> A 501(3)c that I am affiliated with received a donation >>>>>> of several hundred ~80G SATA/PATA drives the other day. >>>>>> They have allegedly (?) been bulk erased. I was asked, >>>>>> today, if there is any way to make the drives serviceable, >>>>>> again. >>>>>> >>>>>> I have not seen the drives or had a chance to play with >>>>>> any of them. As "proof" that they were bulk erased, I >>>>>> am told each drive bears a label: >>>>>> ERASED >>>>>> Magnetic data is completely erased. >>>>>> Erased product can't be reused or repaired. >>>>>> >>>>>> When *I* take a drive out of service, I "bulk erase" them >>>>>> (after "electronically" overwriting the existing data) and >>>>>> then subject them to the 500G drop test :> But, I'll admit >>>>>> I have never *tried* to recover data from a drive thusly >>>>>> (ahem) "treated". >>>>>> >>>>>> My initial response to them was "recycle them, they're trash". >>>>>> Was I too hasty? >>>>>> >>>>>> I would imagine all the servo information, low level >>>>>> formatting, bad sector table, etc. are gone or corrupted >>>>>> so putting these back into service would require "special >>>>>> factory tools"... >>>>> >>>>> There is a software command for newer drives to erase all data. >>>> Yes, but it takes too long to execute for commercial reality? >>> >>> Have you ever tried it? >> >> No, but the time quoted for secure erase in 'smartctl' report for HDD >> is similar period to what writing zeroes to entire surface would >> take. So I 'dd' zeroes to the HDD instead :) > > Some new drives run everything in/out of the platters through > a block cipher (?). So, you can effectively "erase" the data > just by changing the "key". > > Note that modern drives are hard to truly obfuscate their contents > as the bit density is so high that even grinding/chopping the > platters will leave large enough fragments to be imaged! > (e.g., I think a sector on a modern drive is like 0.010"; > granted, that's just *a* sector but if the drive is full of > names, birthdates and SSN's, that's *a* hit for each such > imaged sector! :-/ ) > > Of course, you need to have something truly *worth* stealing > for these sorts of Class II and III attacks (I wonder if, > nowadays, a Class I attack could be successfully mounted; > e.g., using facilities available at a university) Well, 50 years ago there was the question "what does a lock do?" and the answer was (and is today and in the future) "keep an honest person honest.". Probably the most secure place for information (data) is IN THE PUBLIC (domain). The info being easily available in the public domain essentially makes it worthless or as worthless as any other info - and so not worth the time and/or trouble to find a particular straw in the haystack.
From: Grant on 26 Jun 2010 08:28 On Fri, 25 Jun 2010 22:44:23 -0700, Robert Baer <robertbaer(a)localnet.com> wrote: >Grant wrote: >> On Fri, 25 Jun 2010 16:57:11 -0400, "Michael A. Terrell" <mike.terrell(a)earthlink.net> wrote: >> >>> Grant wrote: >>>> On Thu, 24 Jun 2010 23:40:18 -0400, "Michael A. Terrell" <mike.terrell(a)earthlink.net> wrote: >>>> >>>>> D Yuniskis wrote: >>>>>> Hi, >>>>>> >>>>>> A 501(3)c that I am affiliated with received a donation >>>>>> of several hundred ~80G SATA/PATA drives the other day. >>>>>> They have allegedly (?) been bulk erased. I was asked, >>>>>> today, if there is any way to make the drives serviceable, >>>>>> again. >>>>>> >>>>>> I have not seen the drives or had a chance to play with >>>>>> any of them. As "proof" that they were bulk erased, I >>>>>> am told each drive bears a label: >>>>>> ERASED >>>>>> Magnetic data is completely erased. >>>>>> Erased product can't be reused or repaired. >>>>>> >>>>>> When *I* take a drive out of service, I "bulk erase" them >>>>>> (after "electronically" overwriting the existing data) and >>>>>> then subject them to the 500G drop test :> But, I'll admit >>>>>> I have never *tried* to recover data from a drive thusly >>>>>> (ahem) "treated". >>>>>> >>>>>> My initial response to them was "recycle them, they're trash". >>>>>> Was I too hasty? >>>>>> >>>>>> I would imagine all the servo information, low level >>>>>> formatting, bad sector table, etc. are gone or corrupted >>>>>> so putting these back into service would require "special >>>>>> factory tools"... >>>>> >>>>> There is a software command for newer drives to erase all data. >>>> Yes, but it takes too long to execute for commercial reality? >>> >>> Have you ever tried it? >> >> No, but the time quoted for secure erase in 'smartctl' report for HDD >> is similar period to what writing zeroes to entire surface would take. >> So I 'dd' zeroes to the HDD instead :) >> >> Grant. > ??? 'dd' ??? Whazzat? Command line utility on unix-like OS (eg. Linux), dd is a generalised data transfer utility. Example, write zeroes to entire HDD: # dd if=/dev/zero bs=1M of=/dev/sdd Decode: # - superuser prompt, if=/dev/zero - input file is endless stream of zeroes, bs=1M - blocksize is 1MB, of=/dev/sdd - output file is a particular HDD treated as one big file; no end condition specified so command runs until output file (the drive) is full. Grant. -- http://bugs.id.au/
