From: jim bell <jimbell@pacifier.com>
Date: Sun, 21 Jan 96 20:53:20 PST
To: Peter Monta <cypherpunks@toad.com
Subject: Re: Wipe Swap File
Message-ID: <m0teDrp-0008yBC@pacifier.com>
MIME-Version: 1.0
Content-Type: text/plain


At 06:43 PM 1/21/96 -0800, Peter Monta wrote:
>Tim May writes:
>
>> Much more expensive would be various electron microscope-based imaging
>> methods to directly image the domains and extract subtle signs of past
>> write cycles.
>
>I recently took a tour of Park Scientific, the scanning-probe
>microscopy people, in Sunnyvale.  One of their demo-stations
>showed a small portion of a hard disk (taken with an AFM
>tip fitted with a small magnet to generate the force).  Most
>impressive.  (I did look closely at the edges of the track,
>but saw no sign of previous writes.)
>Peter Monta   pmonta@qualcomm.com

While I admit that I'm not particularly familiar with modern hard disk head 
design, I think it is futile to look for data in this way.  If they "tunnel 
erase" the edges of the data track, even small misalignments will not allow 
remnants of data to remain.  (And I assume that "all" modern hard disk 
drives employ high-precision data-read feedback mechanisms to maintain track 
alignment down to the submicron level...  thermally-sensitive stepper motors
and linear positioners of the 1980's are (or at least should be) gone!)

Further, modern read-channel techniques (PRML; partial response, maximum 
likelihood) bring the normally readable signal closer to the noise level 
than ever before, and the PREVIOUSLY written signal is that much more 
difficult to resurrect.  

As a method for gathering intelligence on anyone, I think that this is dead 
and buried.

However, I _still_ want to see brainless operating systems like MSDOS 
changed to erase (zero) allocated  data buffers before and after use (and 
especially before re-use!), so that parts of vital files don't accidentally 
get written to the ends of other files.