Wanted to verify my theory
Hi,
I have a theory about using Acronis True Image that I wanted to run by the community to ensure that it is correct. The general problem is people disposing of old machines by giving them to me and expecting that I will wipe the drives for them. I don't mind to do this, but once the drive is wiped it's more difficult to get their specific version of Windows back and the license acknowledged as legitimate. Alternatively, I could let Windows revert itself to the out-of-box experience, and then it's all taken care of, but anyone with data retrieval software could potentially find sensitive information on that drive. My theory is that if I were to have Windows revert to out-of-box, and then I use True Image to back the drive up (not sector-by-sector), then I perform a low-level wipe on the drive, and lastly I restore the image to the drive, then I ought to have a basically brand new, licensed copy of Windows, and yet data retrieval software shouldn't be able to turn up sensitive data.
Am I mistaken?
Thanks in advance!
Chris


- Log in to post comments

The general problem is people disposing of old machines by giving them to me and expecting that I will wipe the drives for them. I don't mind to do this, but once the drive is wiped it's more difficult to get their specific version of Windows back and the license acknowledged as legitimate.
Chris, if the old machines are bootable when you receive them, then use a tool such as the free Belarc Advisor to get an inventory of the installed OS and applications etc.
Hopefully, if you are intending to reinstall the same version / edition of Windows, then you will also have a COA sticker for the correct license key. The key shown in Belarc is more often from a volume license used by the original installer and not valid for a re-install.
Personally, I have a number of such machines, mostly very old XP systems that I have wiped and then installed a copy of Peppermint Linux on that uses the EXT3 or 4 file system. I have not come across any to date that would warrant anyone to pay out for a forensic data recovery, especially after the drive has been wiped and then changed from NTFS to a Linux file system!
CCleaner (Windows) can wipe free space on a drive if needed.
The other alternative, swap out the original drive and put in a spare from a different computer then attach the original via a dock to a computer that can spend hours / days doing a complete drive wipe with multiple passes etc.
The final option for sensitive data is an old-fashioned ball pein hammer (for the drive)!
- Log in to post comments

Steve Smith wrote:The final option for sensitive data is an old-fashioned ball pein hammer (for the drive)!
Yes, that is the option I choose when disposing of HDDs which may contain sensitive data.
I must admit I am not good with disposing of old HDDs; I must have about 20 on the shelf behind me - some of them IDE and first generation SATA.
Ian
- Log in to post comments

Thanks for your insights... I think what I'll do is try my theory and then try running a file recovery software on it afterwards... if it comes up with stuff, then my theory is a no-go... if it does not, then it is a working theory... this will not prevent the NSA from finding sensitive data on such a drive, but it would prevent anyone without seriously sophisticated hardware from doing so
- Log in to post comments

Chris, what is the "low level wipe" you intend to perform? Will it do anything better (or faster) than using one of the various products that will wipe free space.
- Log in to post comments

BrunoC wrote:Chris, what is the "low level wipe" you intend to perform? Will it do anything better (or faster) than using one of the various products that will wipe free space.
Hi Bruno,
I'm a developer, and I made a quick drive wiper application that simply writes zeros to the entire drive. I built it so that I could have something extremely light-weight and as fast as the drive can write... that just runs in the background while I work (my experience with commercial drive wipers is that you usually have to boot to them separately, which means that I have to devote my entire machine to wiping a drive, which is just silly, as that requires almost zero resources).
In the long run, I didn't wind up doing this, because the specific machines that I got didn't have the ability to restore themselves to out-of-box-experience... so I just wiped the drives and then installed a fresh copy of Windows. This theory was really for the case where I have a machine that is able to restore itself, but I do not have the key or the specific Windows install necessary. So for now, it remains an untested theory :-)
Thanks,
Chris
- Log in to post comments