Gisle Bjørnstad
This document contains some brief theory and some tests that I performed on my home computer. The theory is based on Peter Gutmann's article "Secure Deletion of Data from Magnetic and Solid-State Memory". This article is worth reading. The tests are all done with Windows XP.
With the use of highly secure encryption mecanisms, hackers have to try other ways to get their information. One solution is to recover deleted files. Much information can be detected from files we think are gone. Sometimes this is a good thing, for eksample when files are deleted unintended, or after a fire. But we don't want trespassers to see them.
We could certainly find many interesting things in old harddrives.
After buying 158 drives, ZDNet found over 5,000 credit card numbers, medical records, detailed personal and corporate financial information, personal emails and gigs of pornography.
When we delete something on the computer, the operating system normally don't erase the file. The only thing that is removed is the pointer to it in the file system. So it's relatively easy to just find the file at the disk surface, extract the content and save it. Then the file system can see it again. It's easy to get software for this. This programs usually requires that the file has not been overritten. If it has, the barrier is higher. Therfore it's also possile to get software that really overwrites the file one to several times. This helps a lot.
As a test I deleted the file, emptied recycle bin and tried Restorer 2000 Professional to recover it. It was no problem.
Then I tried SafeErase to overwrite the file. Even with one, simple write, Restorer could not recover it. The file had been named zzzzzz.zzz and contained no information.
But if someone gets the physical medium, they can recover much more.
Due to deviations in the write head from the track, overwriting of data will leave signifikant traces of the old pattern. This makes it possible to extract what was written before.
Recovery Methods
There are many nanotools in the marked today. Many of this can be used to scan the surface of the storing media.
Scanning Probe Microscopy (SPM)
Uses a sharp magnetic tip attached to a flexible cantilever placed close to the surface to be analyzed, where it interacts with the stray field emanating from the sample to produce a topographic view of the surface. A reasonably capable SPM can be built for a few thousand Nkr, using a PC as a controller. There are thousands in use today
Magnetic force microscopy (MFM)
This is a recent technique for imaging magnetization patterns with high resolution and minimal sample preparation. It's derived from scanning probe microscopy (SPM)
Uses a sharp magnetic tip attached to a flexible cantilever placed close to the surface to be analyzed where it interacts with the stray magnetic field.
An image of the field at the surface is formed by moving the tip across the surface and measuring the force (or force gradient) as a function of position. The strength of the interaction is measured by monitoring the position of the cantilever using an optical interferometer.
STM is another method of the same kind. Klikk here to see a flash animation of the principle.
Using this methods, one can recover 2-3 layers of information.
Secure deletion with software
Peter Gutmann, Department of Computer Science, University of Auckland has published a paper on secure deletion of files. He says:
Faced with techniques such as MFM, truly deleting data from magnetic media is very difficult. The problem lies in the fact that when data is written to the medium, the write head sets the polarity of most, but not all, of the magnetic domains. This is partially due to the inability of the writing device to write in exactly the same location each time, and partially due to the variations in media sensitivity and field strength over time and among devices.
Gutmann describes some patterns to use when overwriting files. Most of them are for older disks. Newer disks are more accurate, and the best to do is to write random data a few times. It should be written with the lowest possible frequence and temperatur in order to make the new pattern penetrate deep into the media.
Many of the file erase software in use today are based on Gutmann's description. SafeErase is one example. Often they overwrites up to 35 times, using all the different patterns described. But this is overkilling. Resent harddrives are very difficult and expensive to recover after a few passes of random 'scrubbing'.
Other methods
Degaussing is another possibility. Degaussing is a process in which the recording media is returned to its initial state. This requires special equipment. Degaussers uses magnetic power to force all the atoms back in the same direction.
Or you can try to destroy the media. But this is not that easy..
Things to think about
Some devices supports caching or buffering of data. This should be disabled to ensure that physical disk writes are performed for each pass instead of everything but the last pass being lost in the buffering. Its a good rule to check that the writings actually was done.
Often we just want to delete special files that we don't want intruders to see. Examples are log files on a webserver. But mostly we just delete those with the normal delete-operation. Then the files can actually be braught to live with simple freeware!
What is the point of encrypt a document if the original plain text file is easy to recover? When writing sensitive documents, always store it in an encrypted folder from the start.
Other types of files that we don't even think about is the temporary files that programs often save while a file is opened. Eksamples are the ~$-files that MSWord uses. Those files can be restored.
The MOVE operation is another example. One way the OS move a file is by first copy the file, and then delete it from the first place. The original file can then be restored.
I tried this. When moving the file inside the partition, only the file system was updated. The file was only found at the new location. But when I moved it to another partition, the file wasn't even marked as deleted when I scanned the original partition again. It was easy to restore.
How do we overwrite files that are already deleted by some
software or by the user? We have no files to give to the erasing
program. I tried to recover a deleted file at the same location as it
originally was. My intention was to see if this would just hook it on
to the file system again. But the recovery program just made another
copy of the file. I wrote over the file with FileErase and scanned
the disk again. The original file was still there, and the restored
copy was overwritten.
Cipher.exe,
that comes with the proffessional- and servereditions of Win 2k and
XP, offers ability to overwrite all deleted files.