The Great Zero Challenge

#1

Post by tubby » Sun, Feb 17, 2008, 2:55 PM UTC

I've heard for many years that in order to securely erase old hard drives that one must use a tool that makes multiple overwrites using random data. However, I've never seen data recovered from a hard drive that had been overwritten once with only zeros (no random data and only on pass). I've also seen heated debates in online forums over this topic. I really wish someone would take this challenge and put an end to this debate once and for all.

The Great Zero Challenge
16systems.com

Re: The Great Zero Challenge

#2

Post by daniel-cussen » Sun, Feb 17, 2008, 4:52 PM UTC

Very cool.

Re: The Great Zero Challenge

#3

Post by pmjordan » Sun, Feb 17, 2008, 6:16 PM UTC

Interesting. I've read the whole spiel about data being recoverable after being overwriteen many times and from many sources. I've always wondered whether it was true. I mean, I know about hysteresis loops, but given the size of the storage cells on a hard disk these days, it seemed really unlikely that they're not fully magnetised. If data recovery companies aren't going to even try, then I guess that pretty much confirms it's a myth.

I'd be intrigued whether it's possible to recover data on hard disks from 10, 15 years ago which have been treated this way. Back then, the magnetic cells were much, much bigger. What about floppies? I'm guessing the myth must have originated somewhere - although ignorance is a reasonable possibility I suppose.

Re: The Great Zero Challenge

#4

Post by Tichy » Sun, Feb 17, 2008, 6:24 PM UTC

The well-repected German magazine c't did the test a couple of years ago. They contacted three data recovery firms, and none could recover a drive that had been dd-ed with zeros once.

I wonder how to erase Flash-Drives, though.

Re: The Great Zero Challenge

#5

Post by rw » Sun, Feb 17, 2008, 6:55 PM UTC

No one is allowed to disassemble the drive! Because of that, this drive won't ever get professional-level treatment from a data recovery firm.

Re: The Great Zero Challenge

#6

Post by gojomo » Sun, Feb 17, 2008, 7:03 PM UTC

The theory is that special expensive equipment could possibly do such a recovery -- so the 3-day time limit, and measly $40 prize, isn't really responsive to the question.

Further, if you were an agency with the budget and equipment to do this, would you want the world to know?

They aren't testing what they're trying to test, and even a 100x reward and 10-year time limit wouldn't prove the negative, "that recovering data from a zeroed hard drive is impossible".

A seminal paper on the possibility -- but not the reality -- of such specialized recovery is Peter Gutmann's 1996 "Secure Deletion of Data from Magnetic and Solid-State Memory" [ http://www.cs.auckland.ac.nz/%7Epgut001/pubs/secure_del.html ].

Guttman notes in an undated epilogue, however, that advances in data density and recording techniques since 1996 make any recovery from modern devices "unlikely". Still, the "Great Zero Challenge" provides very little in the form of real evidence about these questions.

Re: The Great Zero Challenge

#7

Post by tel » Sun, Feb 17, 2008, 7:56 PM UTC

rw wrote: post #5

No one is allowed to disassemble the drive! Because of that, this drive won't ever get professional-level treatment from a data recovery firm.

If you can prove you're an established firm they'll let you have it for 30 days and disassemble it.

Re: The Great Zero Challenge

#8

Post by Hexstream » Sun, Feb 17, 2008, 8:45 PM UTC

pmjordan wrote: post #3

Interesting. I've read the whole spiel about data being recoverable after being overwriteen many times and from many sources. I've always wondered whether it was true. I mean, I know about hysteresis loops, but given the size of the storage cells on a hard disk these days, it seemed really unlikely that they're not fully magnetised. If data recovery companies aren't going to even try, then I guess that pretty much co…

"I'm guessing the myth must have originated somewhere - although ignorance is a reasonable possibility I suppose."

Imagination stems from trying to read from uninitialized memory, yielding an undefined value. :)

Re: The Great Zero Challenge

#9

Post by thaumaturgy » Sun, Feb 17, 2008, 9:05 PM UTC

tel wrote: post #7

rw wrote: post #5

No one is allowed to disassemble the drive! Because of that, this drive won't ever get professional-level treatment from a data recovery firm.

If you can prove you're an established firm they'll let you have it for 30 days and disassemble it.

Alternatively, they're perfectly happy to sell you the drive for 60 bucks.

Re: The Great Zero Challenge

#10

Post by pmjordan » Sun, Feb 17, 2008, 9:49 PM UTC

Hexstream wrote: post #8

pmjordan wrote: post #3

Interesting. I've read the whole spiel about data being recoverable after being overwriteen many times and from many sources. I've always wondered whether it was true. I mean, I know about hysteresis loops, but given the size of the storage cells on a hard disk these days, it seemed really unlikely that they're not fully magnetised. If data recovery companies aren't going to even try, then I guess that pretty much co…

"I'm guessing the myth must have originated somewhere - although ignorance is a reasonable possibility I suppose." Imagination stems from trying to read from uninitialized memory, yielding an undefined value. :)

I don't think anyone claims it's possible to read said data using standard drive firmware, so comparing it to uninitialised memory isn't the whole story. I always figured the theory was that if the cell was magnetised twice, you could tell from the magnitude of the resulting field not only its current magnetisation but also its history. I can see how that might be possible based on magnetic properties of real materials. ( http://en.wikipedia.org/wiki/Hysteresis_loop#Magnetic_hyster... ) However, you'd have to take an analog reading, not a binary one. The idea here being that N, then S magnetisation ought to yield a weaker S magnetisation than S, S.

Strong enough magnetisation will erase that history though, and presumably make the current data more long-lived and random bit-flips rarer. I'm just wondering if the tech used back in the days wasn't sophisticated to magnetise cells strongly enough. (without affecting neighbouring cells)

Yes, I probably am thinking about this too much. I guess that serves me right for doing a physics degree at university. :)