Comments on post #1027902

@Indefinity on post #1027902 (kochiya sanae, tatara kogasa, mystia lorelei, and miyako yoshika (touhou) drawn by mizuki_hitoshi)

2013-08-12T05:11:55-04:00

Danbooru: How to format your hard drive 101.

@Futo^o^Maki on post #1027902 (kochiya sanae, tatara kogasa, mystia lorelei, and miyako yoshika (touhou) drawn by mizuki_hitoshi)

2013-06-01T15:47:34-04:00

I think it should be your best friend's responsibility to wipe your browsing history when you die.

@Black_Rynex on post #1027902 (kochiya sanae, tatara kogasa, mystia lorelei, and miyako yoshika (touhou) drawn by mizuki_hitoshi)

2012-02-18T14:38:18-05:00

I was considering that it was a reference to those who have stashed pornography. That's my thought on it. They're called jokes for a reason. Heh heh..., moving on I'm more torwards that.

@Alignn on post #1027902 (kochiya sanae, tatara kogasa, mystia lorelei, and miyako yoshika (touhou) drawn by mizuki_hitoshi)

2011-12-20T03:38:27-05:00

I thought it was reminding you to reformat first so no-one finds your shameful secrets.

@akun5000 on post #1027902 (kochiya sanae, tatara kogasa, mystia lorelei, and miyako yoshika (touhou) drawn by mizuki_hitoshi)

2011-12-20T03:24:10-05:00

Guys, I think the implication is that since you didn't format the drive, the sign is implying that you can recover the data.

I.e. even if there's an error that kills the drive, you can still get your work off it, thus you don't necessarily need to kill yourself if the computer dies.

Considering how tense high school and college entrance exams, and/or final exams can be, losing important data could be enough to trigger a mental BSOD, and lead someone to committing suicide.

And suicide over lost term papers is probably not as rare as one would hope.

@ThunderBird on post #1027902 (kochiya sanae, tatara kogasa, mystia lorelei, and miyako yoshika (touhou) drawn by mizuki_hitoshi)

2011-11-03T12:07:09-04:00

DschingisKhan said:
I'm honestly not sure why you're breaking out the liquid nitrogen for this, they're nonvolatile...

Oh fmb, I mixed them up momentarily with RAM chips... -.-'

As for the internal sectors, I've only had to try and dissect only one flash drive before, but that used 512 byte sectors. It turned out better than I expected, the files were largely intact, thanks to using only a quick format. If they accidentally did a full format, I think it would have been pretty much a goner.

As for the study, it made for a rather interesting read, thanks for bringing it to my attention!

@Saphyr on post #1027902 (kochiya sanae, tatara kogasa, mystia lorelei, and miyako yoshika (touhou) drawn by mizuki_hitoshi)

2011-11-03T09:09:54-04:00

C-c-c-c-combo breaker!

So, in any case... having to reformat a drive is hardly going to stop me from committing suicide if I still bear enough sense to know that I (and anyone I decide to care about before my death) won't suffer any consequences from what's found in my files after I'm dead, assuming my storage devices are with someone I trust.

@etb on post #1027902 (kochiya sanae, tatara kogasa, mystia lorelei, and miyako yoshika (touhou) drawn by mizuki_hitoshi)

2011-11-03T03:33:01-04:00

To complete what DschingisKhan said I would like to recall why there is still the idea that you need lots of overwrites.

It was true for data on floppy disks that in the yore were fairly common. Nowadays it is not the case anymore.

@DschingisKhan on post #1027902 (kochiya sanae, tatara kogasa, mystia lorelei, and miyako yoshika (touhou) drawn by mizuki_hitoshi)

2011-11-02T15:18:31-04:00

ThunderBird said:
What I was referring to was the reading of the residual magnetic field after a zeroing, using an atomic force microscope. Due to its sensitivity, it can detect the minuscule field left behind after a write of zeros to a sector

As I said: the possibility of recovering any single bit is ~56% (Wright, Kleiman and Sundhar, 2008). The Guttmann standard is so outdated at this point it's pretty well pointless. Read that here: www.vidarholen.net/~vidar/overwriting_hard_drive_data.pdf

As for flash memory, you're right there: wear leveling moves all the shit around so much there's no telling where a given bit is, or was two seconds ago. They may be able to freeze the bits in place by dunking the chips in liquid nitrogen, but that only preserves the data, it doesn't make it any easier to reconstruct...

