What method of wiping do you use?

[fieldofgreen]

I noticed the new version of ShredOS has PRNG Stream as its default and was curious to know if it was any better than filling with 1s and then the Blanking pass filling with 0s? Is there any other method that you might choose over another? Im just curious what makes the different methods worth using

[Knogle]

From my experience, using a PRNG (Pseudorandom Number Generator) stream has proven to be the most effective method for securely overwriting data on hard drives. Here’s why I prefer PRNG streams and how they compare to other methods.

Why I Prefer PRNG Streams

1. Randomness: PRNG streams use a pseudorandom number generator to write random data to the hard drive. This randomness makes it extremely difficult to reconstruct any residual data because there is no predictable pattern for data recovery tools to exploit.

2. Effective Data Overwrite: Writing random data effectively obscures the original content. Unlike patterns of zeros or ones, random data does not leave any recognizable trace of the previous data, making recovery attempts significantly harder.

3. Speed and Efficiency: PRNG streams can be implemented efficiently, and modern hardware can handle these operations relatively quickly compared to methods that require multiple passes.

4. Meets Security Standards: Many security standards and organizations recognize the effectiveness of random data overwrites. As a result, PRNG streams are often considered sufficient for securely erasing data.

Comparison with Other Methods

1. Fill With Zeros and Fill With Ones

• Method: Writing zeros (0x00) or ones (0xFF) to the entire hard drive.
• Security Level: Basic. This method can be effective for some purposes, but it is relatively easy to reverse-engineer since the pattern is predictable.
• Use Case: Suitable for non-sensitive data or quick erasure needs.

2. RCMP TSSIT OPS-II

• Method: Defined by the Royal Canadian Mounted Police, involves multiple passes of data overwriting.
• Security Level: High. Provides thorough erasure but can be time-consuming.
• Use Case: Suitable for sensitive data requiring high-security erasure.

3. DoD Short (3 Pass) and DoD 5220.22-M (7 Pass)

• Method: The Department of Defense methods involve multiple overwriting passes. The short version includes 3 passes (0x00, 0xFF, and random data), while the full version includes 7 passes.
• Security Level: Very high. Multiple overwrites ensure data cannot be easily recovered.
• Use Case: Ideal for military or government data requiring stringent data destruction.

4. Gutmann Wipe

• Method: A 35-pass method designed by Peter Gutmann for securely deleting data from magnetic and solid-state memory.
• Security Level: Extremely high. The Gutmann method is very comprehensive, considering various storage technologies.
• Use Case: Suitable for highly sensitive data where maximum security is required.

5. PRNG Stream

• Method: Fills the device with pseudorandom data generated by a PRNG.
• Security Level: High. The randomness provides strong protection against data recovery.
• Use Case: Suitable for most sensitive data, offering a balance between security and efficiency.

6. Verify Zeros and Verify Ones

• Method: These methods do not erase data but check if the device is filled with zeros (0x00) or ones (0xFF).
• Security Level: Not applicable for data erasure.
• Use Case: Used for verifying the state of the storage device after a wiping operation.

7. HMG IS5 Enhanced

• Method: Defined by the UK's HMG Information Assurance Standard No. 5, involves multiple overwrites.
• Security Level: Very high. Ensures data is unrecoverable.
• Use Case: Suitable for protectively marked or sensitive information.

Summary

Overall, I find PRNG streams to be the most suitable as they are effective, efficient, and provide high protection against data recovery. While methods like DoD 5220.22-M and Gutmann Wipe offer very high security levels, they are often time-consuming. Filling with zeros or ones provides only basic security and is less effective against advanced recovery techniques. The choice of method ultimately depends on the sensitivity of the data and the required level of security.

[PartialVolume]

@Knogle I don't mean any disrespect, but did you use ChatGPT to help generate your reply? AI generated output is pretty much grammatically perfect and your reply has that sort of feel not to mention Chapgpt generates some identical sentences.

@fieldofgreen @Knogle
While I agree that a prng pass is preferable there is no publicly available data to suggest that a singles zeros wipe on a modern non mfm drive can be recovered. The reason I prefer a prng wipe on a modern spinning disc is that the randomness of the data exercises the data channels in the drive. This is important for detection of a stuck bit. I have a test disc that will pass a zeros wipe & verification but fails a ones or prng wipe. The drive has a fault where a single bit on the data bus is stuck at zero so passes a zero wipe & verification without a problem.

prng stream & verification is more likely to fully wipe a SSD depending on whether the firmware within the drive uses some form of compression technique. Random data is virtually impossible to compress. I've tried compressing prng data and have so far found no commonly available program that can compress the data.

Re the Gutmann wipe it's really a waste of time and electricity. It may have been relevant to old MFM drives but not modern drives.

So in summary and this is just my opinion, a single prng wipe with verification or any of the methods that incorporate a prng pass like DOD 3 pass or IMG IS5 enhanced are the methods I would use. But in the end it really depends on what your goal is.

[mdcato]

@PartialVolume, Thank you for clarifying this.

…

-- Mike

________________________________ From: PartialVolume ***@***.***> Sent: Friday, June 21, 2024 4:03:55 PM To: martijnvanbrummelen/nwipe ***@***.***> Cc: Subscribed ***@***.***> Subject: Re: [martijnvanbrummelen/nwipe] What method of wiping do you use? (Discussion #582) @Knogle<https://github.com/Knogle> I don't mean any disrespect, but did you use ChatGPT to help generate your reply? AI generated output is pretty much grammatically perfect and your reply has that sort of feel not to mention it generates @fieldofgreen<https://github.com/fieldofgreen> While I agree that a prng pass is preferable there is no publicly available data to suggest that a singles zeros wipe on a modern non mfm drive can be recovered. The reason I prefer a prng drive on a modern spinning disc is that that randomness of the data exercises the data channels in the drive. This is important for detection of a stuck bit. I have a test disc that will pass a zeros wipe & verification but fails a ones or prng wipe. The drive has a fault where a single bit on the data bus is stuck at zero so passes a zero wipe & verification without a problem. prng stream & verification is more likely to fully wipe a SSD depending on whether the firmware within the drive uses some form of compression technique. Random data is virtually impossible to compress. I've tried compressing prng data and have so far found no commonly available program that can compress the data. Re the Gutmann wipe it's really a waste of time and electricity. It may have been relevant to old MFM drives but not modern drives. So I'm summary and this is just my opinion, a single prng wipe with verification or any of the methods that incorporate a prng pass like DOD 3 pass or IMG IS5 enhanced are the methods I would use. But in the end it really depends on what your goal is. — Reply to this email directly, view it on GitHub<#582 (reply in thread)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/ANGK2PXYQQ4OTEFXJ4VAVM3ZISILXAVCNFSM6AAAAABJV2K75OVHI2DSMVQWIX3LMV43SRDJONRXK43TNFXW4Q3PNVWWK3TUHM4TQNBTG42DS>. You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>