Paul,

> 2) Once you have the media prepared for a bare metal restore/factory
> recover, *physically erase the drive*.

And there is wher a problem slips in : the nowerdays SSD drives themselves
move sectors around on the media for wear-and-tear purposes. IOW, the
written data might well *not* overwrite the existing data.

Do you know what, in that case, happens with the old data ? Does it just
stay there until its overwritten by a next wear-and-tear move of another
sector, or does it get erased after its data is moved elsewehere ?

IOW, is it actually possible, for the common Joe User, to securely erase an
SDD (without spectaculary shorthening its life I mean) ?

Regards,
Rudy Wieser

On 27/11/2023 15:45, jason_warren@ieee.org wrote:
> What's the best way to clean everything off a hard drive
> before I return it to Dell?
>
> Will a low-level format do it or is there something better>
> The drive has five partitions.
>

Best way? Dunno, that's subjective.

Darik's Boot and Nuke (DBAN)
- https://sourceforge.net/projects/dban/

Beware! It will wipe all drives it finds so disconnect or remove any
that you don't need wiped.

--
Regards
wasbit

On 2023-11-28 05:40, Paul wrote:
> On 11/27/2023 2:09 PM, Ed Cryer wrote:

> 2) Once you have the media prepared for a bare metal restore/factory recover,
> *physically erase the drive*. This is important. Some
> of the other respondents have mentioned some methods to do this.
> A method in past years, was DBAN (single pass mode is OK).
>
> 3) Now, the disk is clean as a whistle (absolutely nothing on it).

There will still be the SMART logs :-p

--
Cheers,
Carlos E.R.

On 2023-11-28 08:12, R.Wieser wrote:
> Paul,
>
>> 2) Once you have the media prepared for a bare metal restore/factory
>> recover, *physically erase the drive*.
>
> And there is wher a problem slips in : the nowerdays SSD drives themselves
> move sectors around on the media for wear-and-tear purposes. IOW, the
> written data might well *not* overwrite the existing data.
>
> Do you know what, in that case, happens with the old data ? Does it just
> stay there until its overwritten by a next wear-and-tear move of another
> sector, or does it get erased after its data is moved elsewehere ?
>
> IOW, is it actually possible, for the common Joe User, to securely erase an
> SDD (without spectaculary shorthening its life I mean) ?

The ATA Secure Erase should clear it all, but it is up to the
manufacturer to have done a good firmware.

--
Cheers,
Carlos E.R.

On 2023-11-28 02:43, VanguardLH wrote:
> T <T@invalid.invalid> wrote:
>
>> And keep in mind, if the bad guys are well funded, they'd
>> just breaking your house and steal your whole computer.
>
> Nah, they'd just clone the drive and leave. You'd never know they were
> there until you received a court appearance order for all those
> instructions on how to build WMDs.

"Just clone". This operation takes HOURS.

And they have to reboot the machine to external media to use their
software, that leaves a trace.

It is not like in the movies :-p

--
Cheers,
Carlos E.R.

On 2023-11-28 07:10, Paul wrote:
> On 11/27/2023 8:45 PM, Carlos E. R. wrote:
>
>> There are suspicions that a lab could read residual magnetism on the sides of a track,
>> but nobody with that sort of knowledge has clarified the doubt in any direction.
>> So there was software what would overwrite them several times with several patterns,
>> just in case it was really possible.
>
> Modern drives use vertical recording. If you find
> an MFM picture of a vertical recording platter,
> it's "black" between tracks. There is no indication
> of a fringing field.
>
> In vertical recording, there is a keeper layer below
> the plating stack. The recorded bits are vertical ovals.
> The keeper layer is the bottom boundary of the magnetic
> circuit
>
> On the old drives, recording was longitudinal, on the
> surface of the platter. There is still a plating stack
> there, but no need for a keeper layer. Longitudinal
> recording had more obvious fringes.
>
> Some of the thoughts on the topics from the old
> days, are addressed here.
>
> https://en.wikipedia.org/wiki/Gutmann_method

Marked for reading later :-)

>
> The modern Secure Erase pattern, is single pass.
> The drive does not do 35 passes for Secure Erase.
> The time to Secure Erase a drive, is pretty well
> identical to the time to write from end to end.
> Secure Erase or Enhanced Secure Erase, attempt
> to "write everything if they can". (The sparing
> sector area is erased too.) If you wanted to emulate
> 35-passes, you could always execute Secure Erase
> 35 times, but that would be silly.

