Data recovery and destruction are two sides of the same coin. To know when and how you can get your information back, you need to understand how it can be permanently destroyed. And in some situations it is simply necessary: for example, destruction corporate information when disposing of equipment, destruction of your personal data when transferring a disk for use to friends or selling, or maybe you want to delete the history of correspondence with your mistress once and for all;) It is believed that the best data recovery specialists work in the special services, so we formulated the question exactly this way way: how to destroy information from a disk so that it cannot be recovered either by the cops from department “K”, or by Q from James Bond, or even by our specialists from StoreLab.
Destruction of data using software
If you still want to use the hard drive after destroying the data, and are not going anywhere, then you should look towards software methods for deleting data.Full disk rewrite
There are many algorithms for destroying data through a complete disk overwrite. But they all boil down to N-fold formatting and writing binary ones, zeros and pseudo random numbers. Since the disk writing speed usually does not exceed 70 MB/s, armed with a calculator we can calculate how much time we need?The formula is quite simple: Disk capacity (MB) / Write speed * Number of cycles = Seconds;
500000 / 70 * 7 = 50000 (sec.).
From this we can conclude that a 500 GB disk will be “erased” in about 13 hours. But should we use 7 rewrite cycles? Modern storage media do not leave residual magnetization after rewriting data. Therefore, one cycle is enough for us. This means that we will need not 13 hours, but only 1.5.
Operating systems have tools for complete removal files.
Windows:
format c:
Instead of " c:" you must specify the letter of the logical partition.
For Windows Vista and older, previous generations of Windows delete only service information.
Linux:
dd if=/dev/zero of=/dev/sda bs=4k
Instead of " /dev/sda"You must specify the address of the device to format.
Partial data overwrite
Using a direct connection to hard drive at the lower level through Driver API disk or your own driver, you can quickly corrupt information by overwriting data intervals with pseudo-random numbers. By directly specifying the memory address to write to, we do not need to completely rewrite the disk. Also, through the disk driver API, you can get the addresses where information is stored and overwrite only this memory area. This method the most complex in its implementation, but on the other hand, it allows you to quickly destroy only confidential information, while maintaining the functionality of the disk.Working with the driver involves 2 stages. The first is to get the address and length of the data, usually one file is written in different places on the disk, so we will get an array of addresses and an array of lengths. The second step is writing pseudo-random numbers into these memory areas; writing must also be done through the driver, so that the operating system does not block or redirect data writing to another area of the disk.
Destroying data along with the disk
Let's complicate the task: imagine that we do not have time for disk-safe data destruction. In this case, the only thing that can help you is to destroy the disk itself. To be precise, you only need to destroy the pancakes on which the information is recorded.Mechanical data destruction
The picture shows the hard drive after placing it in a hard drive pressurizer (EDR Solutions) .
You can destroy data once and for all if you damage your hard drive. It is difficult and often impossible to recover data from scratched disks; do not forget to keep a screwdriver nearby, because you will have to remove the hard disk cover and it can scratch the hard disk. Naturally, the data will be erased in the places where the scratch was made and adjacent to it. In other places, the data can be recovered in the laboratory. Do not spare your efforts on scratches; light strips will not destroy data even in places where your screwdriver has been. And if you bend the pancake, as shown in the picture, then your data will definitely never be recovered by anyone.
But dropping the disc on the floor won't be enough. Yes, it will not be detected by the computer, but the data will be successfully restored in the laboratory. HDD drive will not survive a fall from the table, and in the off state the safe fall height is greater than when the disk is operating. SSDs were designed with such a case in mind; even a fall from a first or second floor window will not kill the disk. This is achieved due to the fact that the SSD has no moving elements; all actions are performed by the controller. The information can still be read by software or not. programmatically.
Modern discs are made of magnetically coated glass. It is enough to remove the disk cover, pull out the magnetic disk and break it. The glass disc breaks easily, but you should take safety precautions to avoid cutting yourself. A disk failure will lead to the destruction of the entire sputtering layer and it will no longer be possible to restore the data.
Physically
"What doesn't kill us makes us stronger." It would be logical to assume the opposite: what does not make us stronger kills us. From the previous article, you may have learned that cooling the disk negatively affects its performance. But is it possible to kill him like that? By placing your media in the freezer important information, you don't kill him. You have a time bomb in your hands - the disk will work and you can read information from it programmatically. When the disk breaks, all data can be restored without much difficulty in a “clean room”.What do discs think about heating? Among all the disk devices, we are only interested in pancakes. The material that covers the pancake is capable of demagnetization at a temperature of 450 °C. When heated, the magnetic layer should oxidize and become green. Another negative result for the disk, but positive for us, is a temperature of more than 660 °C.
At this temperature, aluminum - the basis of the hard drive pancake - begins to melt. A temperature of 750 °C at home can be obtained from the flame of a candle or a burning match. To achieve maximum temperature, it is necessary to place the flame at the very edge of the pancake.
