How to properly erase any hard drive - FREE TOOLS
Vložit
- čas přidán 24. 10. 2021
- The FBI or other government agencies don't have special tools to recover the wiped drive. Here is a white paper on this:
www.researchgate.net/publicat...
Do you need data recovery? Do you want to be featured in one of my videos? Contact me via email info@datarescuelabs.com
You can also find me at forensicguy.ca
Here are some of my favourite free tools to erase hard drives.
-------------------------------------------------------------------------------------
Links:
-------------------------------------------------------------------------------------
TikTok: / forensicguy
Instagram: / datarescuelabs.inc
Facebook: / datarescuelabs
-------------------------------------------------------------------------------------
Some of the tools that we use:
ruSolut Monolith adapter
ruSolut eMMC Adapters
ruSolut TSOP adapter
ruSolut Visual Nand Reconstructor
FlashExtractor
Z3X EasyJtag + UFS
JBC NANO
Hakko Soldering Iron FM-203
Hakko Rework Station 810B
Quick 8610W Rework Station
ACHI IR6500 BGA Station
PC-3000 UDMA
PC-3000 Portable III +SSD and nVMe
DeepSpar 3
DeepSpar 4
DeepSpar DPI PCI-E NVME Addon
DeepSpar Forensic Addon
DeepSpar Network Addon
ZXW Tools
Adobe Premiere CC
Adobe Photoshop CC
Camtasia Studio
Cellebrite UFED (Latest Version)
MSAB XRY
Magnet Forensics IEF
Magnet Axiom
X-Ways
FTK Imager
Various Linux Distros
-------------------------------------------------------------------------------------
Music:
Evil Needle - Dive chll.to/5ad90f75
cocabona - Daybreak chll.to/303c5685
Evil Needle, Misha - Dreams chll.to/d5cb0773
-------------------------------------------------------------------------------------
Stock footage:
Video by cottonbro from Pexels
Video by Kindel Media from Pexels
Video by RODNAE Productions from Pexels
Video by EKATERINA BOLOVTSOVA from Pexels
-------------------------------------------------------------------------------------
All graphics created by Data Rescue Labs
Need data recovery service? Forensic service?
Contact us today info@datarescuelabs.com
Data Rescue Labs Inc
145 Traders Blvd East Unit 8
Mississauga, Ontario
L4Z 3L3
Canada
Copyright (c) Data Rescue Labs Inc 2021
1-877-681-4131
www.datarescuelabs.com
#DFIR #forensicguy #wiping - Věda a technologie
people that say you can recover data from shredded drives have never seen it done. its powder, the biggest pieces are maybe rock salt. how tf are you going to re-build a drive from powder??? and at my site, we dump them in a bin with 100 other shredded drives. how are you going to distinguish your powder from their powder and put humpty dumpty back together
Yeah it’s all bs, I don’t know why this is still spread online as if it was true
The recovering data from a shredded HD started when someone (FBI?) took a cut up a 5.25 inch floppy drive and pieced it together and read the data off. It was then assumed that you could do the same thing with a HD platter. But you can't.
I remember the floppy storey haha
hi great video..would AOMEI Partition Assistant work? Also I noticed you clicked on erase disk but there is also a wipe disk option. To completly wipe would you need to use the wipe disk option or will just the erase otion be good enough?
Does windows powerhsell clear-disk do the same as dd command you demonstrated?
how about dispart clean all ?
in other words, is there a build in tool (commandline) that does secure erase a hdd and ssd?
Very good video. Thank you very much. I have a question about uninstalling software. What are your thoughts on IObit Uninstaller? are there better options out there? Thanks a lot!
What can be the problem if i copy files to my new ssd is slow down speed then freeze or stop is their a fix
Could filling the hard drive fully with a bunch of files copied over and over till its full be another way to "overwrite" the deleted files? Like a bunch of video files copied over and over. that seems like it would be faster than doing the software that just writes random zeros and 1s
It would be slower. When wiping a drive, it’s not at random but rather sequential zeros from LBA 0 to the end of the drive. This also ensures that the entire drive is covered. Once you start, it will stop when at the end. As when if you were to fill the drive with videos, you’d have to make sure to copy the exact amount of data to the drive from another source and it would also have to be drive fast enough to read from one, in order to write to the other
is Win11's "Reset this PC" enough on a newer SSD based laptop?
