Files can always be recovered no matter what you do...

Started by
33 comments, last by HappyCoder 12 years, 6 months ago
At least that is what my NOS-110 teacher said. This automatically got me thinking about ways to permanently delete a file without possible recovery. It seems simple enough to me. Write over the bytes of the file with random values and use a seed value from a unrecoverable source. For example the computer clock, CPU temperature or internet connection speed. Make sure not to write over bytes which have to do with the file system since they are in known patterns and could be used to uncover the seed value by checking every single possible value for the seed using the algorithm which was used to generate the random number. This should naturally be avoidable by using a standard file open command to write the data which I believe should avoid writing to any known structures in the file system. Unless however the file type is know and includes a standard header. However one could also make the permanent deletion algorithm avoid file type headers.

So anyway I told my teacher that I was pretty sure it was possible to permanently delete a file using an unknowable seed value to overwrite the file with random values. This made the teacher go into a long rant about how I think I know everything and telling me all of his qualifications. Then he went on to explain that no values on a computer are random and once you know the algorithm you can hack any encryption. I tried to explain to him that you may know the algorithm but an unknowable seed value is easily obtained. I'm almost certain I'm right but he humiliated me in front of the whole class... Anyway, what do you guys think? Am I right? If not then why?
Advertisement
http://en.wikipedia....a_storage_media

Also see:

http://en.wikipedia.org/wiki/Data_remanence
I'm fairly sure you can just write to your disk until you run out of memory to make erased data unrecoverable in most cases...

There's also the Gutmann Method, though I know little about it's necessity.
Even if you write over a file with (unknowable, truly random) random bits, forensic analysis can still detect the original values of the bits in some cases. Think of it like, how when you erase a page of pencil-writings, and then scribble over it, there will still be a faint impression of the original text on the paper. Same thing happens with magnetic disks, so you need to scribble really hard to make sure no-one can decipher those imprints.

The standard practice that I know of for permanently deleting a file is to write over it will all zeros, then write over it with all ones, then write over it a few times with random bits, and then to smash the hard-drive enclosure with a hammer and discard of it in protected land-fill.

As for truly random numbers -- electronic slot machine regulations in some jurisdictions actually require truly random numbers, not just pseudo-random numbers. These are generated from a real RNG device (which measure entropy from radiation, decay, thermal noise, etc), not a PRNG algorithm, and it is truly impossible to predict the output numbers, even if you know how it works.
Actually, you can just erase it so well that it never existed in the first place.
-~-The Cow of Darkness-~-
The issue isn't with overwriting with randomness, it's that hard-drives are analog beasts in a digital world. Even when you write '1' to the bit, it's not completely totally a one. It's just more than .5 so the hard-drive says it's a one. A dedicated attacker can crack open the spindles and take an electron microscope to it to get a better picture of what the bits used to be.

In software, the best you can do is write to the drive random bits 13-25ish times. Otherwise, wiping the drive with industrial magnets or causing the platters physical/chemical damage is your best chance of obscuring the data on the drive. Blossum's links are good.

So you're both kind of right; 'just' deleting a file won't do it. Even overwriting garbage won't do it, but you can eventually get to a state where the information is sufficiently obscured to be considered 'lost'.

Even if you write over a file with (unknowing) random bits, forensic analysis can still detect the original values of the bits in some cases.

The standard practice that I know of for permanently deleting a file is to write over it will all zeros, then write over it with all ones, then write over it a few times with random bits, and then to smash the hard-drive enclosure with a hammer and discard of it in protected land-fill.

As for truly random numbers -- electronic slot machine regulations in some jurisdictions actually require truly random numbers, not just pseudo-random numbers. These are generated from a real RNG device (which measures entropy from radiation, decay, thermal noise, etc), not a PRNG algorithm.


Even that would be less effective than what I proposed since you are effectively reducing the magnetic field, increasing the field, and lastly using a PRNG algorithm to scramble it. To recover the data one would need hyper sensitive equipment to read off the data then reduce the values down to get the background noise. Then you simply read the bits that make up the header of an NTFS or FAT file system and run them through an algorithm to reverse PRNG randomization with every single possible seed value. You then amplify the background noise yet again and check to see if the data matches the standard header for that file system.

But if you avoid knowable headers you can just overwrite the data once with random values and result in almost absolutely irreversible deletion.
you can just overwrite the data once with random values and result in almost absolutely irreversible deletion.
No. If I write '4' on a sheet of paper, then you erase it and write '7' in it's place, I can still see the imprint of the 4 on the paper.
You've got to repeat this process many times until there's too many imprints there to make out any specific one....


And then you've got to burn it to be sure.
When I have to be certain something is erased and not recoverable... I use this tool:

power-drill-1.jpg
You can totally erase something, but it's a bigger pain in the ass than it's worth. It pretty much boils down to writing random data a couple times, writing very specific data to the data you want erased a bunch of times, then writing some more random data again. The random data is moreso just to add some more jitter and randomness to it more than anything.

Not positive how it works, but I'd presume it estimates what the original file would look like after being overwritten a bunch of times, then produces a bunch of data that is expected to have the inverse of what the original file would have looked like resulting in neither set of data appearing to have ever existed. THIS EXPLANATION IS PURELY CONJECTURE ON MY PART, but the first paragraph stuff I did skim a paper on, and that appeared to be what they set up.

edit:
[color=#1C2837][size=2]When I have to be certain something is erased and not recoverable... I use this tool:[/quote]
[color=#1C2837][size=2]I use alcohol 8-)

This topic is closed to new replies.

Advertisement