Ask HN: Why did Apple change from 35 pass erases to just 7? | Hacker News Reader

Ask HN: Why did Apple change from 35 pass erases to just 7?

9 pointsbenguild7 comments

In Disk Utility, OS X was always fairly security conscious by allowing up to a 35 pass erase of attached disks to prevent their recovery. However, in Mountain Lion, this built-in option has been dropped to a limit of 7.

Of course, 35 passes was always overkill, but 7 by comparison seems scant. What is the truth to overwriting disks and their ability to be recovered by a malicious third-party?

View on HN

The days when you could actually address (work on) a specific part or area of a storage device are long gone, so overwriting the old data to securely delete it is no longer possible/guaranteed.

A fair overview of Data Remanence is on wikipedia. You want to pay attention to the issues mentioned with flash based (SSD) storage as well as the links to the various research papers.

http://en.wikipedia.org/wiki/Data_remanence

I am critical of any erase that does more than one pass. Is there any research that suggests it is ineffective with modern drives?

http://en.wikipedia.org/wiki/Gutmann_method#Criticism

nand wear balancing

35 passes was always overkill. 35 was the sum of each of 3 patterns, and each of the 3 was only ever relevant on a certain kind of MFM disk. The "Gutmann method" is completely irrelevant on a modern hard drive.

Moreover, my understanding is that modern magnetic storage is, during normal operation, functioning very close to the limit of what the media can store, and what we have the technology to read; the concept that electron microscopes can recover overwritten data was only true decades ago. With this in mind, even a single-pass overwrite is likely to be sufficient for most purposes -- if we had the technology to recover data after it's been overwritten, we'd be using that technology to double hard disk capacities.

"if we had the technology to recover data after it's been overwritten, we'd be using that technology to double hard disk capacities."

If we have the technology, then like an electron microscope, it might not be feasible to implement at a size and a cost that would be viable in a storage product, but would be viable as a forensic analysis tool.

Instead of overwriting, I would recommend sending the drive a ATA_SECURITY_ERASE command. That will wipe all areas of an SSD,as well as reserved space on normal hard drives etc.

Reply on news.ycombinator.com