Did the sign change to remind potential suicides to wipe their hard disks before going?

dkellis said:
Did the sign change to remind potential suicides to wipe their hard disks before going?

I think you're right about that... and look! the "Driver" from the previous chapter is there as well. Must be hard times.

Actually formatting a drive won't wipe out much. It just remakes a new empty filesystem, but the old data is still there if you know how to reach it. If you actually want to wipe out you need some more care...

But I guess the idea of the sign is letting people to gain some more time and reconsider their actions. Or maybe it refers to that brand new hard drive you bought some days ago?

Despair! My frugal wife has left me in despair!

Or however it goes...

I realized that I am weak against faces like those... I would immediately give in.

etb said:
Actually formatting a drive won't wipe out much. It just remakes a new empty filesystem, but the old data is still there if you know how to reach it. If you actually want to wipe out you need some more care...

But I guess the idea of the sign is letting people to gain some more time and reconsider their actions. Or maybe it refers to that brand new hard drive you bought some days ago?

Format C:/u

Is it bad that the first thing I thought when I saw the sign was "Don't let everyone see all your weird porn after you die"? I thought that was the entire point, but nobody else seems to have said anything like that in these comments.

And is it even worse if I thought that and have nothing of the sort?

poor, need an a hug and lot food

Illusive said:
Format C:/u

Like etb said, that does not alter the files themselves. All it does is to remove them from the directory. In other words, declare them as non-existent. Until the space is filled with new files, the deleted files are still recoverable.

To completely remove the data, either physically destroy the drive, or write everything bit to zero. This latter take 2-3 hours on a typical hard drive.

unicode said:
Like etb said, that does not alter the files themselves. All it does is to remove them from the directory. In other words, declare them as non-existent. Until the space is filled with new files, the deleted files are still recoverable.

To completely remove the data, either physically destroy the drive, or write everything bit to zero. This latter take 2-3 hours on a typical hard drive.

That's exactly what the /u switch does: low-level format, regardless of the FAT sector markings, it zeros ever sector. Data can still be recovered, but it'll take time and equipment, so don't hide your Osama-correspondence from the CIA with this, but it will put your porn out of reach of regular undelete-unformat software.

unicode said:
Like etb said, that does not alter the files themselves. All it does is to remove them from the directory. In other words, declare them as non-existent. Until the space is filled with new files, the deleted files are still recoverable.

To completely remove the data, either physically destroy the drive, or write everything bit to zero. This latter take 2-3 hours on a typical hard drive.

I prefer the bottom of lakes or the ocean to format my drives.

ThunderBird said:
Data can still be recovered, but it'll take time and equipment

This is a surprisingly common misconception, even in 2011. For spinning-platter hard disks, the probability of recovering any single bit is approximately 56%-- simple statistics takes over at that point. dd if=/dev/zero of=/dev/whatever bs=1. There are a select few high-grade enterprise devices which have the potential to microstep outside of track to potentially read residual overflow bits; using this technique you could theoretically recover a significant amount of data; a few blocks, even. But the odds of these blocks being contiguous and the "correct" 2048 bytes for whatever purpose is quite close to zero.

Newer NAND flash storage devices muddle the waters a little because of the automatic wear-leveling and lack parity between internal and external addressing, but your theoretical maximum is still only about 30% as of this writing. Moreover, even if you remove each of the chips and put them in a reader, you're not usually going to recover much useful because, as mentioned, there is currently no method of knowing how data was reordered for wear-leveling and fragmentation. This fact has made mobile device forensics somewhat difficult recently.

Illusive said:
Format C:/u

Read about a jera34 experience here.
http://www.tomshardware.co.uk/forum/95964-35-format

Seriously, you need `dd if=/dev/zero of=/dev/sdZ*` to be reasonably sure.
*the syntax is probably a little different in windows: something like //Device/...

Nah, a lot of people refer to "erasing HDD" as "formatting", forgetting the original meaning. That's probably the case here, too.

How about an industrial magnet?

BadRoad said:
How about an industrial magnet?

Industrial magnet would work too. But zeroing a drive will cause the data to be irrecoverable.

Truth be told, though, I just like the fireworks when I melt through a drive with a can of thermite.

Honestly, it's pretty entertaining to watch thermite melt through just about anything.

DschingisKhan said:
This is a surprisingly common misconception, even in 2011. For spinning-platter hard disks, the probability of recovering any single bit is approximately 56%-- simple statistics takes over at that point. ...

But it works on CSI and NCIS all the time!

Nilix said:
But it works on CSI and NCIS all the time!

...CSI and NCIS? Forensic science does not work that way. It's hollywood science that they use. Not ALL false, but...well, you get the picture.

Byakugan01 said:
...CSI and NCIS? Forensic science does not work that way. It's hollywood science that they use. Not ALL false, but...well, you get the picture.