What? First off, most NAND devices in the wild right now use 4kb sectors internally, so there is at least a strong possibility a lot of data is still extant in contiguous chunks, but we have no standards or guarantees about its arrangement. Best we can do is remove the physical chips and put them in a NAND reader. I'm honestly not sure why you're breaking out the liquid nitrogen for this, they're nonvolatile...

@ThunderBird on post #1027902 (kochiya sanae, tatara kogasa, mystia lorelei, and miyako yoshika (touhou) drawn by mizuki_hitoshi)

2011-11-02T11:56:57-04:00

DschingisKhan said:
This is a surprisingly common misconception, even in 2011. For spinning-platter hard disks, the probability of recovering any single bit is approximately 56%-- simple statistics takes over at that point. dd if=/dev/zero of=/dev/whatever bs=1. There are a select few high-grade enterprise devices which have the potential to microstep outside of track to potentially read residual overflow bits; using this technique you could theoretically recover a significant amount of data; a few blocks, even. But the odds of these blocks being contiguous and the "correct" 2048 bytes for whatever purpose is quite close to zero.

Newer NAND flash storage devices muddle the waters a little because of the automatic wear-leveling and lack parity between internal and external addressing, but your theoretical maximum is still only about 30% as of this writing. Moreover, even if you remove each of the chips and put them in a reader, you're not usually going to recover much useful because, as mentioned, there is currently no method of knowing how data was reordered for wear-leveling and fragmentation. This fact has made mobile device forensics somewhat difficult recently.

What I was referring to was the reading of the residual magnetic field after a zeroing, using an atomic force microscope. Due to its sensitivity, it can detect the minuscule field left behind after a write of zeros to a sector, but the field strength decreases rapidly with each subsequent zero write.
That's why I said that if someone needs your data badly enough, they can recover it even after a low-level format. Five passes of zeroing should move the field around enough to eliminate most traces, six passes of alternating zeroes and ones will be an almost definite kill, and the nine passes of zeroes, ones, and random bits should leave no trace of whatever was there in the first place, unless they give it to a clairvoyant machine.
(The alternating 0-1-random passes are actually how the USDOD wipes their HDDs. Or at least how they used to do it a decade or so ago...)

As for flash memory, you're right there: wear leveling moves all the shit around so much there's no telling where a given bit is, or was two seconds ago. They may be able to freeze the bits in place by dunking the chips in liquid nitrogen, but that only preserves the data, it doesn't make it any easier to reconstruct...

@Nilix on post #1027902 (kochiya sanae, tatara kogasa, mystia lorelei, and miyako yoshika (touhou) drawn by mizuki_hitoshi)

2011-11-02T09:32:53-04:00

Byakugan01 said:
...CSI and NCIS? Forensic science does not work that way. It's hollywood science that they use. Not ALL false, but...well, you get the picture.

Oh yeah?! Well, I'm gonna make a GUI in visual basic to crack your IP Address! Then we'll see who's right!
I can't understand how they can say things that silly with a straight face...

@Byakugan01 on post #1027902 (kochiya sanae, tatara kogasa, mystia lorelei, and miyako yoshika (touhou) drawn by mizuki_hitoshi)

2011-11-02T09:16:39-04:00

Nilix said:
But it works on CSI and NCIS all the time!

...CSI and NCIS? Forensic science does not work that way. It's hollywood science that they use. Not ALL false, but...well, you get the picture.

