notANON

Whenever you get rid of an old hard drive you should always wipe it.  This goes without saying but what does “wiping a drive” entail?  When I say wipe, I mean more than a format.  I even mean more than a destructive format.  If you’ve had to wipe a disk for work or some other reason, you’ve undoubtedly heard of Darick’s Boot and Nuke A.K.A. DBAN.  This is a great tool that will fill all of your sectors with zeros.  It will even do multiple passes to comply with different data sanitization standards.  It’s self-contained and easy to use but it has a limitation…

DBAN cannot wipe data blocks that your hard drive has internally marked as “bad” in the g-list(grown list).  The g-list is created by firmware in the hard drive whenever a sector takes too much time to access.  When the firmware detects that a sector is slow, it determines that the sector is bad and if it can read the data, it will COPY the sector to a new physical location on the disk and this will be reflected as an updated entry in the g-list.  Of course this is all done in a way that is totally transparent to the operating system.  Windows or whatever other system will have no idea this has occurred and will just continue plugging away.  But what about that “bad” block?  If it’s bad, it can’t be read anymore, right?  Maybe, maybe not.  There are tools that exist that have entended control over the physical hard drive that sometimes CAN read that data.  It might not be much if you don’t have a lot of bad sectors but it’s probably something and it’s probably not all zeros.

The situation sounds a little grim but the manufactures of IDE hard drives thought of a solution.  There is a command in the ATA command set that will make the hard drive erase itself, good AND bad blocks.  This will require a couple of things though.  You will need a bootable MS-DOS(compatible) disk and a hard drive attached directly to your IDE controller.  This will not work through a USB-IDE enclosure since USB doesn’t support a full implementation of the ATA command set.

You will also need a free tool called Secure Erase.  It is graciously provided by the Center for Magnetic Recording Research (CMRR) along with instructions but no support.  It’s a very small, simplistic program but it does a simplistic job.  I am going to borrow a chart from the Secure Erase documentation. I would like to point out that DBAN would share the “medium” slot with the DOD “Block Erase” and I also slightly disagree with the author on the final method suggested:

In my opinion, the Secure Erase tool should be considered as good as it gets for software solutions.  I can’t see how changing the in-drive encryption key could possibly be more secure than making the hard drive obliterate every single block, good or bad.  The encryption is EXCELLENT right now and for all practical purposes unbreakable but does anyone else remember when Netscape was limited to exporting 40-bit encryption because we didn’t want foreign countries to have anything better than we could crack?  That quickly was tossed out the window and clever cryptographers have now broken far more sophisticated algorithms.  Seems like breaking or bruteforcing(practically) any encryption is theoretically possible with enough computing horsepower but perhaps I’m entirely misunderstanding the author’s statement.  If the chart kept going, the BEST possible way to sanitize your data, of course, is to shred the drive.