Thanks for your video. Do you have any post about how to scrub hard drive in Huawei? I tried factory reset but I heard that doing that alone does not remove spyware from the phone. Any advice will be greatly helpful. Thank you in advance.
Factory reset should be enough. If malware is that persistent, change phones
These are all the disk wipe tools that I heard are fantastic:
1. KIllDisk (in the video)
2. Dban
3. DiskPart (Available command installed in Window's command prompt)
4. WipeDrive
From all of these tools, which one is the best? Are they ALL considered great, especially by doing just one wipe on the hard drive? Would I need to run each of these tools one by one to ensure no data can be retrieved even through forensics (in case I would like to sell my drive)? Or is either tool and one swipe enough?
Thank you!
You could wipe it with one of those tools and use CCleaner to re-write the free space and wipe it.
Sometimes you can restore deleted files - but not if the space has been overwritten (which CCleaner does).
Any of those does not work on my bitlocker locked drive. Freakin stubborn. Tried each one and always comes up error when erasing. 🤯
HI, Laptop with soldered in C drive- How do i erase the C drive if i need the operating system on it to do it and its all being erased? I have USB stick with ubuntu on it if that helps. If i do a fresh install, it only has option for delete not ERASE when you what to start fresh. Thanks
You can use bootable DBAN or use windows to “erase everything” and data should be gone. Trim will take care of the rest
The free version of CCleaner has a wipe disk tool among other useful features.
I remember always checking the remove free space option without knowing what it was doing.
To feel comfortable with the destruction of my data, I toss my old hard drives in a volcano.
Finding a hammer might be a lot easier than finding a volcano.
@@EricE168 That's certainly true for most people. Luckily, I have one in my living room. In addition to destroying hard drives, it's also great for making fondue.
Hey, i tried to use this tool to erase everything from my backup ssd where i mirrored my old system but it doesnt work... i get a few errors and it stops. The Errors: "Error 5 writing sector "numbers"
on primary NTFS Access denied"
Need to run as admin
Have you tried the Redkey USB?
Funny that you mentined about getting data from shredded HDs; one of my current DF professors repeated the same myth that you can. I had a previous forensics professor in my undergrad degree that created a lab for debunking this belief. First, she gave everyone in the class an HD that would get shreds to create an image. Then, she had a private company come to class to show their tech on shredding HDs. Then we got our shredded HDs back and told us whoever can get a single 0/1 recover will have an A in the class. Many people in the class did not even try; those who did receive a 100pts bonus to add to the final grade. She always did labs that taught us more than the one the course required us to do.
Haha that’s awesome. I don’t know where this myth came from and whats worse is that people even in IT believe it 😆😆😆
@@forensicguy That professor told us the myth started from a whitepaper done for the FBI about recovering data from a destroyed HD. Supposedly, the FBI determined the method was property and did not confirm or deny if it was possible. Sounds too much like a conspiracy theory with some BS! Sprinkly all around for flavor to me.
Haha yup. Maybe a destroyed hard drive in the white paper wasn’t that destroyed
Dban is "good enough" for most but remember a few things. It does NOT guarantee a complete wipe. Wiping fully 2x is sufficient for total destruction with a few exceptions. Wiping 32 x is a waste of time and this was an idea that came about because older hard drives "MFM" and "RLL" would vary their writing depth based on the frequency of the drive. This could change for several reasons causing the write to go "deeper" in the media and thus more writes could be required to remove the data or not at all in most cases. Guttman is a myth beyond this. The need for this many writes is not true with modern drives, as the way data is stored, and the relation to the depth of the write is no longer dependant on the frequency of the drives write head. However loud noises can cause data to be mis-written due to the vibration of the sound and this is important but I digress. More to the point is that 32x (or whatever) is useless. On MBR disks typically a "quick format" only writes bytes 447 to 512 on the media which destroys the table of "file" pointers to the data and actually leaves the data in tact. When creating a partition the first 0 to 446 bytes *(see note) are written (or overwritten) and this creates/destroys the old data stored there but only there. Both instances of these operations destroy the database(s) stored there but leave bytes 513 to the end of the disk in tact and can be recovered later with a skilled hand. Note this is a little different with the GPT tables but basically the same effect. Only a Full Format will destroy the data and 2 full formats just to be safe. Format with Random data in case you missed anything (*caused by a loud noise hence the 2x formating) which would stand out from the rest of the Zero's you just wrote to the drive. This way any data missed due to _error_ looks like the rest of the noise you wrote randomly.
