John Bawden wrote:

> I'm speaking from ignorance here about what actually goes on when a
> disc is scratched. But comparing the time that it takes to scratch a
> disc with the time it takes to purge a number of files, I'd guess
> that scratching a disc does not really remove the files physically
> from a disc anymore that the purge command does. I suspect that much
> of the actual files remain on the disc and could be recovered if
> someone were will to put in the time and had the knowledge to do so.
> Withe all the legal ramifications, I'd prefer to know that files are
> completely removed before putting a disc out where someone might get
> to it. Maybe someone with more knowledge of this topic can educate
> us?> 

What happens when you "purge/remove/erase/delete" a file depends on the OS and the filesystem.  For MPE/iX, when you :PURGE a file, the former contents of the file are overwritten with zeroes, and the directory entry is removed.  For all practical purposes, the file is gone.  

Windows/Mac don't usually overwrite, and worse still, you have the "recycle bin/trash" where the file resides until it too is erased; but even then the file isn't [typically] overwritten, only the directory entry is removed.  The file contents still reside on the disk until they are overwritten by a new file.

Unix/Linux and relatives are even more bizarre in terms of removing files.  There is not only a directory entry for the file, but possibly multiple directory entries (hard links) and pointers to directory entries (symbolic links).  Removing a file only flags the associated directory inode (or pointer) as "deleted", but the actual directory entry and corresponding file don't really go away until the reference count on the file goes to zero.  You can "remove" a file that is in use, and the directory entry goes away, but the file remains intact from the viewpoint of any accessors until they close the file.  Even then, the actual data inodes are not overwritten, only returned to free space.

The same concepts also apply to "scratching/formatting/initializing/etc" a disk or filesystem.  As Craig noted, in MPE/iX the 'scratchvol' really only does some voodoo to the volume label; the actual data on the disk is untouched.  Some formatting operations don't really "format" a disk as you would think, they only reinitialize the free space tables (the windows 'quick' format comes to mind). 

A file is not "really" removed until all locations on the disk formerly occupied by the file have been repeatedly overwritten with new data.  If you overwrite it once, you've "wiped" the data for all practical purposes, especially with the density of current disk media.  There is the possibly fictional super-spy extraterrestrial technology, which is presumably covered by DoD standards.  For those cases there are "standards" of just how far you must go to overwrite the data (an excellent list of these, as well as a product that conforms to them can be obtained from the fine folks at Allegro, http://www.allegro.com/products/hp3000/wipedisk.html).  The more current conventional wisdom is perhaps best explained in NIST SP800-88:

> "Purging information is a media sanitization process that protects
> the confidentiality of information against a laboratory attack.  For
> some media, clearing media would not suffice for purging.  However,
> for ATA disk dries manufactured after 2001 (over 15GB) the terms
> clearing and purging have converged."

-- http://csrc.nist.gov/publications/nistpubs/800-88/NISTSP800-88_rev1.pdf

Of course, if you really, really, absolutely have to be sure, I'd do a DoD 5220.22-M approved wipe, burial of the resulting drive in thermite, and subsequent ignition :-)

Jeff

* To join/leave the list, search archives, change list settings, *
* etc., please visit http://raven.utc.edu/archives/hp3000-l.html *