On an SSD, instead of writing zeros they might tell each sector to erase
itself, even those sectors that are mapped out or reserved. Maybe not
those reserved for the SMART log.

I had no chance yet to secure erase an SSD, to see how long it takes.

>
> Governments with "Top Secret" class hard drives,
> do not take chances, and they use a mechanical
> shredder to ensure all the magnetic media is
> bent to some degree.

Normal people with a bit of paranoia just use full encryption :-)

> An MFM is only good on
> perfectly flat media (media which is as flat as
> it was when it was written). The forces are measured
> on the Z-axis, at the nanometer level. You would
> think any curvature to a sample, would cause a problem.
> A typical X-Y scanning area for an MFM, is 100u x 100u
> (microns). There are something like 1200 MFMs, in places
> like university labs. The grad students, hardly ever
> seem to be sticking disk platters in their machines :-)
> For one thing, there isn't a positioner with a 3.5"
> displacement, inside the machine. If you wanted to
> scan a platter, you'd have to add some kit to the machine.
> The tempco of the platter, could easily degrade
> attempts to push a platter around to a 3.5" limit.

The "agencies" might have purpose made microscopes :-p

--
Cheers,
Carlos E.R.

On 2023-11-28 02:51, Paul wrote:

....

> While this is tempting as a partial proof, it's also silly.
>
> dd if=/dev/sda bs=221184 | sum # Would return 0000 given a chance.
> # If nonzero, there is a screwup.
> # But this takes too long to be a useful idea.

Why that particular size (bs)? :-)

I would think of using 10 megs or so.

--
Cheers,
Carlos E.R.

Carlos,

> The ATA Secure Erase should clear it all

Ah, yes. That solves the problem, just let the drive itself (and not the
OS) handle it.

> but it is up to the manufacturer to have done a good firmware.

Good for whom ? :-)

Regards,
Rudy Wieser

On 2023-11-28 03:09, T wrote:
> On 11/27/23 17:38, Carlos E. R. wrote:
>>> Carlos,
>>>
>>> Are you old enough to remember the 10 MB Miniscratch
>>> drives?
>>>
>>> Man they were loud when they failed!  Fingernails
>>> down a chalk board on steroids.
>>
>> I'm guessing what you mean, but no, I never met those.
>
> The dark side of MiniScratch (MiniScribe):
>
> https://www.gillware.com/hard-drive-data-recovery/the-first-hard-drive-to-brick/

:-D

--
Cheers,
Carlos E.R.

Paul wrote:
> On 11/27/2023 2:09 PM, Ed Cryer wrote:
>> jason_warren@ieee.org wrote:
>>> What's the best way to clean everything off a hard drive
>>> before I return it to Dell?
>>>
>>> Will a low-level format do it or is there something better>
>>> The drive has five partitions.
>>>
>>> Thanks!
>>>
>>
>> Just do a factory reset.
>> Settings, System, Recovery, Reset PC, Remove Everything, and make sure you select the Clean the drive option to ensure everything gets deleted.
>>
>> Oh, and don't listen too closely to the discussions of Win10 chummies. They're far more interested in the internal philosophy of matters concerned than the practical task you've raised.
>>
>> Ed
>>
>
> Sorry Ed, this is still wrong.
>
> You method has merit IFF:
>
> 1) You make recovery media, like the DVD set that
> PCs used to make. Today, they do not typically
> make those DVD sets. An alternative today, is to
> make Retail media using the downloaded Microsoft ISO.
> This leaves your Dell with something the staff can boot,
> to prove no damage to the hardware. But the staff will
> still have to do a factory-restore, using their own media.
> The staff are not allowed to trust that the customer
> did a good job.
>
> 2) Once you have the media prepared for a bare metal restore/factory recover,
> *physically erase the drive*. This is important. Some
> of the other respondents have mentioned some methods to do this.
> A method in past years, was DBAN (single pass mode is OK).
>
> 3) Now, the disk is clean as a whistle (absolutely nothing on it).
> Now do the factory restore, using the optical media. It is
> at this point, it is now *truly* in factory state. Any white spaces
> on the drive at this point, contain all-zeros, and none of your
> passwords or banking info, are on the disk.
>
> It's the white spaces on the drive, after the factory restore,
> that your method misses. This is why step (2) is important.
>
> Doing a factory on-disk only (no optical media goes into the tray),
> guarantees your personal details are left all over the place. Not good.
>
> There are people who REVEL in recovering left behind customer info.
> They don't generally do it for a profit motive, but
> they like to make an example out of people who
> don't do a good job.
>
> Even on methods that are supposed to work, I've tested
> them and GOD DAMN if they still didn't leak. I got around
> 200 hits in a hex editor, for my test pattern, after
> a method was used that was supposed to remove the stuff,
> didn't work as well as expected. That's 200 file chunks
> that should not have been there.
>
> This is why some of the answers are extreme -- the participants
> want to make sure there are no leaks. A Dell or HP returns
> specialist, will have materials to redo the disk anyway, so
> it's not a problem if it arrives completely blank. It's convenient
> if it boots into something, but not absolutely necessary.
> Perhaps for factory/warehouse security reasons, they
> don't allow any "customer-boots" to occur, and instead
> just wipe everything the same way. A customer for example,
> could leave a malware on the hard drive.
>
> Paul

