Loading... Please wait...

Wipe Out Storage Devices part 1

Posted by


Hard Drive Wipeout technology – white paper

Rev 2.0

A wipeout (or the erasure of a disk drive or other media) is a process where all the data on that media is completely removed and can not be reconstructed.

Why do we need to wipeout or erase the hard drive?

With the rapid advances in storage technology, the size of hard drives and other storage media are growing exponentially while the price per Mega byte or Giga byte is constantly going down.

This makes it attractive to replace older, smaller drives with newer, larger and faster ones, or to replace an entire computer with a newer, faster model with a larger drive.

Usually the first step we take after we upgrade our computer or drive is to copy the data from the old machine or drive onto the new one. The old one, however, still contains all of our data.

A common practice is to format the old drive. This will indeed “delete” the contents of the drive from the OS by clearing the file allocation table. Even though different operating systems use different methods to mark and to link allocated clusters, all of them use some kind of table that is zeroed out during the format process, Therefore, while all the files and the directories remain on the drive, the OS has no way of retrieving them. The problem is that there are some programs and utilities that can provide access to that data.

Another common way of getting rid of the data is by deleting files and directories. This process is even less effective than the format process. Here’s how it works: the OS marks the file or directory as “deletedby replacing the first character of the file name or folder name with the character “? “ and by releasing or de allocating the areaon the media that was allocated for that file or folder for general usage. Again all the data remains on the drive.

Another point to consider has to do with the organization of the data on the media. The media is organized in fixed-size clusters that, once de-allocated, become part of the pool of available clusters. The content of deleted files or folders will stay intact on the media until being potentially overwritten with new data that happens to use one or more of the reclaimed clusters.

The clusters size, though regarded as fixed, has several possible sizes – from a minimum of 2K bytes (4 hard drive sectors) to a maximum of 64K bytes. The size of a cluster is usually determined automatically by Windows during the drive partitioning and is derived from the drive size(the bigger the drive, the larger the cluster size). Since a typical file has a random size, it is almost never fills the cluster entirely. Let us take, for example, a file that we’ll call “Test1” that is 15.6K bytes. This file will occupy 4 clusters (let’s say 241, 242,243 and 244) in a hard disk that is configured with 4K clusters. The last cluster, the fourth one, contains 3.6K bytes of Test1 data (15.6 – 12). Now let us assume that the user deleted the file Test1 and the OS de allocated its 4 clusters. The user now creates a new file, “Test2,” which is only 12.1K bytes but still occupies 4 clusters. Let’s say, for the sake of this example, that the OS assigns the same clusters (241, 242, 243 and 244) to the new file, Test2. Now the last cluster contains .1K bytes from the new file, Test2, and 3.5K bytes of leftover data from the old and deleted file, Test1. This area of the last cluster in the chain that is not being used by the new allocated file, Test 2, is called Slack Area. Since the OS keeps track of the file’s size, it ignores the information in the Slack Area and it does not pose a problem in normal use. It becomes an issue, however, for a user that is getting rid of an old drive or an old computer and does not want to leave any of his/her data on that drive or computer.

It is safe to say that by writing any pattern of data on the entire drive, sector by sector, there will be no leftover information on the drive media that can be reconstructed by any utility or program. Having said that, however, we should be aware that there is still leftover data energy on the disk between the tracks. This information can not be retrieved without taking the drive apart and without the use of very expensive tools.

Looking at a single surface of a disk drive media


Another important aspect of wiping or erasing information from the hard disk media has to do with the leftover data energy between the tracks. The information on the hard disk media is recorded as magnetic energy. The tracks are not physically engraved in the media; they are virtual tracks. They are called virtual tracks because a track’s positioning information is embedded within the data stream and can change, even if only slightly, every time the data is re-written. As shown in the following drawing, with every new pass of writing to the media, some low level energy from a previous writing pass remains on the disk. During reading, the drive’s electronics are designed to position the reading head around the middle of the track and only consider the high energy information. The leftover energy is added to the general noise, but is not considered a major problem. Special equipment, however, is capable of retrieving significant portions of the leftover information from previous writes. Obviously, the more passes of writes succeeding the pass containing the data of interest, the smaller the amount of retrievable data remains. The data patterns of allpasses written after the pass of interest are also significant for the reconstruction of information from the leftover data energy. The Department of Defense (DOD) specifies 6 passes of“FF” alternating with “00” followed by “F6” as the seventh pass as the requirement for electrical erasure of hard disk media.


There are several software programs and utilities that perform drive wipeout. There are also several hardware solutions. The ICS WipePRO Hardware Solution is dedicated for erasure of up to 8 drives simultaneously.An 8-Port Add-On Module allows wiping up to 16 drives simultaneously.




 

What's New

newsletter

Copyright 2018 ICS-JMR. All Rights Reserved.
 Sitemap | Bigcommerce Premium Themes by PSDCenter