*Note: This is a "quick" overview of this topic for the purposes of debunking the "Dban" utility as the final solution to data destruction, and is not meant to be exact in the description of other related bytes written to the disk during the formatting of the drive. So don't shoot the messenger.
The exceptions are: Bad sectors "G" list, Bad Sectors "P" list, Wear Leveling:
G list:
Bad sectors can happen at any time from the life of the drive to the death and all drive have 2 tables. This is important because Dban is useless in this case. Dban does not have a function in which it performs any kind of checking to be aware of the bad sector table and does not perform any data recovery and wiping. The Bad sectors are managed by the drives firmware and completely hidden from Dban thus if you have a fragment of a image you shouldn't let's say, and you Dban the drive in which _error_ correction was performed at ANY time by the SMART service on the drive, this sector could have been remapped, marked as bad and left fragments of the image on the sector. Ie. One byte of a 512 byte sector is bad so smart "relocates" or copies this data (or as much as it can read) to a new good sector, but because it can't write, it marks this sector as bad, updates the Bad Sector table, and goes about the day and you never see a thing. Note the rest of the 511 bytes are still there. Dban will skip these sectors. This specific list of Bad Sectors is grown while in use and is specifically known as the "Grown List" or G list.
P list:
There is another set of bad sector tables known as the "Permanent List" and this is the list the drive is mapped with from the factory and can never be changed as it is hard coded to the firmware. This list is created at manufacturer time and because no drive is perfect in manufacturing thus mapping the default bad sectors is necessary to allow the drive to pass testing and be ready to function before it is released to the distributor as a working drive.
Wear Leveling:
On ALL digital media there are limitation as to how many times you can write to the same spot before it burns out. This is because apparently when storing data on an SSD of Flash media of any kind it involves pushing an electron through a "substrate" and lodging it there, which is read later as having or not having a charge (short version). This process leaves a residue behind. The residue will accumulate causing a buildup and eventually be unable to push an electron through and thus a "bad" sector will happen. To prevent this there is e technology called "Wear Leveling". Wear leveling is a small piece of software which will randomly move the disk writes to to another location instead and update the File pointer table or File Allocation Table (FAT). The FAT is a database located at the first 447 to 512 bytes of the storage media which contains the name of the file and where the data associated with the filename is. Magnetic media does not use wear leveling because it can be written to indefinitely as long as there are no defects on the physical media and as explained before is uses the SMART software to update the "G" list if there is a problem. Wear leveling protects the longevity of writes to the drive in this fashion but never actually overwrites any data until all other available sectors are used and it must again (assuming the space is now empty) reuse the same spot. Rinse and repeat.
Conclusion:
To get around ALL of the problem associated with bad sector tables the only solution for total data destruction is not Dban, it is Full Disk Encryption deployed before you ever do ANYTHING else on the media. Full disk encryption is the ONLY way to secure your data from the life to the death of the device. Be careful that you select a sufficiently long password as you don't want a brute force attack to uncover your precious cat videos, and remember that if your disk is decrypted the record you have of "deleted" or "trashcan" files would then be recoverable. Wiping your "recycle bin" on an already Full Disk Encrypted device is a waste of time unless you are expecting to have you password breached, and don't want your deleted file recovered and that's just crazy talk. Don't be careless, use a good password when full disk encrypting and I recommend combining a security token such as RSA or a Yubikey that has no API for recovering the key once it has been written to the device with you current password to secure your data. DBan-ing your data at that point won't matter.
Note: 256 bit encryption at rest has: 115,792,089,237,316,195,423,570,985,008,687,907,853,269,984,665,640,564,039,457,584,007,913,129,639,936 possibilities.. Think of it a a key to a door with 2^256 cuts along the blade or 1.1x10^77 combinations. That's 78 digits! If someone were to hack at a good password, with every single computer on earth, all at the same time, for 4 billion years, no computer or combination of computers on earth can break it.
how about physically hammering the hard disc into small pieces?