It strikes me, having read the comments in this thread, that I'll just
simply remove the drives if I ever have to return a box. Then I'll
hammer them into complete unusability.

I remember once seeing a YouTube video where a man took a blowtorch to
an old spinner; melted all the surface coating and then buckled the disks.

Ed

Hello

T <T@invalid.invalid> schrieb

>On 11/27/23 13:50, Shinji Ikari wrote:
>> "jason_warren@ieee.org" <jason_warren@ieee.org> schrieb
>> If you want to return a functioning drive to the seller/manufacturerer
>> and you are afraid they have in this time and age the time and money
>> to look for your Vacationpictures, then overwirte it.
>> HDTunepro erase with random numbers, or dariks boot and nuke, or other
>> tools provide the feature to overwrite the complete disk with random
>> or special patterns.
>> Even windows diskpart command 'clean' can overwrite the whole disk
>> (with zeros).
>>
>> If you are afraid someone like NSA or so wants to see you
>> Vacationpictures: some tools provide further methods to overwrite
>> multiple times with special patterns....
>>
>> But all of that takes time!
>> 22TB 3.5 inch HDD overwrite one time= 26 to 28 hours.
>If you overwrite the entire drive with zeros, everything
>on it is toast.

If I remember it correctly: i did says this with other words.

>And you

_I_ do not need any of this.
_I_ answered to the op.
_I_ use encryption and Raid.

>And keep in mind, if the bad guys are well funded, they'd
>just breaking your house and steal your whole computer.

Well they only do that: they have to invest lots of time to crack the
encryption. And they would have to bring a small forklifter, since the
Computers with relevant Data weight around 60 to 100 kg. Thats why I
use a lifting table with weels to haul it around, when needed.

Hello.

VanguardLH <V@nguard.LH> schrieb

>T <T@invalid.invalid> wrote:
>> And keep in mind, if the bad guys are well funded, they'd
>> just breaking your house and steal your whole computer.
>Nah, they'd just clone the drive and leave.

Okay, when they bring around 100 TB in one drive(set) they may able to
clone my smallest Diskarray. But since a 22TB HDD needs around
26-28hrs to overwrite, They will need at least around one or two days
to clone that Array. I guess I will see them, when they try this. 8)

On 11/28/2023 6:59 AM, R.Wieser wrote:
> Carlos,
>
>> The ATA Secure Erase should clear it all
>
> Ah, yes. That solves the problem, just let the drive itself (and not the
> OS) handle it.
>
>> but it is up to the manufacturer to have done a good firmware.
>
> Good for whom ? :-)
>
> Regards,
> Rudy Wieser
>

the Enhanced Secure Erase command is the best one for that.
It should erase any "pools" you can't see.

The Secure Erase is good enough for casual security, Enhanced Secure Erase
is for your police department :-)

If you Secure Erase, examination in a Hex Editor should be clear
to the naked eye. Enhanced Secure Erase is for cases where you
think the drive may be manipulated in some way, to uncover
spares or something.

