Software recommendations to recover files & securely delete drive contents

[citizen]

In an effort to prevent future drama, I thought I would ask some questions about file recovery & HD deletion. I do not have an "emergency" right now.

I have some old hard drives that need to be wiped in the future. What would be a reliable, secure, program to remove all data. GUI preferred.

I am also looking for a utility that can help me un-delete files/directories. I realized I have no idea how to do this in Linux.

Also, any personal experience with HD destruction? Looking for easy, safe DIY solutions. Not really into BBQing my electronics.

[HalationEffect]

I was pretty sure that Steve Riley (one of the admins here) had posted something on the subject of secure deletion, and some searching discovered it:

https://www.kubuntuforums.net/showth...l=1#post316173

To physically destroy a hard drive (of the spinning platter variety) by DIY methods, I'd go with drilling a few holes entirely through it, then take it out to the street, lean it against the curb and 'curb stomp' it a few times with a big hammer.

As for file & directory undeletion... just restore from your backups! You *do* backup your important data, right?

[Qqmike]

Undeletion/recovery: see TestDisk and PhotoRec (same site, they come together):
http://www.cgsecurity.org/wiki/TestDisk

Wiping drives:
The command dd (it is easy, doing what you want to do), How To:
https://www.kubuntuforums.net/showth...The-dd-Command
Lot of people seem to use Dban
http://www.dban.org/

Destroying the HD: Yep, smash it with a hammer. You can even remove the disks, smash them around, cut with tin snips (and yes, pack pieces separately in bags, discard on separate trash days and bins ...)
;-)

[GreyGeek]

Destroying the data on an HD? The easiest and most sure way is to heat the platters with a propane torch till they are red hot, destroying the magnetic domains. Hold a magnet near it will it cools down to force the domains all into one direction, eliminating even the "ghost" traces. While you are at it, fry the circuitry and chips that drive the rw head, and melt the head.

[citizen]

As for file & directory undeletion... just restore from your backups! You *do* backup your important data, right?

I do. However, I have in the past, stupidly deleted fresh data (just created), when trying to reorganize a project. Oh the joy of being human.


@all the other awesome replies... thanks for the suggestions.

[SteveRiley]

And one more thing...if you want to completely wipe a disk, all you need to do is:

1. Mount it in an external USB enclosure
2. Plug in the cable
3. Run sudo dd if=/dev/zero of=/dev/sdX bs=16M where X is the letter that Udev assigns in the device node tree

You do not need any fancy schmancy multi-pass wipe tools or anything rated "DoD strength" or similarly described. One pass of zeroes will permanently wipe out whatever was there before.

[vinnywright]

And one more thing...if you want to completely wipe a disk, all you need to do is:

1. Mount it in an external USB enclosure
2. Plug in the cable
3. Run sudo dd if=/dev/zero of=/dev/sdX bs=16M where X is the letter that Udev assigns in the device node tree

You do not need any fancy schmancy multi-pass wipe tools or anything rated "DoD strength" or similarly described. One pass of zeroes will permanently wipe out whatever was there before.

? no need for /dev/urandom and 3 pass ?? (what I use)

VINNY

[SteveRiley]

? no need for /dev/urandom and 3 pass ?? (what I use)

Nope, waste of time and electricity. One pass, all zeros, is sufficient.

http://www.howtogeek.com/115573/htg-...e-to-erase-it/
http://privazer.com/overwriting_hard...ontroversy.pdf

And a thread on Secrity Focus discussing /dev/zero vs /dev/urandom. In that thread is an illuminating post by the author of the above paper.
http://www.securityfocus.com/archive/1/497355

Magnetic devices DO NOT have memory. They experience a hysteresis effect. This is NOT Time based and is NOT going to supply the physical effects associated with tool marks etc.

PRML and EPRML are based on analogue processes. Drives are not digitally encoded, they are translated. There is no recovery - AFM, MFM or whatever type of electron microscope you choose. The paper will be available in Dec. The proof is detailed there and the process can be replicated by anyone who cares to do so (I am actually surprised that we are the first to have do it).

The 7 wipe (or more) theory is based on a flawed supposition.

The optinal bitwise recovery from a PRML drive that is no longer available and was never used more than once is less than 92% per bit (given foreknowledge of the write pattern). ePRML is as low as 49% per bit using electron microscopy. Even at 92% per bit, the recovered data is useless and random. This is detailed in the paper mentioned before.

At 49% - this is a modern drive - the toss of a coin is more accurate. Think about that for a minute.

Regards,
Craig Wright GSE-Malware, GSE-Compliance

[vinnywright]

Nope, waste of time and electricity. One pass, all zeros, is sufficient.

http://www.howtogeek.com/115573/htg-...e-to-erase-it/
http://privazer.com/overwriting_hard...ontroversy.pdf

And a thread on Secrity Focus discussing /dev/zero vs /dev/urandom. In that thread is an illuminating post by the author of the above paper.
http://www.securityfocus.com/archive/1/497355

will readjust my method then

VINNY

[Qqmike]

Agree with Steve and his references.
More, in my how-to:

https://www.kubuntuforums.net/showth...l=1#post107356