Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Great Zero Challenge

16systems.com

Post reply on HN
Print view View original

11–19 of 19 posts

Re: The Great Zero Challenge

#11

Post by pmjordan »

Tichy wrote: post #4

The well-repected German magazine c't did the test a couple of years ago. They contacted three data recovery firms, and none could recover a drive that had been dd-ed with zeros once. I wonder how to erase Flash-Drives, though.

That's a tricky one, as flash drives have special logic built in to avoid repeatedly overwriting the same block to prevent deterioration. On the other hand, bypassing that logic in order to read out the data in the extra blocks is not possible in software, (unless there's a backdoor) and I don't know if the logic sits on the controller chip or the actual flash chip. If it's the latter, it'll be pretty damn hard to get to.

EDIT +1 for mentioning c't

Re: The Great Zero Challenge

#12

Post by bdr »

pmjordan wrote: post #10
Hexstream wrote: post #8

Earlier quoted context omitted.

"I'm guessing the myth must have originated somewhere - although ignorance is a reasonable possibility I suppose." Imagination stems from trying to read from uninitialized memory, yielding an undefined value. :)

I don't think anyone claims it's possible to read said data using standard drive firmware, so comparing it to uninitialised memory isn't the whole story. I always figured the theory was that if the cell was magnetised twice, you could tell from the magnitude of the resulting field not only its current magnetisation but also its history. I can see how that might be possible based on magnetic properties of real materia…

I think Hexstream was talking about human memory

Re: The Great Zero Challenge

#13

Post by Hexstream »

bdr wrote: post #12
pmjordan wrote: post #10

Earlier quoted context omitted.

I don't think anyone claims it's possible to read said data using standard drive firmware, so comparing it to uninitialised memory isn't the whole story. I always figured the theory was that if the cell was magnetised twice, you could tell from the magnitude of the resulting field not only its current magnetisation but also its history. I can see how that might be possible based on magnetic properties of real materia…

I think Hexstream was talking about human memory

He was!

Re: The Great Zero Challenge

#14

Post by pius »

The terms are utter bullshit.

You may not write any data to the drive or disassemble it . . . .

The Gutmann paper referenced elsewhere in the thread concludes that overwriting the drive (something like 34 times IIRC) with zeroes is important because a dedicated analyst can measure the residual magnetism of each sector of the drive to infer the most recent "long term" binary values. Not allowing the drive to be opened makes this type of analysis kind of difficult.

Re: The Great Zero Challenge

#16

Post by wmf »

pmjordan wrote: post #11
Tichy wrote: post #4

The well-repected German magazine c't did the test a couple of years ago. They contacted three data recovery firms, and none could recover a drive that had been dd-ed with zeros once. I wonder how to erase Flash-Drives, though.

That's a tricky one, as flash drives have special logic built in to avoid repeatedly overwriting the same block to prevent deterioration. On the other hand, bypassing that logic in order to read out the data in the extra blocks is not possible in software, (unless there's a backdoor) and I don't know if the logic sits on the controller chip or the actual flash chip. If it's the latter, it'll be pretty damn hard to ge…

When I worked with flash chips they were quite dumb and well-standardized, so bypassing a controller should be no problem.

Re: The Great Zero Challenge

#19

Post by xirium »

pius wrote: post #14

The terms are utter bullshit. You may not write any data to the drive or disassemble it . . . . The Gutmann paper referenced elsewhere in the thread concludes that overwriting the drive (something like 34 times IIRC) with zeroes is important because a dedicated analyst can measure the residual magnetism of each sector of the drive to infer the most recent "long term" binary values. Not allowing the drive to be opened…

It may be possible to retreive the data without openning a drive. I can think of two methods for achieving this objective. Firstly, I've seen reference to SCSI commands to retrieve "unbaked" sectors from CDROMs. Support for this functionality varies but it may be possible that some harddisks have undocumented functionality. You may wish to check the widespread implementation of DRM in harddisks for circumstantial evidence of such functionality. Alternatively, it may be possible to replace harddisk firmware which allows retrieval of magnetic traces. Again, I've seen reference to "low-level formatting" which wipes harddisk firmware. If the firmware is accessible in this manner then retreival is possible for almost all harddisks without openning them. It would also demonstrate that data recovery services are doing a shoddy job of imaging disks, running some standard recovery tools, and maybe performing some sector edits.

This test raises the bar because you have three days and writing to the disk is not allowed. That would leave you with three days to reverse engineer the existing firmware.

Post reply on HN