Re: Hard drives v. CF/Smart media/etc.

[Alloishus BeauMains <all0i5hu5 () gmail com>]

Most Media referred to as a Hard Drive isn't currently flash media.
They are for the most part still magnetic heads reading platters. This
goes for the newer USB Hard Drives as well. However, I know that there
are large flash drives, and those fall under flash memory as much as
any other flash type device (USB drive, etc).

It only takes one overwrite after a format to pretty much thoroughly
screw up a hard drive recovery. As far as I know, there isn't a
published way to retrieve that information, although I have read of a
high profile recovery outfit (and it was like $6k for each gig)
recovering tidbits of information. Using a ghost image of garbage
usually works pretty well, especially since you can tell the ghost
image to pull the entire size of the drive. Overwriting data on a
small drive might not be a problem....load it up with your the
pictures of your favorite car. Overwriting data on a huge drive is a
beast. In those cases, there is a device that will rearrange the
electrons on the magnetic discs to make data hard to recover.

If a hard drive has a flash memory cache, then the best way to do it
would be to format the drive, and then go ahead and rearrange the
electrons.

At any rate, there are professional tools to completely erase drives.
I only added that tidbit on magnetic platters because you would be
surprised at how many people believe that using a strong magnet will
erase an HD. That is a myth. You cannot use a magnet to erase a hard
drive reliably, and you cannot use a magnet at all to erase flash
memory (The magnet that you would need to do that would have to be the
size of your house, and have a better chance of sucking electrons from
your skin than it would erasing the flash drive).

I cannot stress enough for people to wipe out those drives before
throwing them away! If you don't plan on using the drive anymore....go
ahead and drill a hole in it or something similiar to destroy the
drive. Then you never have to worry about it.

"I would have thought with that element to flash memory that there
> isn't/wouldn't/shouldn't be a "ghost" image of the
> data that had been stored there."

I think you misunderstood me there....There isn't a ghost image at all
on flash memory. After the logic is changed, then that is it. No need
to do anything else with flash memory other than format it to clear it
out (Or you can overwrite it.)

On 10/18/05, Herman Frederick Ebeling, Jr. <hfebelingjr () lycos com> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> - ----Original Message----
> From: Alloishus BeauMains [mailto:all0i5hu5 () gmail com]
> Sent: Tuesday, 18 October, 2005 14:50
> To: gillettdavid () fhda edu
> Cc: hfebelingjr () lycos com; security-basics () securityfocus com
> Subject: Re: Hard drives v. CF/Smart media/etc.
>
> : Yes and no. Delete may have a recovery option.
> :
> : However, formatting a drive with flash memory offers no protection
> : that I know of, unless the information is cached (backed up) to a
> : separate media.
>
> I presume that your talking about a USB key, and not a HD that has a flash
> memory cache, right?
>
> :
> : The reason is that flash memory is either there or it isn't, as
> : determined by chip/connection logic.
>
> I would have thought with that element to flash memory that there
> isn't/wouldn't/shouldn't be a "ghost" image of the
> data that had been stored there.
>
> :
> : However, on a normal hard drive or floppy disc with platters, there is
> : a magnetic resonance that is left behind, so even if the electrons are
> : scrambled, it is possible to still retrieve that information.
>
> Yep, and depending on how badly someone wanted said data it is "always"
> recoverable.
>
> :
> : So this leads to a side question: How to keep others from retrieving
> : information from one of those media varieties?
> :
> : Answer: There are two ways: 1. Destroy the media. 2. Overwrite the
> : media with garbage (Although this won't utterly completely keep
> : someone from retrieving the information....whoever wanted it would
> : have to pay dearly).
>
> How many times of overwriting would it take to decrease the chances of it being
> recovered?
>
> :
> : I am not aware of any tools that do data retrieval from a flash drive
> : unless it is being copied to another location...so if anyone knows of
> : anything different, let me know.
> :
> : On 10/18/05, David Gillett <gillettdavid () fhda edu> wrote:
> ::  Yes.  My dad accidentally deleted half the digital pictures of
> :: his and my mom's "cruise of a lifetime" (50th anniversary) off the
> :: flash memory card from his camera, and a garden-variety deleted file
> :: recovery utility got them back.
> ::
> :: David Gillett
> ::
> ::
> ::: -----Original Message-----
> ::: From: Herman Frederick Ebeling, Jr. [mailto:hfebelingjr () lycos com]
> ::: Sent: Monday, October 17, 2005 4:26 PM
> ::: To: security-basics () securityfocus com
> ::: Subject: Hard drives v. CF/Smart media/etc.
> :::
> :::
> ::: -----BEGIN PGP SIGNED MESSAGE-----
> ::: Hash: SHA1
> :::
> ::: Here's a good question that I don't think I've seen any
> ::: articles on.  As we all know even though that just because a
> ::: file is "deleted" from a HD doesn't mean that the info is
> ::: really "deleted" as it can (depending on how badly someone
> ::: wants to) be recovered.  Does the same hold true for CF/Smart media/etc.
> ::: types of media?
> :::
> ::: Herman
> :::
> ::: -----BEGIN PGP SIGNATURE-----
> ::: Version: PGP 8.0.3
> :::
> ::: iQA/AwUBQ1Qw2h/i52nbE9vTEQLdgwCffPxDF1rD3hx8kpaNq5uYro8647IAoL3H
> ::: Wfht/XL5GxoPLbli59+iKmzM =UIqO
> ::: -----END PGP SIGNATURE-----
>
> -----BEGIN PGP SIGNATURE-----
> Version: PGP 8.0.3
>
> iQA/AwUBQ1V2Cx/i52nbE9vTEQJQlwCgsCzlbp5+fLUSfA9ADFq3qhf/GLYAoIVj
> ArRJ1/ADXuZ2R6P/wLNflTD4
> =Gj7X
> -----END PGP SIGNATURE-----