35 pass of write zeros to HD does not erase fully!

[bslanger]

I don't get this.  I booted from an external FW HD to erase the HD
on my Powerbook, and used Disk Utility to erase the hard drive,
using 35 pass erase.  Took days. 

Then I ran Data Rescue II on the HD, and guess what? Images,
files, documents...

What the heck?

[bslanger]

After some experimenting, it seems that the data on a boot disk is more
sticky than regular non boot hard drives.  I am hoping to sell the Powerbook,
but as I used it for bookeeping, some of the QuickBook files are still showing
up.  Seems I will need to replace the hard drive.  Is it difficult to replace
a hard drive on a Powerbook?

Brian S

[Kevin]

Don't know if this will help you?

http://www.everymac.com/systems/apple/powerbook_g4/faq/powerbook-g4-how-to-replace-or-upgrade-hard-drive.html

[peterkrogh]

Brian,
It's not that hard to relace drives if you are careful and good with tools.

Are you booting off the system DVD and running the erase?

Peter

[Jon Hawk]

I was surprised you thought it was necessary to use 35 passes to erase your hard drive ; surely 3 or 4 is quite enough ? It's technically possible to read an erased drive after a few passes , but it would take a very skilled (and very expensive ) technician with high powered tools to recover the data - at the rate of approx 1 kB per hour , so you can rest easy for a few years in the meantime .

 Jon

[markpirozzi]

Jon,

The believe original poster stated that he was able to retrieve data with Data Rescue II after a 35 pass erase.

Mark

[peterkrogh]

Yeah, that was certainly Brian's point.
I am interested in how he accomplished the erase.  I'm surprised at his results.
Peter

[Jon Hawk]

Mark

Okay, I understand the OP's outline of his problem , and was just making an off-topic remark about the nature of erasing data - it certainly seems very peculiar that the standard method of erasure isn't working . I would be interested to know why not - surely there can only be something wrong with the way Disk Utility has worked, even though Brian S set it up correctly .

Jon

[rogerhoward]

I'm sorry, but something is wrong with this picture. Either Disk Utility's zeroing is faulty, or the OP simply forgot to enable zeroing and in fact only did a normal format. Let's understand something first:

- When people talk about the ability to recover data from low-level formatted (zeroed) drives, this *requires* specialized equipment which bypasses the host machine and the disk's own controller. This type of recovery is *not* done with off the shelf software through normal hardware controllers.

When your machine instructs a drive to zero a sector, the drive zeroes it in a way that will also be *read* as zeroes the next time. Yes, there may be a latent trace of the signal which may be recoverable with specialized hardware, but *that harddrive's own controller* is *not* going to read anything but what it wrote. If it did, we'd have a terrible time in general since we would never know if what we wrote was then reliably read.

This can lead into a lengthy discussion, but the bottom line is this: when a drive's controller instructs the head to write a value (say, a sequence of zeroes), it should always, under *all* circumstances, read the same sequence of values from that same sector. No matter *what* software is running on the machine. If you want to bypass the controller and analyze latent signals on the disk, this has to be done offline - it's not something a simple application can do.

So bottomline - if you formatted with even a *single* pass of zeroes, no application is going to read any data that has been overwritten. Period. It really sounds to me like either there's a bug in Disk Utility, or there was a fault in the test.

If you do a normal, "quick" format, all you're doing is erasing the directory entries for the filesystem, but not overwriting the data itself - *this* is possible for an app to recover, because the data can still be read by the disk controller (since it never zeroed it out) and a filesystem rebuilt.

think of the drive like a city full of homes. A normal, quick erase would be like throwing out the master map of the city - it can be reconstructed by painstakingly driving down each street and documenting what you find. That's what recovery *apps* do. A full format is like throwing out the map *and* rolling a bulldozer over the entire city. You won't be able to just drive around (as a recovery app) and magically rebuild the city; but perhaps a team of dedicated engineers, archeologists, etc, might be able to reconstruct a decent approximate of what was once there based on latent evidence they find in the resulting dust.

- Roger Howard

[peterkrogh]

Roger,
I was pretty satisfied that this should be the case after talking to the VP at Fujitsu drives. I think there are some issues with the way PCs format drives that could wall off some portion of the drive from being touched, but that Macs should not have this issue (and PCs should not either, depending on how the format was accomplished). 

