Hacker News Reader

Comment by DanBC | Hacker News Reader

About drive wiping: You're probably better off using the ATA Secure Erase command, which is very quick and does the entire disc. dd and other tools risk not doing blocks marked as bad, for example.

He's right that a single overwrite of zero is probably good enough to make sure that data is gone, but it's probably not enough to persuade other people that it's gone. A few passes of pseudo random data is probably better if you need to persuade other people that the data has gone.

But if it's really important drive wiping is what you do to protect the drives until you get a change to grind them.

View on HN

There is also a cryptographic erase option on secure erase if the drive supports it. It is nearly instantaneous and you can follow up with other slower methods if desired.

Also for SSDs, using the secure erase method is important because of overprovisioning and garbage collection. If that is not available, on most SSD algorithms, doing two full pass writes (with random sector data if drive supported compression) will get you close to wiping out all contents as possible.

The OPAL standard has that cryptographic erase function. I've used it before, but did not deeply verify if any data was recoverable. At least the partition table was gone. In theory, the command destroys the old key and creates a new one that the drive uses to read and write data. A different key means everything is noise. You do need access to the printed label on the drive itself to do it (for the PSID).

https://github.com/Drive-Trust-Alliance/sedutil/blob/master/...

This is what I am doing currently

# openssl enc -aes-256-ctr -pass pass:"$(dd if=/dev/urandom bs=128 count=1 2>/dev/null | base64)" -nosalt </dev/zero \ | pv -bartpes <DISK_SIZE> | dd bs=64K of=/dev/sd"X"

To randomize the drive/partition using a randomly-seeded AES cipher from OpenSSL (displaying the optional progress meter with pv): https://wiki.archlinux.org/index.php/Securely_wipe_disk/Tips...

Then I take out the drill press and make a bunch of holes.

>but it's probably not enough to persuade other people that it's gone.

I believe there is a long standing bounty for anyone who can retrieve useful data from a drive that had been zero'd once. No one has been able to thus far.

A lot of the disk wiping "culture" stems from a much earlier time when disk technology was less reliable, especially in regards to writes. Dan Gutmann himself says that the Gutmann method is long antiquated and only worked with MFM/RLL encoded disks from the 80s and early 90s.

Perhaps instead of humoring these people, we should be educating them. A zero'd out disk is a wiped disk until someone proves otherwise.

This reminds me of assertions we used to take for granted about DRAM. We used to assume that the contents are lost when you cut the power, but then someone turned a can of cold air on a DIMM. We usually assume that bits are completely independent of each other, but then someone discovered the row hammer. The latter is especially interesting because it only works on newer DIMM technology. Technology details change, and it's hard to predict what the ramifications will be. A little extra caution isn't necessarily a bad thing.

I agree but redoing a wipe isn't extra caution, its just literally repeating the same thing. If that thing is wrong, you're not helping the situation, just wasting time/resources.

Extra caution would be shredding the drive or some other non-wipe method. At work for example, we zero out drives and then those drives get physically destroyed by a vendor.

Peter Gutmann? https://www.cs.auckland.ac.nz/~pgut001/

Gutmann's paper talks about a time when you didn't know what drive controller was used, and so he created a set of patterns to be used for each pattern. That comes to (about) 35 different patterns.

This gets misunderstood as "you need to do 35 passes of these patterns". You don't, Gutmann recommends a couple of overwrites of random data, and a single overwrite of zeros is probably enough.

You make a good point, but see countless Dilbert cartoons about the futility of trying to persuade your boss that what he wants is stupid.

This may be my paranoia talking, but is there a way short of an examination with a scanning electron microscope to ensure that the erase command is actually doing what it's supposed to do?

Not so much that the drive manufacturers are engaging in malfeasance (though that's certainly not off the table), but that it's not unheard of for certain agencies in certain governments to crock low level system components (intercepting them in shipping and so forth) so they work against the user.

..or just plain ignorance. A study indicates that back in 2011, half of the major drive vendors weren't doing the erase correctly. https://www.usenix.org/legacy/events/fast11/tech/full_papers...

You could just read the disk again and check for nonzero blocks. If you don't trust the disk to read or write to itself either, then you might as well just toss it.

It wouldn't be that technically complex to have modified firmware that looks for the secure erase command (not something that's ever invoked except purposefully by the user), and returns all random for read sectors without ever actually overwriting the underlying data.

But yeah, you're right. If you ever have reason to invoke the secure erase command, you're probably in a position where the next step is throwing the drive in a shredder.

>A few passes of pseudo random data is probably better if you need to persuade other people that the data has gone.

You only need one.

https://en.wikipedia.org/wiki/Data_erasure#Number_of_overwri...

It's not about what is needed. It's about what the person ultimately responsible (the client, your boss, etc) perceives is necessary.

Then don't tell them how many passes you did :-)

Reply on news.ycombinator.com