Exactly why they have two commands, is the question we should
be asking. There really should have only been one command. It's
something Yoda would have commented upon.

Paul

Ed Cryer <ed@somewhere.in.the.uk> wrote:
[...]
> It strikes me, having read the comments in this thread, that I'll just
> simply remove the drives if I ever have to return a box. Then I'll
> hammer them into complete unusability.
>
> I remember once seeing a YouTube video where a man took a blowtorch to
> an old spinner; melted all the surface coating and then buckled the disks.

For some of my old disks (all 2.5"), I opened them and broke the
platters. Then I closed them again and brought them to our electro-waste
disposal.

Only a few weeks ago, I did the same for a relative's Mac disk. For
some strange reason, that was even more satisfying than normally.

On 11/28/2023 7:40 AM, Ed Cryer wrote:
> Paul wrote:
>> On 11/27/2023 2:09 PM, Ed Cryer wrote:
>>> jason_warren@ieee.org wrote:
>>>> What's the best way to clean everything off a hard drive
>>>> before I return it to Dell?
>>>>
>>>> Will a low-level format do it or is there something better>
>>>> The drive has five partitions.
>>>>
>>>> Thanks!
>>>>
>>>
>>> Just do a factory reset.
>>> Settings, System, Recovery, Reset PC, Remove Everything, and make sure you select the Clean the drive option to ensure everything gets deleted.
>>>
>>> Oh, and don't listen too closely to the discussions of Win10 chummies. They're far more interested in the internal philosophy of matters concerned than the practical task you've raised.
>>>
>>> Ed
>>>
>>
>> Sorry Ed, this is still wrong.
>>
>> You method has merit IFF:
>>
>> 1) You make recovery media, like the DVD set that
>>     PCs used to make. Today, they do not typically
>>     make those DVD sets. An alternative today, is to
>>     make Retail media using the downloaded Microsoft ISO.
>>     This leaves your Dell with something the staff can boot,
>>     to prove no damage to the hardware. But the staff will
>>     still have to do a factory-restore, using their own media.
>>     The staff are not allowed to trust that the customer
>>     did a good job.
>>
>> 2) Once you have the media prepared for a bare metal restore/factory recover,
>>     *physically erase the drive*. This is important. Some
>>     of the other respondents have mentioned some methods to do this.
>>     A method in past years, was DBAN (single pass mode is OK).
>>
>> 3) Now, the disk is clean as a whistle (absolutely nothing on it).
>>     Now do the factory restore, using the optical media. It is
>>     at this point, it is now *truly* in factory state. Any white spaces
>>     on the drive at this point, contain all-zeros, and none of your
>>     passwords or banking info, are on the disk.
>>
>>     It's the white spaces on the drive, after the factory restore,
>>     that your method misses. This is why step (2) is important.
>>
>> Doing a factory on-disk only (no optical media goes into the tray),
>> guarantees your personal details are left all over the place. Not good.
>>
>> There are people who REVEL in recovering left behind customer info.
>> They don't generally do it for a profit motive, but
>> they like to make an example out of people who
>> don't do a good job.
>>
>> Even on methods that are supposed to work, I've tested
>> them and GOD DAMN if they still didn't leak. I got around
>> 200 hits in a hex editor, for my test pattern, after
>> a method was used that was supposed to remove the stuff,
>> didn't work as well as expected. That's 200 file chunks
>> that should not have been there.
>>
>> This is why some of the answers are extreme -- the participants
>> want to make sure there are no leaks. A Dell or HP returns
>> specialist, will have materials to redo the disk anyway, so
>> it's not a problem if it arrives completely blank. It's convenient
>> if it boots into something, but not absolutely necessary.
>> Perhaps for factory/warehouse security reasons, they
>> don't allow any "customer-boots" to occur, and instead
>> just wipe everything the same way. A customer for example,
>> could leave a malware on the hard drive.
>>
>>     Paul
>
> It strikes me, having read the comments in this thread, that I'll just simply remove the drives if I ever have to return a box. Then I'll hammer them into complete unusability.
>
> I remember once seeing a YouTube video where a man took a blowtorch to an old spinner; melted all the surface coating and then buckled the disks.
>
> Ed

The message is, storage devices are persistent beasts,
and our job is to be thorough. This is why governments,
for rotating hard drives, don't use a "magnet", they
use a mechanical shredder. It grinds up the milled chassis
and all. And you must examine and verify your shredder
is working once in a while (with the power cable unplugged).

