From nobody Fri Nov 15 12:36:56 2024 X-Original-To: freebsd-questions@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4Xqc3F6F3Gz5d5dT for ; Fri, 15 Nov 2024 12:36:57 +0000 (UTC) (envelope-from freebsd-doc@fjl.co.uk) Received: from bs2.fjl.org.uk (bs2.fjl.org.uk [84.45.41.208]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (2048 bits) client-digest SHA256) (Client CN "bs2.fjl.org.uk", Issuer "bs2.fjl.org.uk" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4Xqc3F1rpTz4kx6 for ; Fri, 15 Nov 2024 12:36:57 +0000 (UTC) (envelope-from freebsd-doc@fjl.co.uk) Authentication-Results: mx1.freebsd.org; dkim=none; spf=pass (mx1.freebsd.org: domain of freebsd-doc@fjl.co.uk designates 84.45.41.208 as permitted sender) smtp.mailfrom=freebsd-doc@fjl.co.uk; dmarc=none Received: from roundcube.fjl.uk ([192.168.0.2]) by bs2.fjl.org.uk (8.16.1/8.16.1) with ESMTP id 4AFCautK039601 for ; Fri, 15 Nov 2024 12:36:56 GMT (envelope-from freebsd-doc@fjl.co.uk) List-Id: User questions List-Archive: https://lists.freebsd.org/archives/freebsd-questions List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: freebsd-questions@freebsd.org Sender: owner-freebsd-questions@FreeBSD.org MIME-Version: 1.0 Date: Fri, 15 Nov 2024 12:36:56 +0000 From: Frank Leonhardt To: FreeBSD questions mailing list Subject: Re: How to zero a failing disk drive before disposal? Message-ID: <6296286326ddb19458de6631f8560dd8@fjl.co.uk> X-Sender: freebsd-doc@fjl.co.uk Content-Type: multipart/alternative; boundary="=_871f1156143d15dd1c8b2ec9f92492f0" X-Spamd-Result: default: False [2.84 / 15.00]; FAKE_REPLY(1.00)[]; SUBJECT_ENDS_QUESTION(1.00)[]; NEURAL_SPAM_MEDIUM(0.99)[0.994]; NEURAL_SPAM_LONG(0.94)[0.939]; NEURAL_HAM_SHORT(-0.89)[-0.890]; R_SPF_ALLOW(-0.20)[+ip4:84.45.41.208:c]; MIME_GOOD(-0.10)[multipart/alternative,text/plain]; ONCE_RECEIVED(0.10)[]; ARC_NA(0.00)[]; ASN(0.00)[asn:25577, ipnet:84.45.0.0/17, country:GB]; RCPT_COUNT_ONE(0.00)[1]; MIME_TRACE(0.00)[0:+,1:+,2:~]; RCVD_COUNT_ONE(0.00)[1]; MID_RHS_MATCH_FROM(0.00)[]; MISSING_XM_UA(0.00)[]; PREVIOUSLY_DELIVERED(0.00)[freebsd-questions@freebsd.org]; TO_MATCH_ENVRCPT_ALL(0.00)[]; FROM_EQ_ENVFROM(0.00)[]; RCVD_TLS_LAST(0.00)[]; TO_DN_ALL(0.00)[]; MLMMJ_DEST(0.00)[freebsd-questions@freebsd.org]; DMARC_NA(0.00)[fjl.co.uk]; R_DKIM_NA(0.00)[]; FROM_HAS_DN(0.00)[] X-Rspamd-Queue-Id: 4Xqc3F1rpTz4kx6 X-Spamd-Bar: ++ --=_871f1156143d15dd1c8b2ec9f92492f0 Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset=US-ASCII; format=flowed On 2024-10-10 12:57, Ronald F. Guilmette wrote: > Any suggestions? If worse comes to worse I guess I will end up writing > my own tiny > little C program to just write 4KB blocks to a designated output file > while ignoring > all output errors, but I don't want to reinvent the wheel if somebody > else already > created something I can use in this context. > > Suggestions welcome. I spent many years dealing with forensics and disk drives, as well as writing about the technology in 1980s and 1990s. My take is this: If you want to pretty much guarantee nothing can be recovered, drilling a hole through the platters is the easiest way. Getting data off the undamaged cylinders once you've done that requires serious money and expensive equipment. If you want to go further, take the top off and bend the platters. After that you'll need an electron microscope and a lot of time to get anything back. Don't bother with a software erase alone. Modern drives lie to the OS. They'll almost certainly have data on blocks they'll pretend don't exist as they're presenting a "perfect disk" to the OS, but data on such blocks can be read it other ways by transferring the platters out. This was all true until Flash-EPROM appeared in hybrid drives. If you've got one of these, drill through the flash chips on the controller (again, Flash-EPROM presents as perfect so bad hidden blocks may contain useful data). If you're not sure which chips contain flash, drill-them all. I'm aware defense erasure standards go further than this, but I regard them as over-paranoid unless the data is of interest to a nation state with an unlimited budget and plenty of time. As to erasing old hard disks for re-use, the same applies. Don't rely on a software erase if it matters that someone could retrieve fragments. However, if you've been encrypting sensitive data (as you should), all they'd get is impossible to decrypt fragments - no problem. -- ------ 25-Sept-24 My apologies to everyone who I appear to have ignored for the last few years. A procmail script was misfiling some replies to Questions to the wrong folder. --=_871f1156143d15dd1c8b2ec9f92492f0 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=UTF-8

On 2024-10-10 12:57, Ronald F. Guilmette wrote:

Any suggestions?  If worse comes to wor= se I guess I will end up writing my own tiny
little C program to just = write 4KB blocks to a designated output file while ignoring
all output= errors, but I don't want to reinvent the wheel if somebody else alreadycreated something I can use in this context.

Suggestions welc= ome.


I spent many years dealing with forensics and disk dri= ves, as well as writing about the technology in 1980s and 1990s. My take is= this:

If you want to pretty much guarante= e nothing can be recovered, drilling a hole through the platters is the eas= iest way. Getting data off the undamaged cylinders once you've done that re= quires serious money and expensive equipment. If you want to go further, ta= ke the top off and bend the platters. After that you'll need an electron mi= croscope and a lot of time to get anything back.

= Don't bother with a software erase alone. Modern drives lie to the= OS. They'll almost certainly have data on blocks they'll pretend don't exi= st as they're presenting a "perfect disk" to the OS, but data on such block= s can be read it other ways by transferring the platters out.

This was all true until Flash-EPROM appeared in hybrid = drives. If you've got one of these, drill through the flash chips on the co= ntroller (again, Flash-EPROM presents as perfect so bad hidden blocks may c= ontain useful data). If you're not sure which chips contain flash, drill-th= em all.

I'm aware defense erasure standard= s go further than this, but I regard them as over-paranoid unless the data = is of interest to a nation state with an unlimited budget and plenty of tim= e.

As to erasing old hard disks for re-use= , the same applies. Don't rely on a software erase if it matters that someo= ne could retrieve fragments. However, if you've been encrypting sensitive d= ata (as you should), all they'd get is impossible to decrypt fragments - no= problem.

--
= ------
25-Sept-24 My apologies to everyone who I appear to have ignore= d for the last few years. A procmail script was misfiling some replies to Q= uestions to the wrong folder.
--=_871f1156143d15dd1c8b2ec9f92492f0--