Muti-Pass Software Data Sanitation Method - Truth or Myth?
In the age where spreading information is faster than the speed of light because of the internet, anyone must do all the necessary measures in protecting their data from the prying eyes.
For an effective data sanitation, you must understand how data sanitation method works and what are the possible things you can do with it.
Take, for example, sanitizing data through the use of software; most people are inclined to the idea that overwriting the disk in multiple passes will ensure data on the drive is removed.
Ensuring data destruction by data is one of the easiest method you can perform to destroy the data.
The problem is this process is very time-consuming because data needs to be overwritten several times.
A full overwrite for a 500 Gigabyte hard disk drive can take 12 to 16 hours, and it also depends on the kind of processor you have and the amount of RAM.
This is, however, through the use of the Guttman method, one of the popular method of disk overwrite.
The problem with Multi-pass software overwrite is that most disk wiping algorithm is meant for two kinds of hard disks: run-length limited and modified frequency modulation.
Modified Frequency Modulation MFM is a method of encoding data in hard disks.
MFM was first used on older drives it has a data transfer rate of 200 up to 500 kbps.
MFM is not used in modern drives and is only seen in floppy disks.
Run Length Limited Encoding RLL is an improvement of MFM encoding also used in earlier models of hard disks and floppy disks.
It is a more sophisticated technique than MFM because there are two parameters that define how RLL works and have its specific variations.
Both these two methods are not used in modern drive any more.
Which means Guttman's 35 pass disk wipe and other data overwriting procedures that implement multiple passes are usually overkill because of the certain factors that make multi-pass not an ideal option.
For example, Guttman's overwriting method only focuses on two kinds of disks: RLL and MFM.
These methods of encoding rely on detection of a narrow range of signal values and have not been used in modern drives for the past 10 to 15 years.
Furthermore, the areal density has increased by at least three orders of magnitude since the publication of Guttman's paper.
Which means the method is at least three years late.
Additionally, multi-pass overwrite is theoretical.
Magnetic Force Microscopy is a tremendously expensive procedure which requires a powerful microscope that anyone can buy or use.
That is why the government created their own disk overwriting based on their overwriting standards.
The Government Overwriting Standards There are many disk overwriting standards anyone can use on their drives.
Below are some of the overwriting standards issued by the government for secure data destruction.
DoD 5220-22-M DOD 5220-22-M is a recommended procedure by the government in handling sensitive information in a hard disk drive.
It overrides the data by writing some character, its compliment, and then another random character.
NSA 130-1 A data sanitation procedure wherein the procedure is performed by writing a character, then another random character, and a specified value.
Since most are classified information, there are no clear indications on how exactly it is done or if the government is still using these procedures when removing confidential data.
A study by computer forensic experts Craig Wright, Dave Kleiman and Shyaam Sundar R.
S in 2008 discovered that when a hard disk is overwritten once, the chance of recovering a data is 56 percent.
If you want to recover a byte, you would need to correct the head positioning repeating for about 8 times; therefore, it will reduce the probability to 0.
97%.
Which means the probability of recovering an overwritten file is zero.
It is not a surprise that these recovery companies cannot recover data from a hard disk that are overwritten even once.
Even zero-fill or low-level formatting is enough to make a file unrecoverable.
Conclusion If you want to get rid of the data, it is essential to erase the entire disk drive rather than deleting certain partition on the disk.
Deleting just the file or the folder creates a shadow copy, backup, or temporary copies of the file that you deleted.
The safest thing to do is to format the hard disk drive then perform a basic file overwrite that can be finished in as fast as two to three overwrite.
Further developments on how a disk reads and writes data made it possible to overwrite files securely with just a few passes.
Before you sell, transfer, or donate you hard disk drive, it is crucial that you perform disk sanitation methods but this time do not overdo it with 10 or more passes, a quick 1 or 3 pass is enough.
For an effective data sanitation, you must understand how data sanitation method works and what are the possible things you can do with it.
Take, for example, sanitizing data through the use of software; most people are inclined to the idea that overwriting the disk in multiple passes will ensure data on the drive is removed.
Ensuring data destruction by data is one of the easiest method you can perform to destroy the data.
The problem is this process is very time-consuming because data needs to be overwritten several times.
A full overwrite for a 500 Gigabyte hard disk drive can take 12 to 16 hours, and it also depends on the kind of processor you have and the amount of RAM.
This is, however, through the use of the Guttman method, one of the popular method of disk overwrite.
The problem with Multi-pass software overwrite is that most disk wiping algorithm is meant for two kinds of hard disks: run-length limited and modified frequency modulation.
Modified Frequency Modulation MFM is a method of encoding data in hard disks.
MFM was first used on older drives it has a data transfer rate of 200 up to 500 kbps.
MFM is not used in modern drives and is only seen in floppy disks.
Run Length Limited Encoding RLL is an improvement of MFM encoding also used in earlier models of hard disks and floppy disks.
It is a more sophisticated technique than MFM because there are two parameters that define how RLL works and have its specific variations.
Both these two methods are not used in modern drive any more.
Which means Guttman's 35 pass disk wipe and other data overwriting procedures that implement multiple passes are usually overkill because of the certain factors that make multi-pass not an ideal option.
For example, Guttman's overwriting method only focuses on two kinds of disks: RLL and MFM.
These methods of encoding rely on detection of a narrow range of signal values and have not been used in modern drives for the past 10 to 15 years.
Furthermore, the areal density has increased by at least three orders of magnitude since the publication of Guttman's paper.
Which means the method is at least three years late.
Additionally, multi-pass overwrite is theoretical.
Magnetic Force Microscopy is a tremendously expensive procedure which requires a powerful microscope that anyone can buy or use.
That is why the government created their own disk overwriting based on their overwriting standards.
The Government Overwriting Standards There are many disk overwriting standards anyone can use on their drives.
Below are some of the overwriting standards issued by the government for secure data destruction.
DoD 5220-22-M DOD 5220-22-M is a recommended procedure by the government in handling sensitive information in a hard disk drive.
It overrides the data by writing some character, its compliment, and then another random character.
NSA 130-1 A data sanitation procedure wherein the procedure is performed by writing a character, then another random character, and a specified value.
Since most are classified information, there are no clear indications on how exactly it is done or if the government is still using these procedures when removing confidential data.
A study by computer forensic experts Craig Wright, Dave Kleiman and Shyaam Sundar R.
S in 2008 discovered that when a hard disk is overwritten once, the chance of recovering a data is 56 percent.
If you want to recover a byte, you would need to correct the head positioning repeating for about 8 times; therefore, it will reduce the probability to 0.
97%.
Which means the probability of recovering an overwritten file is zero.
It is not a surprise that these recovery companies cannot recover data from a hard disk that are overwritten even once.
Even zero-fill or low-level formatting is enough to make a file unrecoverable.
Conclusion If you want to get rid of the data, it is essential to erase the entire disk drive rather than deleting certain partition on the disk.
Deleting just the file or the folder creates a shadow copy, backup, or temporary copies of the file that you deleted.
The safest thing to do is to format the hard disk drive then perform a basic file overwrite that can be finished in as fast as two to three overwrite.
Further developments on how a disk reads and writes data made it possible to overwrite files securely with just a few passes.
Before you sell, transfer, or donate you hard disk drive, it is crucial that you perform disk sanitation methods but this time do not overdo it with 10 or more passes, a quick 1 or 3 pass is enough.