I might save my Notes.txt file multiple times a day.
If I were to scan the disk, and see how many occurrences
of a unique key phrase are in there, I might find 50-100
copies in white space on the disk. If I use Sysinternals
SDelete, I might get some of them. But it might not get
all of them. Theoretically it should have worked...

And this is why we test. Never assume anything.

The nice thing about rotating hard drives, is if
an operation does not take enough time, then you know
for sure it wasn't thorough. If it takes five hours
to write a drive, that clever command you use that finishes
after ten minutes, couldn't possibly have done the job.
And that includes any observations about "I restored
with Macrium, over top". Of course that doesn't clean
a disk, because your restore only took ten minutes, and
did not take five hours. You have to be using your
mental "reasonable test" of these things, to avoid
getting snowed by the glossy tech.

There are crypt tricks, for devices using FDE,
and that can achieve a result a lot faster.
FDE is even available for hard drives. Now,
how many "issues" have been discovered with FDE...
A government spy would not rely on an FDE-based
erasure for her security, because of the track
record of FDE so far.

The message here is not one of paranoia, it's that
cleaning disks is a tricky business, and only
thorough people are thorough. Casual people are
just too smug for the work. I wouldn't be suited
to the job, because I'm just.. too.. lazy.. :-)

Paul

On 11/27/2023 2:13 PM, VanguardLH wrote:
> "jason_warren@ieee.org" <jason_warren@ieee.org> wrote:
>
>> What's the best way to clean everything off a hard drive
>> before I return it to Dell?
>>
>> Will a low-level format do it or is there something better>
>> The drive has five partitions.
>
> I'm confused. If you are returning a hard drive to Dell, doesn't that
> mean it is defective, and why you are returning it? If the drive is
> defective, likely you cannot completely wipe the drive.

I think he is returning a new computer after a short usage
period, because it isn't working out. The machine is still
functional, and it's a matter of sanitizing before return.

If I'm buying a new Dell, my sequence is like this:

1) Boot Macrium CD, do a Full Backup to external drive.
This records the disk in the "As Received" state.
Do this from the CD, so you do not disturb the OOBE state.

2) Use the computer...

3) Thoroughly erase drive as preparation for return.
Then, restore the backup image from (1) as a convenience for Dell staff.
The erasure step, ensures white space got covered.
You can use DBAN for the erasure step if you want, or Secure Erase.

But this all assumes you did (1).

Paul

On 2023-11-28 17:18, Paul wrote:
> On 11/28/2023 6:59 AM, R.Wieser wrote:
>> Carlos,
>>
>>> The ATA Secure Erase should clear it all
>>
>> Ah, yes. That solves the problem, just let the drive itself (and not the
>> OS) handle it.
>>
>>> but it is up to the manufacturer to have done a good firmware.
>>
>> Good for whom ? :-)
>>
>> Regards,
>> Rudy Wieser
>>
>
> the Enhanced Secure Erase command is the best one for that.
> It should erase any "pools" you can't see.
>
> The Secure Erase is good enough for casual security, Enhanced Secure Erase
> is for your police department :-)
>
> If you Secure Erase, examination in a Hex Editor should be clear
> to the naked eye. Enhanced Secure Erase is for cases where you
> think the drive may be manipulated in some way, to uncover
> spares or something.
>
> Exactly why they have two commands, is the question we should
> be asking. There really should have only been one command. It's
> something Yoda would have commented upon.

<https://security.stackexchange.com/questions/62253/what-is-the-difference-between-ata-secure-erase-and-security-erase-how-can-i-en>

«As quoted from this page:»

So I go to that page.

<https://tinyapps.org/docs/wipe_drives_hdparm.html>

«If your drive supports enhanced erase, you may want to substitute
security-erase-enhanced for security-erase. The difference, according to
the HDDerase.exe FAQ:

Secure erase overwrites all user data areas with binary zeroes.
Enhanced secure erase writes predetermined data patterns (set by the
manufacturer) to all user data areas, including sectors that are no
longer in use due to reallocation. ***NOTE: the enhanced secure erase
option is not supported by all ATA drives.»

<https://web.archive.org/web/20110222015452/http://cmrr.ucsd.edu/people/Hughes/HDDEraseReadMe.txt>

«HDDerase.exe menu
1: Secure Erase
This uses the ATA internal drive secure erase command. It offers a
higher level of secure erase than block overwriting software utilities.
It can take 30 to 180 minutes depending on the drive’s capacity and
speed. Drive will be left unlocked and ready for use once the process
has successfully completed.

2: Enhanced Secure Erase (if supported by the drive)
An optional ATA internal drive secure erase command. Drive will be left
unlocked and ready for use once the process has successfully completed.
Not all ATA drives support this erase method and if it does not, then
you will not be given this option.»

....

«Q: What is the difference between secure erase and enhanced secure erase?

A: Secure erase overwrites all user data areas with binary zeroes.
Enhanced secure erase writes predetermined data patterns (set by the
manufacturer) to all user data areas, including sectors that are no
longer in use due to reallocation. ***NOTE: the enhanced secure erase
option is not supported by all ATA drives.»

....

«Q: What are HPA and DCO areas?

A: HPA is an acronym for Host Protected Area. A HPA is a portion of
sectors at the end of the hard drive that can not be addressed by the
user. Normally this area is used to store hard drive diagnostic or
recovery type software, but any type of data may reside in this area.
DCO is an acronym for Device Configuration Overlay. Similar to a HPA, a
DCO represents a portion at the end of the hard drive that is not user
addressable. Both these areas are NOT overwritten when a windows
format, secure/enhanced erase, or any other overwrite method is
performed. In order for these areas to be erased they have to be first
removed, and only then can the entire drive be erased (see the following
question).
***Note: In our testing some drives overwrite the HPA when a secure
erase is performed, but most drives do not erase this area when a secure
erase isperformed. CMRR contends that HPA erasure is not mandatory
because user data is not stored there; however HDDerase offers erasure
of both areas for maximum erase security.

Q: Can hdderase.exe erase the host protected area (HPA) or the device
configuration overlay area (DCO)?

A: Yes. A message will appear if a HPA and/or DCO exist(s) on the
selected drive and prompt the user if he/she wants the areas to be
erased. Accepting removes the HPA and/or DCO via set max address (ext)
and device configuration restore commands, respectively. A subsequent
secure erase will then erase the entire drive. Declining leaves the HPA
and/or DCO intact, and a subsequent secure erase may or may not erase
over the HPA/DCO, depending on the manufacturer. CMRR Secure Erase
protocol requires erasure only of all user-accesible records. If your
drive is locked by a non-HDDerase password and if either option 3, 4, 5,
or 6 is chosen, then the HPA and/or DCO will NOT be detected or reset.
***Note: the device configuration restore command disables ANY settings
previously made by a device configuration set command--thereby placing
the drive in its factory default state.»

I also found out that some software sets the security password when
doing this:

«The GNOME Disks app offers an ATA Secure Erase option in the Format
Disk menu. But if it fails to complete, how to unlock the drive? The
password does not appear to be documented; happily, Babiz tracked it
down by finding udisksd[1206] Commencing ATA enhanced secure erase in
/var/log/daemon.log (and system.log) then searching the UDisks source
code for "user password", which uncovered it in udiskslinuxdriveata.c as
"xxxx". Thus, hdparm --security-disable xxxx /dev/sdx will unlock the
drive.»

Wow. It is the first time I found this information, and it was hidden in
some ancient software...

--
Cheers,
Carlos E.R.

On 11/28/2023 6:36 AM, Carlos E. R. wrote:

>
> The "agencies" might have purpose made microscopes :-p
>

This is true.

There was a time, in silicon development, when researchers
used to paint liquid crystals on top of a silicon die,
and the electrical signals on the top of the die (not the
ones inside it) would cause the liquid crystal to change state.
And I'm told you could determine nodal states by doing that.

We cannot discount some technique which is not normally used.

What we have working on our side, is the shrinking feature
size of storage, and how much harder it is now, to examine
the smallest detail. An MFM can still read a platter, but it's
getting down to the practical limits of the MFM (perhaps 2nm or so).
The flying height now is (according to patent filings) 3nm or so.
And Hitachi, as a lab test, did try flying a head at 0nm,
and it took a month, to grind the head off it :-) They still
haven't hit a limit yet, on the size of a stored magnetic bit.
A slightly larger drive, just came out. We may eventually
reach a condition, where only a moving platter can be read,
and the instruments can't do it reliably on static specimens.

