Theoretical Questio...
 
Notifications
Clear all

Theoretical Question

8 Posts
5 Users
0 Likes
434 Views
(@rkamens)
Posts: 36
Eminent Member
Topic starter
 

deleted

 
Posted : 19/06/2006 5:04 pm
keydet89
(@keydet89)
Posts: 3568
Famed Member
 

Difficult, time consuming, and expensive…

 
Posted : 19/06/2006 6:39 pm
(@zon4jou)
Posts: 11
Active Member
 

Difficult, time consuming, and expensive…

All three true. But as the "attacker" finds the information usefull enough, it can be interesting to spend the time, money and technology. For more information on this, see
http//www.porcupine.org/forensics/forensic-discovery/chapter7.html
and specially paragraph 7.2 which addresses the side-tracks on magnetic media.

 
Posted : 19/06/2006 7:31 pm
(@tgoldsmith)
Posts: 35
Eminent Member
 

If you are referring to the voodoo art of Magnetic Force Microscopy that people like to talk about when discussing the topic of hard drive deletion, it is pretty much a moot issue. A few passes of random data is more than sufficient to destroy almost all data on the hard drive, barring a few sectors that have been remapped.

A few nice figures off the top of my head from research on the topic (80Gb drive)

Resolution of MFM 4 pixels per bit
Number of images required to capture the surface of 1 3.5 inch platter 2x10^8
Storage required to save these images ~65 Terabytes
Imaging time for a single snapshot ~30 seconds
Recovery rate for MFM imaging 10 bytes/second
Time to image the platter surface ~190 years

You might be able to speed up scanning a little by making some educated guesses at the location of the filesystem metadata and then parsing that to try to find specific files. Bear in mind however that the number above just relates to capturing the information in raw image form - you still have to write and run the software to interpret the images as data and try to obtain meaningful data from the residual magnetic imprints.

Also, the chances of finding some meaningful data is pretty low at these speeds.

Basically, you are looking at very big governments wanting to try to extract data from hard drives of leaders of countries, at extreme cost with very little chance of success. Which is why almost everyone worldwide shouldn't worry about this level of data recovery )

 
Posted : 19/06/2006 7:46 pm
(@rkamens)
Posts: 36
Eminent Member
Topic starter
 

deleted

 
Posted : 20/06/2006 10:32 am
(@tgoldsmith)
Posts: 35
Eminent Member
 

Well, assuming the Government is willing to spend hundreds of thousands/millions of dollars on possibly recovering a nice bit of a standard Windows install or whatever (in which case I think you have more to worry about 😉

Considering the platters are coated with magnetic material, you can raise the temperature of the platters above the Curie temperature, the point at which a substance loses its magnetic properties. You are looking at around 700 degrees celcius for this, and Thermite is the often quoted substance to achieve this (although it is hard to ignite, and not exactly safe to have around). If you thoroughly do this however, it is physically impossible to retrieve any information at all from the platters. I wouldn't recommend it though.

Special powerful magnets can be used, but are expensive and dangerous also.

I suppose you could remove the platters from the case and spindle and carefully remove the upper coating with a power sander and suitable disc. Still dangerous (you are sanding something like glass - it may shatter, you might breathe in the dust etc).

Performing a few wipes with random data, removing the platters physically destroying them by smashing them with a hammer usually works fine. "They" could put the pieces on a spin stand to attempt to recover data, but that is also very unlikely.

Besides, the data densities of modern disks mean that the magnetic residue always show in those nice photos isn't as defined anymore, as the tracks are closer together and the heads need to be more accurate to write at these densities. Again, it's a moot point )

 
Posted : 20/06/2006 12:48 pm
neddy
(@neddy)
Posts: 182
Estimable Member
 

http//driveslag.eecue.com/articles/index.php?artid=1

this should do it

 
Posted : 20/06/2006 1:44 pm
(@rkamens)
Posts: 36
Eminent Member
Topic starter
 

deleted

 
Posted : 21/06/2006 8:32 am
Share: