Hi Hemmann,, on Sunday, 2005-10-30 at 19:05:20, you wrote: > > Oh, no doubt that they can recover from burned platters. > > But have you ever seen, that they can recover overwritten > > data? > > not seen, but read about it. They can recover overwritten data.
Maybe those overwritten once with a simple pattern. Not after a dozen
times with random bits, no way.
> > I've only heard the opposite - that they CANNOT do that.
>
> maybe you should ask one of the forensic/data saving companies that do this
> all day.
They don't.
> Recovering overwritten data is as easy as recovering from damaged drives.
>
> Basically, you need a very, very sensitive magnetic coil ;)
If you've ever seen the noisy output of a regular coil reading regular
data you start wondering how it comes out the same error-free sequence
in the first place. Recovering data from damaged drives isn't exactly
easy either, but they're still on the platters. Finding an overwritten
signal under several others is magnitues harder.
On the original question: for wiping free space, a repeated
dd if=/dev/urandom of=/path/to/file bs=4096
should be suffcicient, if slow.
To just wipe unused data to reduce the sice of a compressed image, I do
the same with /dev/zero. It fills the whole partition with a file full
of zeroes that you can remove afterwards. It's not quite as efficient as
really zeroing all free blocks but it works on every FS and should even
be unaffected by journaling.
regards
Matthias
--
I prefer encrypted and signed messages. KeyID: 90CF8389
Fingerprint: 8E1F 1081 A466 2946 B98A B9E2 099F 3B91
pgpvCh1OIG879.pgp
Description: PGP signature
