From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.saout.de ([127.0.0.1]) by localhost (mail.saout.de [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kJIVGOM329nM for ; Sun, 9 Dec 2012 17:37:48 +0100 (CET) Received: from v4.tansi.org (ns.km33513-03.keymachine.de [87.118.94.3]) by mail.saout.de (Postfix) with ESMTP for ; Sun, 9 Dec 2012 17:37:47 +0100 (CET) Received: from gatewagner.dyndns.org (84-74-164-49.dclient.hispeed.ch [84.74.164.49]) by v4.tansi.org (Postfix) with ESMTPA id C2EDD1404001 for ; Sun, 9 Dec 2012 17:37:47 +0100 (CET) Date: Sun, 9 Dec 2012 17:38:29 +0100 From: Arno Wagner Message-ID: <20121209163828.GA17651@tansi.org> References: <20232.77.109.139.26.1355052014.squirrel@lavabit.com> <50C48372.5030106@gmail.com> <50C4A4A1.4090003@babioch.de> MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Disposition: inline Content-Transfer-Encoding: quoted-printable In-Reply-To: <50C4A4A1.4090003@babioch.de> Subject: Re: [dm-crypt] (OT) Secure data wipe List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: dm-crypt@saout.de On Sun, Dec 09, 2012 at 03:48:01PM +0100, Karol Babioch wrote: > Hi, >=20 > Am 09.12.2012 13:26, schrieb Javier Juan Mart=EDnez Cabez=F3n: > > overwritting unallocated space several times >=20 > this basically is a myth. Overwriting the whole drive just one time will > make any recovery practically impossible, see [1]. >=20 > The "multiple times" aspect to my best knowledge originates from the > good old days, where the density of tracks on floppies wasn't as high as > it is with todays hard drives and it was possible to "miss" the track by > some amount. Actually, the background is as follows (track density, bit-density,=20 etc, are secondary): A magnetic medium has a s/n (signal-to-noise)=20 ratio and a ratio an overwrite weakens an older singnal by.=20 As a simplified example, you may get 10mV of noise and a maximum=20 signal of 100mV. Then you have signal-to-noise of 10:1. An overwrite=20 always weakens the original signal, bit it is still there. Say, it=20 gets weakened by a factor of 3. Then you have the n-th (overwriting) signal at 100mV singal strengt, and the n-1 (older) signal at 30mV. You can hence read signal n, reconstruct (in analog) how it=20 was written, subtract it from an analog media read and get the n-1 signal.=20 For floppies, I did some measurements 20 years back, and I=20 could clearly see the n-1 signal and maybe the n-2 signal=20 would also have been possible to read. The s/n ratio was=20 was very high. For modern disks, the s/n ratio is low enough that the n-1=20 signal vanishes in the noise after a single overwrite. The=20 background is that modern electronics can read the signal=20 almost perfectly in analog and modern signal processors can=20 do all the math needed to get the maximum possible decoding=20 quality in real-time. If the HDD manufacturers could cram in more bits, they would, but the surfaces can simply not=20 hold them reliably. They certainly cannot hold twice as much data, as in a signal and the overwritten signal from before. Ordinary 1.44MB floppy disks coukld be made to=20 hold > 20MB with special equipment back in the day. Rumour has it that after one overwrite you may get lucky and=20 pull off single bits, like occasionally recognizing a keyword,=20 using very expensive equipment and a lot of time. For encrypted=20 data that is pretty worthless.=20 Arno --=20 Arno Wagner, Dr. sc. techn., Dipl. Inform., Email: arno@wagner.name GnuPG: ID: CB5D9718 FP: 12D6 C03B 1B30 33BB 13CF B774 E35C 5FA1 CB5D 9718 ---- One of the painful things about our time is that those who feel certainty are stupid, and those with any imagination and understanding are filled with doubt and indecision. -- Bertrand Russell