Overwriting data Multiple times ?

I consider Bruce Schneier to be nothing less than a god when it comes to encryption opinions and recommendations. So if Schneier recommends three passes as a minimum standard, then I'd use three passes as a minimum standard, and wouldn't feel any need to ask questions about it.
The quibbling over what should be enough for a maximum number I'll leave to greater minds than my own.

The page you linked to is a discussion of a software based on Schneier's own encryption baby, Blowfish.

Schneier was also part of the Twofish encryption development team, and Schneier himself now says he's surprised people still use Blowfish, and that he recommends Twofish as the superior encryption algorithm:

http://www.computerworld.com.au/art...curity_linux_faithful/?pp=3&fp=4194304&fpid=1

If there's some ulterior motive to his recommendation, I don't know it, and I'm personally more than happy to take him at face value.

I'm also a proponent of a person evaluating his/her actual needs when it comes to things like encryption, privacy, et. al., and taking only the appropriate action needed to fulfill those requirements.
No reason to use a cannon to kill a fly, in other words.

But if you're truly worried about NSA, FBI, or whatever being able to recover data from your machine, then by all means pull out the heavy artillery.
Under such a scenario, I wouldn't have the least concern over whether or not wiping/overwriting the drive 'X' number of times might reduce the lifespan of the drive, either.

And btw-- I once had a drive wipe utility, several years ago, that ran from a floppy disc-- I don't remember the name of it anymore, but the recommendation from the instructions in that utility was also to use a minimum three-pass overwrite.

 

The other day I wiped my SSD drive using Eraser and Windows.

1) manually deleted all my personal files/folders with Eraser Pseudorandom Data 1 pass + Cluster Tip Area
2) formatted the drive using Windows
3) used Eraser to format the drive using the Erase Unused Space option with Pseudorandom Data 1 pass + Cluster Tip Area
4) used Recuva to scan for any files leftover - It didn't find anything retrievable

I didn't have time to try any other recovery applications to see if if there was anything retrievable.

 

I would be very careful when erasing USB flash drives. They might have internal mechanism that can affect the writing process in order to optimize it, because the number of writes on a flash is limited. In order to be totally sure about erasing data from a flash I would recommend a visual inspection of the result with a disk editor. However, I'm sure that if a HDD would be used for the experiment, the results would have been different.

 

If you have an old ancient Hard Drive? No, 1 pass is not enough. If your using a new Modern Drive, Yes 1 pass is enough, don't believe me? Google any forensic forum and ask them about their success rate recovering data from a drive where the person of interest used 1 pass Psudorandom to wipe their entire drive. Old papers about old drives are Old and outdated advice given for Old outdated Hard Drives.

If your trying to erase data from a SDD/Flash drive, Encrypt the entire drive, then reformat it, if your afraid of the gov because you were engaged in illegal activities? smash it with a hammer. EDIT to add more info: Or vice versa, you should have encrypted the entire Flash drive before you started writing sensitive data to it. then you could have just reformatted it if you wanted to sell it or use it for something else.


Schneier on Security
Erasing Data from Flash Drives

When it comes down to encryption, I don't care if your cascading algorithms (AES-Twofish), it will be useless if one does not know anything about Encryption and the precautions needed. If your a paranoid you basically have to physically take your machine with you every where you go to prevent an attacker from having any physical access to it because so many attacks are present, like Evil Maid, or ways to Infect your Bios, or tamper with your Hardware, which can store your key for them somewhere when you enter it, and the list of attacks goes on and on ect...........

 

How many threads like this are here at Wilders? Must be dozens and dozens. The answer, inevitably, comes back to Full Drive Encryption with PGP or Truecrypt. If you're only interested in security, with some respect of privacy (depending on the software) - it comes down to light virtualization (Returnil, etc.).

Look at it like this: If I had a small room that had bits of information that I needed to get rid of regularly, I could set fire to each piece of paper over and over and over again, day after day after day - or - I could just turn the little room into a Fort Knox-like safe that would take numbers of years to enter and I would not have worry about what lies about in the room. All of it then would be locked behind doors that would take years to open. That's the difference between cleaning up with cleaners and shredders and the rock-solid safe: FDE.

 

Yes, I agree their are other posts regarding the same subject, But at the same time one can never learn to much about security especially when new things come to light, I would rather be up to date with new advice than stuck in the past with nothing but old advice.

The Advice below is not aimed at anyone in this thread. It is only an example...

You can use FDE all day long, but once the malware hits your keys are had and that sir = Fail. If someone with brains really wants your key they will figure out one way or another to get it regardless of how secure your FDE algorithm, strong password, and multiple keyfiles makes one feel.

But in the end one would not have to worry about such a sophisticated attacker, unless they knew they were doing something wrong? But it is never to late to change and let go of all of the old ways that was making one so paranoid. Like if you were a kid and you used to think hacking was fun but the paranoia of getting caught took over your life, one word of advice, CHANGE!

 

It seems that way, even though encryption has very little to do with the original subject, data overwriting and how much is necessary in order for it to be completely effective. The only thing the subjects have in common is that they're both privacy issues. While most encryption users also need good data erasing, those who want to securely overwrite data don't automatically need encryption.

 

Discussing and bringing up FDE has a lot to do with the discussion of data overwriting. They're not only related because they're simply "both privacy issues." Without FDE, you have to worry about all the nooks and crannies that need to be overwritten, including the free space - with FDE there's no need for the concern. It's directly related. Without FDE, you have to make damn sure whatever you use to overwrite is effective. BTW, I didn't say those who want to securely erase data need full drive encryption. What I said is the discussion ultimately comes back around to FDE as the only solution that leaves you not having to worry about what scraps have been been overwritten properly.

 

The Urban Legend of Multipass Hard Disk Overwrite

 

I only use one pass normally. I use random data not zeros though that way no one can prove if it's encrypted data or wiped data.