Relay-Version: version B 2.10 5/3/83; site utzoo.UUCP
Path: utzoo!mnetor!uunet!seismo!sundc!pitstop!sun!amdcad!ames!hc!beta!cmcl2!rutgers!im4u!ut-sally!utah-cs!utah-gr!stride!stride1!mitch
From: mitch@stride1.UUCP (Thomas P. Mitchell)
Newsgroups: sci.crypt
Subject: Re: Erasing magnetic media
Message-ID: <692@stride.Stride.COM>
Date: Wed, 4-Nov-87 14:59:17 EST
Article-I.D.: stride.692
Posted: Wed Nov  4 14:59:17 1987
Date-Received: Sun, 8-Nov-87 01:05:49 EST
References: <7566@reed.UUCP> <1175@cup.portal.com> <6964@pur-ee.UUCP> <1029@pbhyd.UUCP>
Sender: news@stride.Stride.COM
Reply-To: mitch@stride1.UUCP (Thomas P. Mitchell)
Organization: MicroSage Comp. Sys. Inc., 680 S. Rock Blvd, Reno, NV 89502
Lines: 52
Summary: Grind them tapes up.

In article <1029@pbhyd.UUCP> lc@pbhyd.UUCP (Larry Colton) writes:
>In article <6964@pur-ee.UUCP> 3ksnn64@pur-ee.UUCP (Joe Cychosz) writes:
>>It is quite easy (given the proper equipment) to recover information that
>>has be written over several times.
>
>Could you enlighten us with the details?  There is great commercial
>potential in being able to recover files that have been accidentally 
>overwritten.

There tends to be small differences between the signal levels as
a result of the previous data.  A 1 which overwrites a 1 is
commonly a small amount stronger than if the previous data was a
0.  Careful signal analysis can attempt to remove the obvious
data by subtraction. The result is the previous data.  If the
data is valuable enough the effort is worth it.  Also there is
some information on the edge of the track that is effectively
unchanged because of the minor alignment differences from one
write to the next.  Using heads of slightly different sizes and
alignments can increase the signal to noise (data) ratios.  In
any case the last data is obvious which greatly simplifies its
removal from the signal.

In general the above is smoke. Although I have been told that
some companies do provide a service recovering data from various
types of media.  The real security problem is if ANYTHING is
permitted out of the room.  How do you detect someone
removing/trashing a tape or disk-pack that has been erased with
encrypted (their code) data or written/erased with reduced
current to the heads? It might look ok but out goes national
security.  When I was in school someone picked up some surplus
(USAF) 1/2 inch tapes which we were going to split for audio use.
We hung them on the CDC and they were not all blank.  Since it
was the very late 60's we were surprised, but not surprised that
nothing made sense.

In fact on many installations the dump and trash bin is one of
the most securely guarded and managed areas.

I do not know of any service companies by name that recover data
but contact someone at a Big Blue/Bank data processing center for
pointers.  If you cannot get in try a suit and a job application.
Brush up on COBOL RPG and such, big well run DP shops are worth a
visit.  The key words are "well run", not Big or Blue.

Thanks for the soap



Thomas P. Mitchell (mitch@stride1.Stride.COM)
Phone:	(702) 322-6868 TWX:	910-395-6073
MicroSage Computer Systems Inc. a Division of Stride Micro.
Opinions expressed are probably mine.