From: JosephKK on 26 Jun 2010 10:24 On Wed, 23 Jun 2010 19:19:02 -0700, D Yuniskis <not.going.to.be(a)seen.com> wrote: >Hi, > >A 501(3)c that I am affiliated with received a donation >of several hundred ~80G SATA/PATA drives the other day. >They have allegedly (?) been bulk erased. I was asked, >today, if there is any way to make the drives serviceable, >again. > >I have not seen the drives or had a chance to play with >any of them. As "proof" that they were bulk erased, I >am told each drive bears a label: > ERASED > Magnetic data is completely erased. > Erased product can't be reused or repaired. > >When *I* take a drive out of service, I "bulk erase" them >(after "electronically" overwriting the existing data) and >then subject them to the 500G drop test :> But, I'll admit >I have never *tried* to recover data from a drive thusly >(ahem) "treated". > >My initial response to them was "recycle them, they're trash". >Was I too hasty? > >I would imagine all the servo information, low level >formatting, bad sector table, etc. are gone or corrupted >so putting these back into service would require "special >factory tools"... I would have asked for some samples, and said it was just curiosity to see if i could figure out what was done to them. At 80 GB it would not take all that long to do a truly worthwhile grade of wipe. And an industrial chipper would be cheaper than any magnet wiper that powerful. And i have meet people unscrupulous as to just apply labels. Actually rewriting the servo information may take machinery with different heads.
From: JosephKK on 26 Jun 2010 10:35 On Thu, 24 Jun 2010 10:04:12 +0200, Robert Roland <fake(a)ddress.no> wrote: >On Wed, 23 Jun 2010 19:19:02 -0700, D Yuniskis ><not.going.to.be(a)seen.com> wrote: > >>I would imagine all the servo information, low level >>formatting, bad sector table, etc. are gone or corrupted >>so putting these back into service would require "special >>factory tools"... > >I'd say you are right. The key here is the servo information. The head >positioning is done by a voice coil. A voice coil has no positional >feedback, so the drive needs to read special information from the >platters to figure out where the heads are at the moment. Once this >information is lost from the platters, there is no way to locate the >heads accurately. > >In the olden days, when the heads were moved by a stepper motor, a low >level format was a simple matter. Pretty much. The original write of servo information requires an alternate path for accurate head positioning.
From: JosephKK on 26 Jun 2010 10:45
On Fri, 25 Jun 2010 01:22:51 -0700, Robert Baer <robertbaer(a)localnet.com> wrote: >AZ Nomad wrote: >> On Wed, 23 Jun 2010 19:19:02 -0700, D Yuniskis <not.going.to.be(a)seen.com> wrote: >>> Hi, >> >>> A 501(3)c that I am affiliated with received a donation >>> of several hundred ~80G SATA/PATA drives the other day. >>> They have allegedly (?) been bulk erased. I was asked, >>> today, if there is any way to make the drives serviceable, >>> again. >> >>> I have not seen the drives or had a chance to play with >>> any of them. As "proof" that they were bulk erased, I >>> am told each drive bears a label: >>> ERASED >>> Magnetic data is completely erased. >>> Erased product can't be reused or repaired. >> >>> When *I* take a drive out of service, I "bulk erase" them >>> (after "electronically" overwriting the existing data) and >>> then subject them to the 500G drop test :> But, I'll admit >>> I have never *tried* to recover data from a drive thusly >>> (ahem) "treated". >> >>> My initial response to them was "recycle them, they're trash". >>> Was I too hasty? >> >>> I would imagine all the servo information, low level >>> formatting, bad sector table, etc. are gone or corrupted >>> so putting these back into service would require "special >>> factory tools"... >> >> An external magnetic field will physically damage the drive before it >> starts to erase the data. The gap between platter and case is enough >> to make external bulk eraseing nearly impossible. They probably just >> ran software to erase the drives. >> >> Have you actually tried powering on a few and trying restore the >> partition table? > Diskwipe software over-writes ALL data, so there would be NO >partition table in any sense of the term. True, but a new partition table can be easily created, so long as the electronic size data and the magnetic servo data is intact. I have done so many times on erased drives. More than once i used simple tools that inspected the drive and re-created the old partition table. |