So I have to turn in my company computer and I need to clear the hard drive to get rid of all of my personal files on here (financial, and other ) so they can't tell what I did on the computer. If I were to just put in the OS software cd and do an in depth restore of the hard drive. should that suffice to cover up my trail, or should i do something more in depth to clean the computer?

10/20/2010 12:17:11 AM

use this: http://www.dban.org/about

then re-install OS X

10/20/2010 12:44:36 AM

Quote :

"DBAN prevents or thoroughly hinders all known techniques of hard disk forensic analysis."

This part isn't true, but in the OP's case it should work just fine.

10/20/2010 8:31:31 AM

a 1 pass wipe is enough to prevent any data recovery from all known recovery techniques. any claims to the contrary are urban legend

10/20/2010 9:56:03 AM

^ That's not true.

I'm a computer forensics analyst and I know for a fact that magnetic storage retains the data even if you run a drive scrubber on top of it. You may not know what you're going to get, and it is MUCH harder to retrieve, but portions of the data are still there.

[Edited on October 20, 2010 at 11:27 AM. Reason : .]

10/20/2010 11:25:07 AM

The company I don't believe have the skills to do an in depth search on the computer. I just want to make sure that they can't follow my tracks and find out my personal information. I doubt they would even look at my computer honestly, just want to be safe and secure about it.

10/20/2010 11:36:32 AM

That's why I said it would work fine in your case in my original reply

10/20/2010 11:39:18 AM

i would like to know more of this magic machine that can pull bits from nothingness.

10/20/2010 2:15:32 PM

Good read to gain an understanding: http://www.infosecwriters.com/text_resources/pdf/Magnetic_Data_Recovery_JSawyer.pdf

(Although admittedly not the best writing.)

[Edited on October 20, 2010 at 3:03 PM. Reason : .]

10/20/2010 2:59:25 PM

That's the whole point, it's not "nothingness" as you put it.

Let's see if I can give you an parallel that makes sense. Think of hard drive platter like a layer of dirt spread out over an area. I can lay whatever objects in it I want and manipulate anyway I'd like as it is just dirt. Suppose I leave a hammer laying in the dirt (data) and then I decide to "erase" anything on the drive with a drive scrubber putting all 1's or all 0's across the entire drive (shoveling more dirt over the area till it is covered how ever many times I want). I can shovel as much dirt as I want over and the hammer will be buried deeper and deeper, but it's still there. The handle may be rotted and the head rusted (only part of a file header remains) but still there under the dirt. The dirt doesn't "remove" the hammer, it just covers it up. Make sense?

You would need highly specialized readers and some brilliant people to pull info in this manner, but it is plausible and has been done. The cost of the process and cost of the equipment ($texas) makes impractical to use right now. That's why you don't hear about it. A lab in England recently filled 10 platters full of info and ran a drive scrubber on them. Then, they left them under seawater for 10 years and melted all the platters together. They were still able to retrieve 3 bits of data from the media. Don't think you're safe, I can see you

10/20/2010 3:00:17 PM

3 BITS? From 10 platters?

I'm not worried.

10/20/2010 3:07:20 PM

it's just an example of how the field is progressing

Rome wasn't built in a day amirite?

10/20/2010 3:11:53 PM

you mean Rome wasn't burned in a day

10/20/2010 3:23:18 PM

It also lasted for much longer than a day.

10/20/2010 3:31:49 PM

10/20/2010 3:38:28 PM

Another thing to consider is the fact that information density on hard drives is increasing, which means that recovery will get only harder, (Think about the hammer analysis, but now its a pin).

If you wipe over it more than one pass, sure the NSA might be able to recover some of your data, but for the most part your safe from cops, and anyone else who might want to look.


With unlimited money and resources you could probably recover it, but even then what would you actually recover, most files today are megabytes in size, even a small portion of data is recovered, its not likely to contain information that will build a picture.

Also remember on modern drives data is being moved around all the time, so how deep do you go, if you wipe it 4 times, how do you know whats the 4th layer and was is actual data when you dig down. Can you tell it was wiped 4 times, probably but then you start getting so deep in the dirt that you cant tell the difference betweent he 5th and 6th layer.

When you say you recovered 3 bits from the crazy destroyed disk, but my question is did they do this, say lets dig until we get the picture we want, or they attempt recovery and see what they got right.

Even then, 3 bits im sure isn't statistically relevant, i dont know how you would prove that those bits were actually recovered.

Or finally encrypt the drive, from the get go when you setup a new computer

[Edited on October 20, 2010 at 8:50 PM. Reason : after wiping no way they are going to recover.]

10/20/2010 8:28:09 PM

Just buy a new HDD and put it in it, if you're that worried about it. Retain the old HDD and do whatever with it.

10/20/2010 9:30:51 PM

Boot to OSX disk, run disk utility, click the erase option and click the advanced(or something like it) option. You have the option to write over the drive up to 30 times if you are that paranoid. I would recommend 8 times, that is DOD level if I am not mistaken.

10/20/2010 10:40:03 PM