From: tallpaul@pipeline.com (tallpaul)
Date: Sun, 21 Jan 1996 23:44:19 +0800
To: cypherpunks@toad.com
Subject: Re: Wipe delete
Message-ID: <199601201840.NAA05671@pipe11.nyc.pipeline.com>
MIME-Version: 1.0
Content-Type: text/plain


On Jan 20, 1996 10:24:34, 'sheol@downdeep.com' wrote: 
 
 
>How can data be recovered after it has been wipe by being  
>overwritten? You say even 8 or 9 times is not secure? That's kind of  
>scary. 
> 
 
Let me "answer" this and another post first by saying, re the tekkie stuff,
"I do not know." 
 
However, my non-technical understanding goes something like this: 
 
Reading and writing/erasing from a disk platter are pure only in the
abstract. A bit interpreted as a 1 or 0 has a certain level of magnetism
that the software accepts as defining it as a 1 or 0. The level of defined
magnteism is never 100% on the specification; it always varies a little.
How much it varies can be read by different grades of hardware. 
 
Think of a simple erasure of data that has been written once and erased
once. The different patterns of writing will have slightly different
values. These can be read with specialized hardware and the raw data
analyzed with special software programs. 
 
Is there a cheap way that *we* can do such things? I do not think so. 
 
The normal read/write head(s) on our normal hard disks have a limited
sensitivity, fine for normal read/write operations but not sensitive enough
the gather the minute variations described above. 
 
Doing a military grade analysis of heavily overwritten data involves, to my
knowledge, first opening the disk drive, removing the platters, inserting
the platters in a second drive with much more sensitive heads, initializing
the new drive to make sure that the extra-sensitive heads can locate the
proper tracks/sectors etc. on the old platter, and then gathering the data.
That is, the first steps in the process are hardware, not software, steps. 
 
Now one way to increse the sensitivity of a read/write head is to run it
closer to the physical media on which the magnetic signal resides. In other
words, the intensity of magnetic flux decreases as a function of distance;
get closer to the source and you can read weaker signals. 
 
This also means that, as you postion a new read/write head closer to the
platters you significantly increase the likelihood that it will physically
crash into the platter itself with the data intensity of an army tank
running over a stack of bowling pins. 
 
This, in turn means that the new combination of extra-sensitive read/write
head and old disk platter is especially sensitive to contaminates.
(Forgetting the width of the gap in the head which is another way of
increasing sensitivity), the level of contamination like smoke particles,
dust, etc. must be less than that called for in the original factory
specifications. 
 
This, I think, means you need a physical "clean room" to perform the
reassembly that is cleaner than that used by the original factory. 
 
Those aren't cheap and that is (one) reason why there isn't a cheap way for
us to do this. 
 
At least some aspects of this service is commercially available today. One
easy way to locate services is to look at the small ads in the back of _PC
Magaxine_. 
 
You might try Vogon USA. voice is 405-321-2485. fax is 405-321-2741. 
 
They have no WWW page or even e-mail address because they are not on the
net. I don't even think they permit modems on their factory site. I spoke
to Bob Emerson, Vogon's Service Manager, about this. He explained it as a
security matter: you don't get hacked over the net if you aren't on the
net; you don't get penetrated over the phone lines if you don't have modems
in your shop. 
 
Sorry for the excessively broad non-technical character of this post. I'm
sure other people on the list can go into the privacy issue of data
recovery in far greater detail while ROFLTAO at my low level of knowledge. 
 
tallpaul