You can also demagnetize the disk using an electromagnet, acting on the pancake with alternating magnetic field with increasing distance from the magnet to the disk. For such purposes, special equipment “Information destruction devices” was developed. By acting on hard drives with pulses, they completely demagnetize the drive, which makes it impossible to recover any data on it. These devices destroy everything in 2-3 seconds.
Chemically
As you probably already understood, in order to destroy data, you need to destroy the magnetic layer of the hard drive pancake. It is enough to pour any liquid onto the disk that can change the properties of ferromagnets. To change the structure of chromium oxide (the ferromagnet that covers the pancakes of hard drives - the magnetic layer of the disk), you need to pour hydrochloric acid or water on it at a temperature of 100 ° C.What else is important?
- If you do not need long-term storage of confidential data, write it to volatile (random access) memory, then you will not have to worry about destruction.
- Make sure that your data cannot be recovered from other media on which a copy was once recorded.
Sometimes there is a need to completely delete files, i.e. deletion without the possibility of recovery. Let's say you decide to sell hard drive or flash drive. In this situation, I would not want the next owner to be able to restore confidential information that was previously stored on the device. After performing normal formatting, the data can still be restored, we talked about this in.
Therefore, in this video we will look at tools that allow you to permanently delete files.
There are programs that permanently delete files that we specify. But what to do with data that has already been deleted? They cannot be specified in the program! It is for this reason that we will consider cleaning free space. That is, first you delete unnecessary files, run the program and it fills the free space with zeros, from which you can recover data.
This program is called CCleaner. It has become famous as a program that cleans the system and disks of various junk, but it also has a free space cleaning function that interests us. The advantage of CCleaner is that it free version There is also this function, and analogues are paid.
First, download the program from the official website www.piriform.com\CCleaner\Download from PC\Free\Download.
Let's launch CCleaner\Tools\Erase Disks\Erase:
The entire disk (all data will be lost) - in this case, all data from the media will be deleted and overwritten, i.e. analogous to formatting, only without the possibility of data recovery. This method can be applied in a situation if you decide to sell a hard drive or flash drive;
Free space only - only free space is filled with zeros, without affecting the current data. This method can be used when you are selling a computer or laptop. That is, we first delete all confidential information, and then clear the free space so that previously stored data cannot be restored.
There are also several cleaning methods, they differ in the number of passes, i.e. number of rewrite cycles. 7 would be optimal, but if you are expecting a visit from special services, you can set 35 passes.
This process is quite long and depends on the amount of free space on the disk or drive, as well as the number of passes. Therefore, I will not test the effectiveness of this cleaning now, but I can say that after completing the work, I checked in R-Studio and indeed the program could not find anything.
When deciding to clean up a hard drive, users usually use formatting or manual removal files from the Windows Recycle Bin. However, these methods do not guarantee complete erasure of data, and with the help of special tools you can recover files and documents that were previously stored on the HDD.
If you need to completely get rid of important files so that no one else can recover them, standard operating system methods will not help. For these purposes, programs are used to completely delete data, including those deleted by conventional methods.
If files have already been deleted from the HDD, but you want to erase them permanently, then you need to use special software. Such software solutions allow you to erase files in such a way that later they will be impossible to recover even with the help of professional tools.
In short, the principle is as follows:
- You are deleting a file "X"(for example, through the “Trash”), and it disappears from your field of view.
- Physically it remains on the disk, but the cell where it is stored is marked free.
- When new files are written to disk, the cell marked as free is used and the file is overwritten "X" new. If the cell was not used when saving a new file, then the previously deleted file "X" remains on the hard drive.
- After repeatedly overwriting the data on the cell (2-3 times), the initially deleted file "X" finally ceases to exist. If the file takes up more space than one cell, then we're talking about only about the fragment "X".
Therefore, you yourself can delete unnecessary files so that they cannot be restored. To do this, you need to write any other files 2-3 times to all the free space. However, this option is very inconvenient, so users usually prefer software tools that, using more complex mechanisms, do not allow them to recover deleted files.
Method 1: CCleaner
A well-known program designed to clean hard drive from garbage, and also knows how to reliably delete data. At the user's request, you can clear the entire drive or just free space using one of four algorithms. In the second case, all system and user files will remain untouched, but the unoccupied space will be securely erased and inaccessible for restoration.
Method 2: Eraser
Eraser, like CCleaner, is easy and free to use. It can reliably delete files and folders that the user wants to get rid of, and in addition to this, it cleans up free disk space. The user can choose one of 14 deletion algorithms at his discretion.
The program is built into context menu, therefore, by clicking on unnecessary file right click mouse, you can immediately send it for deletion in Eraser. A small minus is the lack of Russian in the interface, however, as a rule, basic knowledge of English is sufficient.