@Nilix on post #1027902 (kochiya sanae, tatara kogasa, mystia lorelei, and miyako yoshika (touhou) drawn by mizuki_hitoshi)

2011-11-02T09:12:38-04:00

DschingisKhan said:
This is a surprisingly common misconception, even in 2011. For spinning-platter hard disks, the probability of recovering any single bit is approximately 56%-- simple statistics takes over at that point. ...

But it works on CSI and NCIS all the time!

@BadRoad on post #1027902 (kochiya sanae, tatara kogasa, mystia lorelei, and miyako yoshika (touhou) drawn by mizuki_hitoshi)

2011-11-01T20:23:58-04:00

Honestly, it's pretty entertaining to watch thermite melt through just about anything.

@Shadowflames on post #1027902 (kochiya sanae, tatara kogasa, mystia lorelei, and miyako yoshika (touhou) drawn by mizuki_hitoshi)

2011-11-01T18:31:27-04:00

BadRoad said:
How about an industrial magnet?

Industrial magnet would work too. But zeroing a drive will cause the data to be irrecoverable.

Truth be told, though, I just like the fireworks when I melt through a drive with a can of thermite.

@BadRoad on post #1027902 (kochiya sanae, tatara kogasa, mystia lorelei, and miyako yoshika (touhou) drawn by mizuki_hitoshi)

2011-11-01T18:17:01-04:00

How about an industrial magnet?

@Апельсиновый_Чувак on post #1027902 (kochiya sanae, tatara kogasa, mystia lorelei, and miyako yoshika (touhou) drawn by mizuki_hitoshi)

2011-11-01T13:32:07-04:00

Nah, a lot of people refer to "erasing HDD" as "formatting", forgetting the original meaning. That's probably the case here, too.

@etb on post #1027902 (kochiya sanae, tatara kogasa, mystia lorelei, and miyako yoshika (touhou) drawn by mizuki_hitoshi)

2011-11-01T12:56:56-04:00

Illusive said:
Format C:/u

Read about a jera34 experience here.
http://www.tomshardware.co.uk/forum/95964-35-format

Seriously, you need `dd if=/dev/zero of=/dev/sdZ*` to be reasonably sure.
*the syntax is probably a little different in windows: something like //Device/...

@DschingisKhan on post #1027902 (kochiya sanae, tatara kogasa, mystia lorelei, and miyako yoshika (touhou) drawn by mizuki_hitoshi)

2011-11-01T12:24:40-04:00

ThunderBird said:
Data can still be recovered, but it'll take time and equipment

This is a surprisingly common misconception, even in 2011. For spinning-platter hard disks, the probability of recovering any single bit is approximately 56%-- simple statistics takes over at that point. dd if=/dev/zero of=/dev/whatever bs=1. There are a select few high-grade enterprise devices which have the potential to microstep outside of track to potentially read residual overflow bits; using this technique you could theoretically recover a significant amount of data; a few blocks, even. But the odds of these blocks being contiguous and the "correct" 2048 bytes for whatever purpose is quite close to zero.

Newer NAND flash storage devices muddle the waters a little because of the automatic wear-leveling and lack parity between internal and external addressing, but your theoretical maximum is still only about 30% as of this writing. Moreover, even if you remove each of the chips and put them in a reader, you're not usually going to recover much useful because, as mentioned, there is currently no method of knowing how data was reordered for wear-leveling and fragmentation. This fact has made mobile device forensics somewhat difficult recently.

@Saladofstones on post #1027902 (kochiya sanae, tatara kogasa, mystia lorelei, and miyako yoshika (touhou) drawn by mizuki_hitoshi)

2011-11-01T11:55:11-04:00

unicode said:
Like etb said, that does not alter the files themselves. All it does is to remove them from the directory. In other words, declare them as non-existent. Until the space is filled with new files, the deleted files are still recoverable.

To completely remove the data, either physically destroy the drive, or write everything bit to zero. This latter take 2-3 hours on a typical hard drive.

I prefer the bottom of lakes or the ocean to format my drives.