Re: [Full-Disclosure] Erasing a hard disk easily

["morning_wood" <se_cur_ity@xxxxxxxxxxx>]

> Since that time I have seen sensationalist TV shows showing how FBI and
CIA
> operatives get stuff out written to a sector BEFORE the sector was
> overwritten and I honestly cannot understand how that could be, if at all
> possible. Am I right in thinking those shows are bull?

simple...

by analizing the magnetics of the disk ....
one write makes 010101 etc
the 0's and 1's are written to the disk by a magnetic manipulation to the
disk
there is a "level" of magnetisim than can be measured
the disk electronics detect this "difference".
lets say a "0" can be between .000 and .010 and a "1" is between .996 and
1.00

when you write again over the data, the magnetic properties of the disk
"rember" slightly the previous write.

now when you analize the disk there is a "ghosting" of the previous data
example...
new data pits "0" =.009 "1"=.999
( ghost pits )  "0"=.003 "1"=.997

the drive electronics will detect the higher magnetic "pits" as actual data
and discard
the data below the new threshold.

recovering the "ghost" data is now trivial by setting the thresholds below
the new data levels..
logic: discard any data over .004 for "0" and .996 for "1"s


this is a very basic example of course but shows how this technique is used.


Donnie Werner

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html