mailing list archives
Re: Erasing a hard disk easily
From: "morning_wood" <se_cur_ity () hotmail com>
Date: Mon, 12 Jul 2004 18:42:23 -0700
Since that time I have seen sensationalist TV shows showing how FBI and
operatives get stuff out written to a sector BEFORE the sector was
overwritten and I honestly cannot understand how that could be, if at all
possible. Am I right in thinking those shows are bull?
by analizing the magnetics of the disk ....
one write makes 010101 etc
the 0's and 1's are written to the disk by a magnetic manipulation to the
there is a "level" of magnetisim than can be measured
the disk electronics detect this "difference".
lets say a "0" can be between .000 and .010 and a "1" is between .996 and
when you write again over the data, the magnetic properties of the disk
"rember" slightly the previous write.
now when you analize the disk there is a "ghosting" of the previous data
new data pits "0" =.009 "1"=.999
( ghost pits ) "0"=.003 "1"=.997
the drive electronics will detect the higher magnetic "pits" as actual data
the data below the new threshold.
recovering the "ghost" data is now trivial by setting the thresholds below
the new data levels..
logic: discard any data over .004 for "0" and .996 for "1"s
this is a very basic example of course but shows how this technique is used.
Full-Disclosure - We believe in it.
Re: Erasing a hard disk easily Adam (Jul 13)