That's why Brian's post is a surprise. He even indicates that the format took days, as one would expect.  So the question remains, how could he run this, and still recover data from this drive?  Somehow, a 35 pass erase has not resulted in the zeroing of all data.

Any chance that some of this data was written to walled-off bad sectors that the disk utility disregarded, but that the data recovery software actually looked at? Other than that, about the only thing I can imagine is that he was still booted off the drive and chose "erase empty space" instead of a total drive format.

I'll ping Brian, and see what he says.

Peter

[bslanger]

Interesting posts.  I have no conclusion myself other than to try it again.
To recap:  I installed Leopard on a separate FW800 drive (after formatting and zeroing once the FW800 drive).
I updated Leopard on the FW800 drive.  I booted from the FW800 drive.  I formatted the drive on the Powerbook
first.  Then I formatted with a 35 pass of write zeros.  This took days.     

Then I ran the latest version of Data Rescue on the PB, running, if memory serves me correctly, from the PB,
but using the FW800 as the scratch disk, and recovering data to the FW800 drive.  I was careful that I was
only scanning the PB drive.   I then reviewed all the files from the PB, and there were all sorts of files (I don't have
an exact amount, somewhere around 200) individually, and found files, such as Quick Book files, etc, that were
only specific to that Powerbook and the PB's drive.  I was extremely surprised.

I have been experimenting with erasing free space on other drives using disk utility, and then scanning with Data Rescue,
and on some occassions there is still data that was not wiped from the free space.

I have wiped drives with disk utility and some are clean.  This are external drives, USB type.     
I am going to have to try the whole process again.  I also did a 35 pass on my Mac Book Pro, and, there were still files
found from Data Rescue.  These files are also specific to that computer. 

I have been a victim of Identity theft twice now, once through Pay Pal, and once directly to my bank account, so I'd
like to understand this.    I do not remember if I clicked on the top icon for the drive or the bottom icon, and whether
that would make a difference when I orginally did the pass.  However, I find  it curious that I again found files on a 35 pass
erase on my MBP. 

I realize this does not seem feasible.  However, on two Laptops this has been the case.    I may try erasing the data
using Drive Genius, which has a random pass erase, as well as zeros.    I also wonder if I had booted from the Leopard
disk and ran Disk Utility and erased that way, if thing would have been different.   

I'm not a tech guy in understanding how this happened.   At some point, I think I will again zero out the portable FW800 drive,
install Leopard and update it, install Drive Genius on the portable drive, and then boot from the fw800 drive, and run a 3 pass
random wipe with Drive Genius, and try that.

Again, I don't think I am just losing my mind, as the data recovered was only specific to that laptop, the only one in which
I was using Quick Books.

I am open to suggestions.  Does this help?

[bslanger]

I did note one posters mention of a possibility that I ran the erase with just the erase empty space set.
However, I don't believe this to be the case, as surely I would have recovered thousands of files
from the original system info. on the PB, and not just data that was NOT system related, and would
have been stored in folders on the desktop, as well as 'document's' on the system.

I believe I have been very careful in checking the appropriate boxes, as I have been experiementing
with both erasing empty space, and full erases.  Again, data was found on my MBP as well, that
makes me suspect something to do with laptop architecture. (?),

The only sure thing to do would be to repeat everything exactly, erasing using just Disk Utility,
but I am wanting at this point to use Drive Genius, as a new attempt at a clean erase. 

[peterkrogh]

Brian,
Thanks for the update, and the help in tracking this down.
So, to re-iterate,

You bought an external drive, installed OS software and booted off it, and then ran a 35 pass erase on the laptop's existing internal drive, which you were not booted off of. When you ran data rescue on the laptop drive, you found lots of files.

If so, the most likely issue is that the format did not run on the entire drive, rather than some data was left behind after being stomped on 35 times.

If you still have the laptop, it would be interesting to run an experiment or two.  I'd like to see if we can pinpoint where the problem is happening.

Can we try this first:
Open Disk Utility
Select the drive, not the volume
Go to erase
Go to Security options
Select Zero Out data (the one-pass version)
Run the erase

Then try to recover files. Stop the recovery as soon as you find a file, because that means the erase failed, and we should try a second attempt (probably a Partition)

Peter

[bslanger]

Fair enough, I can try that. 
This could all be operator error, but....
to have it happen on two laptops...
still could be operator error.
I will try your test.

[bslanger]

Could there be a difference in the outcome based on selecting
the volume instead of the drive?
Brian S.