@Drunk3n Scum I should probably add thay Quantum Computers supposedly will speed thing up but I am not convinced they will "break" all encryption. I'm not an expert on QBITs but from my understanding they can bring a password which takes b billion years to a few minutes. A 256 bit password may then take.. let's say a week as this is all theoretical anyway. But a 4096 bits which may take 100 Trillion years down to 400 years is still not gonna happen in my lifetime. Plus they don't have any effect at all on symmetric cyphers so Quantum means no threat to AES encryption such as what is used in banking transactions etc. -I'll clean up this post later just woke up 🤪
@@ahears1 Would you clarify, when you advise to deploy Full Disk Encryption "before you ever do ANYTHING else on the media", does this mean that any files or media which existed before the encryption will not be protected against file recovery methods? Or can you encrypt your storage drive at any point in time and not worry? Thanks for your post.
@@MetalTaiIs Encrypt before use because if you encrypt the data after the fact one of the sectors could have 1 bite in that 512 bite sector that's bad and the whole sector gets marked bad leaving 511 bites that could be recovered. This might occur because operating systems or hard drive firmware are always conducting error correction in the background. If it marks a sector bad before disk encryption then it is unable to write or encrypt that sector which can leave data behind still unencrypted..
@@ahears1 I wasn't notified of your reply so I am responding late. Thank you for the answer 👍
this is absolutely the best tutorial! the program Active KillDisk is also free. thank you.
Very true, when I worked in the good ol' data center life we only did one pass to wipe the data. That argument of 3pass did come up and was shot down due to reseach papers showing that one pass is good enough. Don't ask we about the reseach papers, that was done by VP Ops.
P.S. We also drilled holes in it if the customer requested it and paid for that service. Haha
It seems like such a waste. I’ve seen good enterprise SSDs destroyed for no reason
What software did he use on windows?
Activekilldisk
Question for you: if my PC is protected with a windows admin password and lock screen, can you recover the files on my hard drive without my windows admin password?
Yes, as long as there is no drive encryption enabled such as BitLocker or any other one.
Are these tools for wiping a phone good enough ? Or is there special software needed to erase a phone ?
Hmm.. frustrating. I installed this program and I can only see my two hard drives in my laptop. I want to erase my digital walkman's hard drive. Maybe I can not do this? I tried refreshing it and still don't see it. Should I do this a different way for this item?
Use create partition to see the drive in windows
Nice ❤️ Video Mr Stanko
how long dose it take to whipe drive
depends on size of drive
Get a pixel 4a and root graphene OS on it
Then ur 8 digit Password and then to crack it open.
So curious if graphene can be cracked by cellebrite
I have pixel as my secondary phone, I really want to try graphene on Cellebrite
Hi again. In the interrogation of Russell Williams the detective also said that the programmes that can be bought to help clean their computers don't work. He said the fbi etc are pulling that stuff out the whole time. Is he lying ? Or is he correct that these programmes we can buy to clean computers don't work? Thanks.
I am sure there are some that don’t. The ones I discussed work. As long as you can write to all sectors of the drive, the data cannot be recovered.
@@forensicguy would your way still work if the fbi and government etc really wanted to get it back and were willing to throw millions and millions into retrieveng it?
There is no way, imagine it like this
You wrote something on a sandy beach and water came and washed it away. There is nothing left at this point
No amount of money or technology can bring back something that isn’t there anymore
@@forensicguy Hi again I discovered something. I hear that the average computer we buy in stores are designed that overwritting a hard drive leaves traces that don't be overwritten atall. And that their purposely designed like that in case the cops etc ever need to check your computer. Ever hear of this? Also if i didn't make sense let me know I'll explain again.
You sound like you know what you are talking about. Subscribed.
Wow, again mate. You kill the BS. I've had iShredder on my phone for a few years now. Im wondering if it's worth having anymore. I have an S10, if im not wrong my phone uses FBE. So when I delete a file it's gone. I usually do a 7 write overpass but as you say 1 pass is more than enough. Does that include phones?