Paul

On 2023-11-28 18:00, Paul wrote:
> On 11/27/2023 2:13 PM, VanguardLH wrote:
>> "jason_warren@ieee.org" <jason_warren@ieee.org> wrote:
>>
>>> What's the best way to clean everything off a hard drive
>>> before I return it to Dell?
>>>
>>> Will a low-level format do it or is there something better>
>>> The drive has five partitions.
>>
>> I'm confused. If you are returning a hard drive to Dell, doesn't that
>> mean it is defective, and why you are returning it? If the drive is
>> defective, likely you cannot completely wipe the drive.
>
> I think he is returning a new computer after a short usage
> period, because it isn't working out. The machine is still
> functional, and it's a matter of sanitizing before return.
>
> If I'm buying a new Dell, my sequence is like this:
>
> 1) Boot Macrium CD, do a Full Backup to external drive.
> This records the disk in the "As Received" state.
> Do this from the CD, so you do not disturb the OOBE state.

Sometimes it is difficult to boot the CD on a new machine that you don't
know how to boot to CD, yet. You may need to read the documentation, or
tell windows to boot from CD next.

--
Cheers,
Carlos E.R.

On 2023-11-28 18:18, Paul wrote:
> On 11/28/2023 6:36 AM, Carlos E. R. wrote:
>
>>
>> The "agencies" might have purpose made microscopes :-p
>>
>
> This is true.
>
> There was a time, in silicon development, when researchers
> used to paint liquid crystals on top of a silicon die,
> and the electrical signals on the top of the die (not the
> ones inside it) would cause the liquid crystal to change state.
> And I'm told you could determine nodal states by doing that.

Wow.

Wait. IIRC LCD had to be fed AC current. DC would degrade (electrolisis)
the materials or something of the sort.

>
> We cannot discount some technique which is not normally used.
>
> What we have working on our side, is the shrinking feature
> size of storage, and how much harder it is now, to examine
> the smallest detail. An MFM can still read a platter, but it's
> getting down to the practical limits of the MFM (perhaps 2nm or so).
> The flying height now is (according to patent filings) 3nm or so.
> And Hitachi, as a lab test, did try flying a head at 0nm,
> and it took a month, to grind the head off it :-) They still
> haven't hit a limit yet, on the size of a stored magnetic bit.
> A slightly larger drive, just came out. We may eventually
> reach a condition, where only a moving platter can be read,
> and the instruments can't do it reliably on static specimens.
>
> Paul

--
Cheers,
Carlos E.R.

Paul <nospam@needed.invalid> wrote:

> On 11/27/2023 2:13 PM, VanguardLH wrote:
>> "jason_warren@ieee.org" <jason_warren@ieee.org> wrote:
>>
>>> What's the best way to clean everything off a hard drive
>>> before I return it to Dell?
>>>
>>> Will a low-level format do it or is there something better>
>>> The drive has five partitions.
>>
>> I'm confused. If you are returning a hard drive to Dell, doesn't that
>> mean it is defective, and why you are returning it? If the drive is
>> defective, likely you cannot completely wipe the drive.
>
> I think he is returning a new computer after a short usage
> period, because it isn't working out. The machine is still
> functional, and it's a matter of sanitizing before return.
>
> If I'm buying a new Dell, my sequence is like this:
>
> 1) Boot Macrium CD, do a Full Backup to external drive.
> This records the disk in the "As Received" state.
> Do this from the CD, so you do not disturb the OOBE state.
>
> 2) Use the computer...
>
> 3) Thoroughly erase drive as preparation for return.
> Then, restore the backup image from (1) as a convenience for Dell staff.
> The erasure step, ensures white space got covered.
> You can use DBAN for the erasure step if you want, or Secure Erase.
>
> But this all assumes you did (1).

Except with a laptop, especially one from Dell, likely there is
boot-time option to restore the laptop to its factory state. A hidden
partition is used, or a full setup set of files, is provided to restore
the disk to its factory state. I would not trust the reinstall to wipe
the unallocated sectors, so I'd do the wipe, and then use the reinstall
process (the latter step is probably a waste of time since the Dell
folks will use their sysprep to setup the disk for reuse).

