BleepingComputer.com: What makes and HDD readable even after it's been zeroed?

I'm just trying to learn the science, here.

Say I take DBAN and wipe my drive - just a one-pass zero-fill... to clean my hdd for a new OS installation. There's still information left on the disk that's retrievable? That shouldn't be possible, from my limited understanding (although I realize it is - and it's where I need the connection).

Windows just removes a reference point when "deleting" a file. The junk is still there, a bunch of 1s and 0s representing the data. But when you turn everything to 0s, there's no data left. Just a blank. On a magnetic hard drive, that's 0 or 1, positive or negative.

How's information retrievable (or recoverable, pick your word) when there's two choices: data or no data?

(I know I've vastly over-simplified it, but might as well acknowledge I know nothing and start from scratch.)

To 99.9% of the population, overwriting like "one-pass zero-fill" will make the data unreadable; however, if you are equipped like the FBI, NSA and CIA and many other govt authorities, the residual magnetic imprint is readable on the disk. To your system the data is binary, ones and zeroes. When you diassassemble the hard drive and platters, and run over a very sensitive read head the data becomes more of an analog datastream. Eventhough a data bit is technically a "0" (after your 0 overwrite) the residual can lean "0" or farther toward "1". This is what is used to reconstruct the data. Some data bits will be 99% "0", some will be 80% "0". Discrimination/squelch is adjustable to find the medium where you can detect the "0"s and "1"s. This is why you have DOD wipes etc with multiple passes to erase that residual.

This post has been edited by dpunisher: 05 May 2009 - 02:53 PM

I guess I don't know a lot about magnets, then? When you're dealing with binary data, how does your normal hard drive data stay intact if it's "mostly zero" or "mostly one?" That doesn't sound like a stable way to keep data?

And if your read/write head is only writing 80% of the way, does that mean you should start looking towards a potential failure? (How do you tell when you're losing the strength of the binary charge?)

Yea... most of this is going over my head when I really try to think about it... But it's kind of neat to explore.

" When you're dealing with binary data, how does your normal hard drive data stay intact if it's "mostly zero" or "mostly one?" That doesn't sound like a stable way to keep data?"

Binary data consits of nothing but zeros & ones.

Example: 0001110000011 1111100101 would be binary [have no idea what but it's just an example.

I have a program called OnTrack Easy Recovery Professional [from when I had my shop] that can recover data from a HD that has been zero filled & then formatted.
If it will spin the program can recover about anything that's been on the disk.

Most people aren't going to have that type of program though.

I'm not worried about who has the programs. I just want to see how it works.

My basic, basic understanding is that there are two charges, + and -, 1 and 0. You make it sound like there's a +/- 0.5 when you overwrite something. I'm trying to understand how the new bit would be able to be read if it's not 1 or 0, or IS 1/0 but has a 0.5 under it from the previous writings?

Your hard drive firmware doesn't see shades of grey, only black and white with nothing in between (the difference between black and white, and greyscale) which in a binary world is as it should be.

In a perfect world if you zeroed a drive every bit would read "0" absolutely, and every bit would have the same magnetic residual. Nothing is absolute. You cannot get 100% magnetic saturation of every atom of the iron compound on a platter. When you zero fill a drive that previously had data, the write head cannot totally eliminate the residual "1". Your hard drive doesn't care about the small anomalies. A bit of data represented by the hard drive reads "0" whether the saturation is 100% or 80% (arbitrary numbers I pulled out of my ass) as long as it is over the threshold the manufacturer sets. If you have the ability to scan a platter with a different threshold to determine a "1"or a "0" then you can pick out those bits that were previously a "1".

That's as good as I can explain it.

Edit: In response to:"And if your read/write head is only writing 80% of the way, does that mean you should start looking towards a potential failure?"

That is exactly what your hard drive does automatically. If you have a block that does not read correctly, it failschecksum, and firmware condemns that block, and disables it after copying what data it can to a working block. 80% is just an arbitrary number I used to make the point. I have no idea what the actual threshold is for a proper read from a hard drive.

This post has been edited by dpunisher: 06 May 2009 - 04:03 AM

Oh, okay! Now it makes sense. It reads positive and negative (within a certain tolerance), but it doesn't care HOW positive or how negative? It's like saying "blue" whether it's sky blue, ocean blue, powder blue or periwinkle. It's still BLUE.

(I realized the numbers were arbitrary, but ran with them since they were importantly illustrative and now alliterative.)

. . .

Next question, though. A bad sector, which has a charge outside the tolerance set by the manufacturer is called unreadable by the drive, which is then disabled. Is it possible to restore a charge to that sector by writing over it again? (ie, it was originally + or 1, and by writing another 1 to it, you create enough charge to make it readable again, to rebuild a charge?)

A bad sector is usually caused by the read head coming in contact & physically damaging the disk.

That's why a sudden loss of power [a "crash"] is bad.

That used to be a really big concern on older hard drives.
Newer ones "park" the read head/arm during a restart or power down.

What makes the read head "float" above the disk is the air pressure created from the disk spinning.
[That's why HD's are sealed except for a small pressure releif , or "vent" hole]
If the disk suddenly quits spinning the head drops & hits the disk.

Amended: "bad sector" to "failchecksum"

I wasn't thinking/reading for that last part. Sorry.

DnDer, on May 6 2009, 02:51 PM, said:

If for some reason a sector reads "bad", chances are it is actually bad either due to head contact or a manufacturing defect. Hard drives have extra space that bad sectors get remapped to. No need to try and salvage a bad sector when you can transfer the data to a known good sector seamlessly. At one time I had an old DOS program (circa '93 or '94) that would physically show defective sectors and the actual place on the platter where they occured. It was easy to tell if a hard drive had been dropped, or had head crashes due to power loss etc.

Some newer hard drives/controllers have accelerometers built in. If you drop a laptop, the sensor reads "0 G" and parks the heads hopefully before it hits .

If a defrag is done in DOS using Windows 95,98,98SE,ME it shows the disk in a block grid & will show where bad sectors are.

fairjoeblue, on May 6 2009, 04:15 PM, said:

This program went a step farther. It would literally display the platter and you could see the map of bad sectors as they physically were on the platter. You could see bad sectors from head smashes as dots on the platter scan. Head contact while running would leave a curved trace like a record track.

Learn something new everyday. Great topic