On encrypted phones you don’t even have to do a single pass. File is gone once deleted
@@forensicguy Doesn't each app keep an SQL database file on Android? Chris, you would be a brilliant instructor... Even an author for a book covering the subject!
Yes that’s a different thing. If you’re deleting individual files then they’re gone.
Data within sql need to be overwritten. I don’t think ishredder does this for each app. I might have to test it one day for a vid
Btw i dunno if I’d want to be an instructor 😆😆
@@forensicguy yup it would be a good insight. 👊
Grampa gamer here: D- BAN, and white canyon and other ones don't work on ssd's. Only on sata hard drives. I use two different devices i have had for 3 years and wiped over 30 ssd's. One is called destruct pro. It is a large black usb device shaped like a big key. It wipes the ssd's in blocks. And does a D.O.D. short wipe. Another one i used is red key pro usb from england, but red key pro only lets you erase 3 ssd's and you have to buy it again for about $89. So i still have it, but it is locked. Amazon has destruct pro for apx. $49. But only use the pro version !!. Destruct has a standard version that is like d-ban. and will not wipe ssd's.
how abt the DISK PART and CLEAN ALL???
how erase ata lock drives?
I use pc3000 for that
This does not address most use cases today, Laptops have modules baked in, or are difficult to take apart to access the SSD (Surface Laptop 1 for example).
The easiest way, but certainly time consuming is to write and delete data onto the drive(s) multiple times, of course this new data needs to be benign, perhaps a 4k video or something.
A 'wiped' hard drive can still have its data recovered even after several re-formats. It is possible to recover several layers of data from a hard drive platter, but it is difficult and expensive to so because highly specialised hardware is required to do this.
Unlikely.
@@forensicguyNot unlikely at all. Forensic analysis of a hard drive can reveal and recover data, even after several formats.
Is it possible to totally erase things from computers to the point where a forensic specialist could not retrieve it if he wanted with a lot of work and money? Thank you.
Just wipe the drives the way I show in the video
@@forensicguy The detective in the interrogation of Russell Williams on CZcams told Russell that things can't be deleted from computers. He also said that his computer would be sent to Microsoft in calafornia to be picked apart. He also told him that we can buy programs to have people clean their computers and that the FBI and the police are pulling that stuff out the whole time
Cops lie all the time to suspects to get them to confess. Once data is overwritten with zeros or Radom characters, it will be gone forever.
@@forensicguy Okey. What about deleting certain things on your computer ? Or do you have to wipe and overwrite the whole thing?
You can use ccleaner, under tools to wipe slack space. But per app databases you won’t be able to clean. To truly erase the data you need to erase entire drive. Also using bitlocker on windows or FileVault on Mac helps too by encrypting the data.
08:21 really do not need to 'buy software' for clearing drives within WIndows either, as Diskpart , clear, etc., will take care of it...
Clean does not write to all sectors, it only clears the partition table and mft
@@forensicguy hence the 'all' option.... :)
I’ll try to out and let you know
I see you didn’t mention ‘all’ in your original message hence why I assumed you just ran clean by itself. But yes ‘all’ will clear all sectors. Good advice!
Why is this? Would like to know not how but why?
Linux terminal
dd if=/dev/zero of=/dev/ bs=512
cipher /w:c/
when he learns to talk right he may be agle to produce a video that can be understood...
FIRST
Damn homie! 💪🏼
@@forensicguy sniped that one lol
@@Boosted00 coco bongo has been slacking too
@@wtfmategaming i saw this and took advantage lol
Algorithm.
I can always count on you 💪🏼
@@forensicguy I got you.
Your other message got removed. CZcams keeps doing this to my viewers 😡
Your comments keep getting removed for some strange reason. Not the algorithm ones but anything else you say and I can’t fix it. Wtf is CZcams doing
@@forensicguy CZcams hates me.
Just use an angle grinder, cut it nearly in half, or drill 6 holes in it. Stop faffing about.
You spend all that time rambling and when it comes down to it you FLY right through it. What’s the point?
What can be the problem if i copy files to my new ssd is slow down speed then freeze or stop is their a fix
What can be the problem if i copy files to my new ssd is slow down speed then freeze or stop is their a fix
Either its a failing SSD or very low cache and its falling behind but I would say its failing