"Carlos E. R." <robin_listas@es.invalid> wrote:

> On 2023-11-28 02:43, VanguardLH wrote:
>> T <T@invalid.invalid> wrote:
>>
>>> And keep in mind, if the bad guys are well funded, they'd
>>> just breaking your house and steal your whole computer.
>>
>> Nah, they'd just clone the drive and leave. You'd never know they were
>> there until you received a court appearance order for all those
>> instructions on how to build WMDs.
>
> "Just clone". This operation takes HOURS.
>
> And they have to reboot the machine to external media to use their
> software, that leaves a trace.
>
> It is not like in the movies :-p

Not if you have cloning hardware rather than running cloning software.
A 1 TB hard disk takes 55 minutes to clone. The hardware isn't cheap,
but then if it's the gov't they don't care about cost.

On 11/28/2023 6:39 AM, Carlos E. R. wrote:
> On 2023-11-28 02:51, Paul wrote:
>
> ...
>
>> While this is tempting as a partial proof, it's also silly.
>>
>>     dd if=/dev/sda bs=221184 | sum       # Would return 0000 given a chance.
>>                                          # If nonzero, there is a screwup.
>>                                          # But this takes too long to be a useful idea.
>
> Why that particular size (bs)?  :-)
>
> I would think of using 10 megs or so.
>

OK, let me take the size of my daily driver.

4,000,787,030,016 <=== Even SSDs report CHS compatible sizes... Of course the
"real storage" internally, is not a weird number like that.
But you cannot write past that number.

Divide by 221184. Divides evenly.

Trying the disk in the other machine. 1TB HDD. $60 worth.

1,000,204,886,016

Divides evenly by 221184.

How long can my lucky hold up I wonder ??? WDC 24300 year 2000 IDE drive

4,311,982,080

I found an 80GB IDE. Let's try that.

80,026,361,856

So far, the sizes all divide by 221184 evenly.

How long can my luck hold out, I wonder ???

[Bookies are now taking odds]

And for the audience here, we're not talking about partition
sizes. These are whole-disk sizes, the very limits of storage.

I have a lot of disks. One that is not damaged, it probably
won't run if I test it, but it doesn't even have an IDE
interface, so that's a double-challenge to test with.

I'm sure at some point, I'm going to find a physical drive
that doesn't follow that observation.

Paul

On 11/28/2023 5:19 AM, wasbit wrote:
> On 27/11/2023 15:45, jason_warren@ieee.org wrote:
>> What's the best way to clean everything off a hard drive
>> before I return it to Dell?
>>
>> Will a low-level format do it or is there something better>
>> The drive has five partitions.
>>
>
> Best way? Dunno, that's subjective.
>
> Darik's Boot and Nuke (DBAN)
>  - https://sourceforge.net/projects/dban/
>
> Beware! It will wipe all drives it finds so disconnect or remove any that you don't need wiped.
>

And you know the funny stories from the forum.

A couple of nitwits, after using DBAN:

"I left my backup drive connected to the back of the computer.
It seems to be erased too.

Can you help me recover it?
"

They actually wrote into the forum, to ask Darik
if he could un-erase a drive. Brownie points for
trying it, I guess. Asking someone to undo it.

The reason I didn't think this was a troll, was
there are people who are that deranged :-) You can
warn them and warn them... and that's what happens.
It's not like the author of the program didn't
warn people to be careful and not leave the wrong
drives connected.

One of the claims for DBAN, is it can "erase 99 drives at the same time".
We know it erases backup drives pretty effectively.

Paul

VanguardLH <V@nguard.lh> wrote:
[...]

> Except with a laptop, especially one from Dell, likely there is
> boot-time option to restore the laptop to its factory state. A hidden
> partition is used, or a full setup set of files, is provided to restore
> the disk to its factory state.

I don't know about Dell, but in general it is probably more "there
might be" than "likely there is".

At least that's the case for HP's consumer grade laptops. In the old
days, our Windows (XP?,) Vista and 8[.1 laptops indeed had full Recovery
partitions, but not my 'recent' (one year old) Windows 11 laptop (with
1TB SSD, so plenty of space).

I don't know why they made that change (pressure from Microsoft?), but
they did and so others may have done the same.