Method 3: File Shredder
The File Shredder program is similar in its operation to the previous one, Eraser. Through it you can also permanently delete unnecessary and confidential data and erase free space on the HDD. The program is built into Explorer and can be called by right-clicking on an unnecessary file.
There are only 5 erasure algorithms here, but this is quite enough to safely delete information.
Note: Despite the fact that use similar programs very simple, this does not guarantee complete data deletion if only part of the disk is overwritten.
For example, if there is a need to permanently delete an image, but the OS has thumbnail display enabled, then simply deleting the file will not help. Knowledgeable person will be able to restore it using , which stores photo thumbnails. A similar situation is with the paging file and other system documents that store copies or sketches of any user data.
Method 4: Multiple formatting
Normal formatting of the hard drive, of course, will not delete any data, but will only hide it. Reliable way delete all data from the hard drive without the possibility of recovery - performing a full format with changing the file system type.
So, if you use the NTFS file system, then you need to complete(not fast) formatting to FAT and then again to NTFS. Additionally, you can mark up the drive by dividing it into several sections. After such manipulations, there is practically no chance of data recovery.
If you have to work with the hard drive where the operating system is installed, then all manipulations must be performed before booting. For this you can use bootable USB flash drive with the OS or a special program for working with disks.
Let's look at the process of multiple full formatting with changing the file system and partitioning the disk.
- Create a bootable USB flash drive with the desired operating system or use an existing one. On our website you can find instructions for creating a bootable flash with,.
- Connect the USB flash drive to your PC and make it the main one boot device via BIOS.
In AMI BIOS: Boot > 1st Boot Priority > Your flash
IN Award BIOS: > Advanced BIOS Features > First Boot Device > Your flash
Click F10 and then "Y" to save settings.
- Before Windows installation 7 click on the link "System Restore".
In Windows 7 you are taken to "System Recovery Options", where you need to select the item "Command line".
Before installing Windows 8 or 10, also click on the link "System Restore".
- From the recovery menu, select "Troubleshooting".
- Then "Advanced options".
- Select "Command line".
- The system may prompt you to select a profile and also enter a password for it. If the password is account not installed, skip input and press "Continue".
- If you need to find out the real letter of the drive (provided that several HDDs are installed, or you only need to format the partition), enter the command in cmd
wmic logicaldisk get deviceid, volumename, size, description
and press Enter.
- Based on the size (in the table it is in bytes), you can determine which letter of the desired volume/partition is real and not assigned by the operating system. This will protect you from accidentally formatting the wrong drive.
- For complete formatting with changing the file system, write the command
format /FS:FAT32 X: - if your hard drive currently has file system NTFS
format /FS:NTFS X: - if your hard drive currently has a FAT32 file system
Instead of X Substitute the letter of your drive.
Do not add a parameter to the command /q- it is responsible for quick formatting, after which file recovery can still be done. You only need to do a complete formatting!
- After formatting is complete, write the command from the previous step again, only with a different file system. That is, the formatting chain should be like this:
NTFS > FAT32 > NTFS
FAT32 > NTFS > FAT32
After this, the installation of the system can be canceled or continued.
Recently I received a question in the mail: “How to delete all files from a flash drive so that it cannot be recovered by any means?” The question is, of course, an interesting one. In principle, there are many options, it all depends on the goals and the required reliability...
In the majority household cases, both from a flash drive and from hard drives you can delete information complete formatting (but NOT "quick formatting", which only removes the disc's table of contents and leaves all files untouched). This is quite suitable if you are going to give a flash drive that you used to a friend or sell it unnecessary hard a disk where various rubbish used to be kept. The likelihood that intelligence agencies who will recover data using special equipment will be interested in these drives is negligible...))
However, if you have a persecution mania, or you need to delete information of truly national importance, for example, photos of a friend or data on your accounts in a Swiss bank, then you will have to use programs tailored for this purpose, which are called “shredders” (by analogy with office “destroyers” of paper documents ).
There are quite a lot of shredder programs, including free ones. However, even here everything depends on the size of your mania or the value of the documents - if you don’t trust free programs, use paid ones. 😎
Let's consider representatives from both groups.
Good Doctor Shredder from the Eraser HDD program
The simplest, and, as its author claims, the most reliable program, is the program. This is a program for completely destroying information on a disk without the possibility of recovery. It takes up only 56 kilobytes and does not require installation (that is, it can be run from either a hard drive or a flash drive). We look at the program website.
The program ensures reliable destruction of all data on a user-specified hard drive or flash drive without the possibility of further recovery of the information that was located there. The program sequentially writes hexadecimal zeros into disk sectors, thereby completely overwriting all files on the disk. This procedure corresponds Russian standard GOST R50739-95 and generally ensures reliable data destruction (although Western standards state the opposite, see below).