Oh yeah?! Well, I'm gonna make a GUI in visual basic to crack your IP Address! Then we'll see who's right!
I can't understand how they can say things that silly with a straight face...

DschingisKhan said:
This is a surprisingly common misconception, even in 2011. For spinning-platter hard disks, the probability of recovering any single bit is approximately 56%-- simple statistics takes over at that point. dd if=/dev/zero of=/dev/whatever bs=1. There are a select few high-grade enterprise devices which have the potential to microstep outside of track to potentially read residual overflow bits; using this technique you could theoretically recover a significant amount of data; a few blocks, even. But the odds of these blocks being contiguous and the "correct" 2048 bytes for whatever purpose is quite close to zero.

Newer NAND flash storage devices muddle the waters a little because of the automatic wear-leveling and lack parity between internal and external addressing, but your theoretical maximum is still only about 30% as of this writing. Moreover, even if you remove each of the chips and put them in a reader, you're not usually going to recover much useful because, as mentioned, there is currently no method of knowing how data was reordered for wear-leveling and fragmentation. This fact has made mobile device forensics somewhat difficult recently.

What I was referring to was the reading of the residual magnetic field after a zeroing, using an atomic force microscope. Due to its sensitivity, it can detect the minuscule field left behind after a write of zeros to a sector, but the field strength decreases rapidly with each subsequent zero write.
That's why I said that if someone needs your data badly enough, they can recover it even after a low-level format. Five passes of zeroing should move the field around enough to eliminate most traces, six passes of alternating zeroes and ones will be an almost definite kill, and the nine passes of zeroes, ones, and random bits should leave no trace of whatever was there in the first place, unless they give it to a clairvoyant machine.
(The alternating 0-1-random passes are actually how the USDOD wipes their HDDs. Or at least how they used to do it a decade or so ago...)

As for flash memory, you're right there: wear leveling moves all the shit around so much there's no telling where a given bit is, or was two seconds ago. They may be able to freeze the bits in place by dunking the chips in liquid nitrogen, but that only preserves the data, it doesn't make it any easier to reconstruct...

ThunderBird said:
What I was referring to was the reading of the residual magnetic field after a zeroing, using an atomic force microscope. Due to its sensitivity, it can detect the minuscule field left behind after a write of zeros to a sector

As I said: the possibility of recovering any single bit is ~56% (Wright, Kleiman and Sundhar, 2008). The Guttmann standard is so outdated at this point it's pretty well pointless. Read that here: www.vidarholen.net/~vidar/overwriting_hard_drive_data.pdf

As for flash memory, you're right there: wear leveling moves all the shit around so much there's no telling where a given bit is, or was two seconds ago. They may be able to freeze the bits in place by dunking the chips in liquid nitrogen, but that only preserves the data, it doesn't make it any easier to reconstruct...

What? First off, most NAND devices in the wild right now use 4kb sectors internally, so there is at least a strong possibility a lot of data is still extant in contiguous chunks, but we have no standards or guarantees about its arrangement. Best we can do is remove the physical chips and put them in a NAND reader. I'm honestly not sure why you're breaking out the liquid nitrogen for this, they're nonvolatile...

To complete what DschingisKhan said I would like to recall why there is still the idea that you need lots of overwrites.

It was true for data on floppy disks that in the yore were fairly common. Nowadays it is not the case anymore.

C-c-c-c-combo breaker!

So, in any case... having to reformat a drive is hardly going to stop me from committing suicide if I still bear enough sense to know that I (and anyone I decide to care about before my death) won't suffer any consequences from what's found in my files after I'm dead, assuming my storage devices are with someone I trust.

DschingisKhan said:
I'm honestly not sure why you're breaking out the liquid nitrogen for this, they're nonvolatile...

Oh fmb, I mixed them up momentarily with RAM chips... -.-'

As for the internal sectors, I've only had to try and dissect only one flash drive before, but that used 512 byte sectors. It turned out better than I expected, the files were largely intact, thanks to using only a quick format. If they accidentally did a full format, I think it would have been pretty much a goner.

As for the study, it made for a rather interesting read, thanks for bringing it to my attention!

Guys, I think the implication is that since you didn't format the drive, the sign is implying that you can recover the data.

I.e. even if there's an error that kills the drive, you can still get your work off it, thus you don't necessarily need to kill yourself if the computer dies.

Considering how tense high school and college entrance exams, and/or final exams can be, losing important data could be enough to trigger a mental BSOD, and lead someone to committing suicide.

And suicide over lost term papers is probably not as rare as one would hope.

I thought it was reminding you to reformat first so no-one finds your shameful secrets.

I was considering that it was a reference to those who have stashed pornography. That's my thought on it. They're called jokes for a reason. Heh heh..., moving on I'm more torwards that.

I think it should be your best friend's responsibility to wipe your browsing history when you die.

Danbooru: How to format your hard drive 101.