On 07/15/2010 06:45 PM, Jordon Bedwell wrote: > Anything, and I repeat anything, is recoverable, even if you remove the > filesystem you can recover pieces of the file. [citation needed] When you do a low-level write to the disk, you're wiping out anything and everything. One single pass of zeroes, and not a single hard drive recovery company on the planet will be willing to attempt a recovery of your data. It's gone. Two writes, if you're ultra paranoid. Any additional writes, and you're just wasting your time. Further, if you physically damage the disks even the slightest, by bending them, drilling holes, exposing them to high degrees of heat, etc, again, not a single hard drive recovery company on the planet will make the attempt. It's not worth their time. It's not worth your money. > You can remove remnants > of the file using over write methods but you need to make sure they > properly implement the algorithm and do your own research on the > algorithms to make sure they were designed or were updated for modern > hard drives. EXP: Gutmann method was designed for older HD's and will > not work on newer HD's most of the time (depending on who implements > it). With any modern hard drive that implements an RLL encoding algorithm since the mid-1990s, can be securely erased with a single pass of zeroes. The bit alignments are too accurate to leave the fragments that Gutmann mentions in his paper, that microscopes can pick up. Now with perpendicular bit encoding, and the areal density of disk platters, there's just no room for fragmentation. Each bit gets written exactly in the same place it did before. This wasn't the case with MFM encoding (pre-1990 drives). > Now, removing remnants of the file doesn't make it unrecoverable > (in all circumstances), you might be able to still do a very low level > recovery, something they would generally reserve for say, a RICO > investigation, terrorists an those sorts. The only way to stop any and > all data leaks, recoveries or anything of the sort is to either Degauss, > Destroy or use Encryption on the drive from the get go and to be honest, No, not really. Encryption is definitely good enough, and erasing only the first and last gigabyte or so with random data, will destroy any clues about using encryption on the disk. As far as the investigator would be concerned, the whale disk was just overwritten with random data, which creates perfect deniability. > the only proper implementation of drive encryption (beyond the actual > encryption) would be RedHat (and this is only because they offer the > ability to span encryption across multiple drives and recommend it) and > no drive encryption (beyond truecrypt) offers deniability. [citation needed] As far as I know, RHEL isn't doing anything special beyond LUKS and dm-crypt, which is available in Debian and just about every other GNU/Linux-based operating system. And, as mentioned above, it's trivial to create deniability with any encrypted disk. > Something > I've brought up on both Debian and Ubuntu and even to Redhat. As a > matter of fact, Ubuntu developers fought with me over the idea telling > me that only criminals could possibly want plausible deniability, but > Ubuntu is rather closed minded most of the time when it comes to this > sort of thing. Generally, when I've interfaced with Ubuntu developers, they've had rock solid reasons on why something does or does not get implemented. It's never been due to hard heads or closed minds, as you suggest. -- . O . O . O . . O O . . . O . . . O . O O O . O . O O . . O O O O . O . . O O O O . O O O
Attachment:
signature.asc
Description: OpenPGP digital signature