By the way, the author of the program (who, moreover, is professionally involved in recovering information from various media) states that currently no laboratory in the world has no funds for recover overwritten data. In principle, all free shredder programs work on exactly the same principle, so you have to believe it.
By the way, a program that destroys data on the entire surface physical disk, there are brothers:
- Eraser LogDisk— a program for guaranteed destruction of all data on logical drive, i.e. for example only disk D: without deleting information on the disk WITH:
- Eraser Free Space- program for safe deleting files without the possibility of their recovery, i.e. overwrite only free space on disk
All programs by this author have a Russian interface and are easy to use. The speed of work depends on the size of the surface being cleaned, because... the program should rewrite all sectors on the hard drive, which is equivalent to the write speed large file the size of your hard drive.
For example, if you want to clean a 500 gigabyte hard drive, then the program should write 500 gigabytes of zeros! Therefore, you are guaranteed a few hours of waiting. What can we say about paid programs which use more complex algorithms Western standards, providing 3, 7 and even 35 times(Peter Gutman method) surface overwriting!!!
We will not list all Western standards for information destruction, because... the most common is the US Department of Defense standard DoD(U.S. Department of Defense), according to which the data is rewritten 3 times with different numerical sequences. This method is acceptable for destroying the most important data, after which even the CIA will not be able to unravel your secrets.
Program for secure destruction of information from O&O SafeErase 5 disks
One of best programs, which will help you securely destroy all your confidential information is Safe Erase 5. It can destroy all data from the disk any of 6 methods, including paranoid 35-fold overwriting! The program has only an English interface, works under any version of Win XP, Vista and Win 7 and takes up 35 MB. Full version costs 29.95 USD, which, in principle, is not very expensive for state secrets. 😀
The topic of today's article is somewhat unusual. Today we will talk about how to permanently destroy data. Destroy so that they cannot be restored even with the help special programs or research hardware systems.
Content:
Deleting a file is not enough
Regular readers of our site already know that simply deleting a file is completely insufficient from the point of view information security. Deleted files (with rare exceptions in the form of SSD drives) can be restored within just a few minutes. This is due to the fact that when deleting a file, Windows does not destroy its contents, but simply makes a note in the file system that the file has been deleted and the disk space it occupies is free. Respectively, deleted file can be restored using easy-to-use tools - for example, Hetman Uneraser.
Disk formatting
The very fact of the existence of tools like Hetman Partition Recovery, is a good indicator that formatted partitions are far from a guarantee of data security. In fact, with the exception of the same SSD drives, formatting a partition in “fast” mode (and in older Windows versions– and formatting in “full” mode) does not erase data, but only resets the file system. Accordingly, data after such formatting can be restored.
However, it should be noted that full disk formatting using Windows Vista and Windows 7 will still overwrite the contents of the disk with zeros, and formatting an SSD disk in any way will most likely (but not one hundred percent) also lead to the destruction of data.
Data destruction programs
There is a whole class of programs designed for reliable and safe destruction of information. Such programs use arrays of random numbers to physically overwrite the disk space occupied by the file being destroyed. Some security standards (such as those used by the US Army) require multiple rewrite cycles and insist on the use of cryptographically strong random number generators. In practice, it's more like shooting sparrows from a cannon. For private users and most commercial organizations, a single rewrite cycle will be enough.
Finding such a program is easy - just run a search by keywords"secure file deletion". Free disk space is erased in a similar way - even the same programs are often used.
It should be noted that these methods only work with traditional magnetic drives, in which unambiguous addressing of the physical space on the disk is possible. In the case of SSD drives, this is not the case, and the destruction of information on them is a separate and rather little-researched topic.
Destroying data on CDs and DVDs
Getting rid of old ones backup copies, do not forget to destroy the data. The most in a simple way destroying information on a CD or DVD means physically destroying the media. Do not give in to the temptation to break the “blank” with your hands - you will most likely cut yourself with fragments, and small fragments of plastic and aluminum substrate will be found in the most unexpected places for a long time.
The easiest way to destroy disks is to use an office shredder equipped with a CD and DVD receiver. In addition to them, there are also specialized devices - by the way, they are not at all as expensive as one might think. For most purposes, it is normal to cut the disc into four strips.
There are also devices that render disks unusable by drilling several holes in them (by the way, you can make holes in the disk yourself using a regular drill). Experts consider this method less reliable compared to using a shredder.
Separately, it is worth mentioning the manufacturers of secure information storage devices. DataTraveler and Silicon Power offer USB or hard drives, which store information in encrypted form. To destroy access to the data of such devices, it is enough to delete the decryption key. Hard drive data recovery software will not be able to decrypt the contents and will be absolutely useless.
We can also mention the heating of the disks, leading to the destruction of the translucent information layer. Like other methods, this method should only be used in specialized devices– overheated “blanks” can quickly melt.
