Re: Wipe Swap File

At 3:38 PM 1/20/96, Dr. Dimitri Vulis wrote:
>tallpaul@pipeline.com (tallpaul) writes:
>> Remember that one simple wipe is *not* secure. Current Department of
>> Defense security regs call for wiping the same space something like 8 or 9
>> times. Even then the wipe is not secure enough for higher level DofD
>> classified material. There the regs call for the physical destruction of
>> the medium after it has been wiped.
>
>Degaussing the media (running a household magnet over it :-) may be an option.

Ordinary household magnets fail for a couple of reasons:

1. Their field strength is not high enough to affect modern media, due to
the extremely high coercivity of modern media. (Try it out, you'll be
surprised at hard it is to really change a lot of bits with a household
magnet.)

2. Most "swap files," as used above, are of course on hard drives. Encased
in metal. In any case, the nearest a household magnet can get to the
surface is several centimeters. Unless the magnet is very large (such as
the 20-pounder I have from my childhood days), the field strength will drop
drastically in several centimeters.

(Modern disk drives, and even modern videotape machines, use very
high-coercivity coatings, including pure metal, and the heads must ride
very close to the media to flip the domains. A magnet several centimeters
away is effectively at infinity.)

3. A time-varying field is preferred. Bulk erasers work this way, by
plugging into an a.c. socket and generating a time-varying field. And even
these are getting harder to use to erase video tapes, for example, due to
the high coercivity of modern media. Most folks I know no longer even try
to bulk erase tapes.

>1. Does anyone know a cheap way to recover the traces of the previous
>(overwritten) recordings on the media?

There are custom drives for various media which have multiple heads, and
heads that can be "jogged" a little bit. This allows, I have read, the
subtle variations of multiple writes to be extracted.

Much more expensive would be various electron microscope-based imaging
methods to directly image the domains and extract subtle signs of past
write cycles.

--Tim May

Boycott espionage-enabled software!
We got computers, we're tapping phone lines, we know that that ain't allowed.
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay@got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Higher Power: 2^756839 - 1  | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."

tcmay@got.net (Timothy C. May) writes:
> >Degaussing the media (running a household magnet over it :-) may be an optio
>
> Ordinary household magnets fail for a couple of reasons:

I've just established experimentally that thoroughly running a household magnet
over a 3.5" floppy messed up less than 1/2 the sectors I tried to read.

Not a good option even for floppies.

(Actually, there _was a smiley up there)

> >1. Does anyone know a cheap way to recover the traces of the previous
> >(overwritten) recordings on the media?
>
> There are custom drives for various media which have multiple heads, and
> heads that can be "jogged" a little bit. This allows, I have read, the
> subtle variations of multiple writes to be extracted.
>
> Much more expensive would be various electron microscope-based imaging
> methods to directly image the domains and extract subtle signs of past
> write cycles.

I'll go on a tangent (this has more of a stego than crypto code relevance):

In the early '80s there was much activity related to floppy disk based
copy protection schemes (we got our first PC in Dec 81; most folks today
know dongles, but may not remember disk-based copy protection). The
original IBM PC came with 360K 5.25" floppy drives and a very smart
floppy disk controller chip that was capable of much more than what
the IBM BIOS normally asked of it; and even the BIOS was capable of
much more (floppy disk related) than PC DOS required.

One of the neater tricks I've seen were the so called "weak bits". One
could confuse the FDC and write a sector in such a way that when subsequently
someone read it, he saw 1's some of the times and 0's at other times.
Naturally, the FDC noted the CRC error on the sector. The copy protection
checker could read the sector several times into different buffers and see
that it got different results every time.

I rummaged around my archives and found an assembly program (about 10K)
that I once wrote (dated Jan 84) which I think did exactly this. I can
e-mail it to anyone who cares to take a look. (Disclaimer: I no longer remember
what it does, but I think this is the one with weak bits.)

I would not be very surprised if it turned out to be possible to confuse the
floppy disk controller (or some hard disk controllers) by software alone, so
that instead of operating "correctly" and reading the most recently written
data, it would operate "incorrectly" and pick up traces of the overwritten
bits from the media.

Jim Bell mentioned the trick of hiding information into 'extra' tracks and
sectors not used by the usual DOS formatting. It's very old too. I think I saw
copy protection schemes circa 1982 that hid important data on tracks 41--43.
360K diskettes normally had 40 tracks. If the diskette was copies by DISKCOPY,
it didn't know about the extra tracks, and the copy didn't have the info
(usually, a piece of the program). It's very easy to do with just BIOS calls to
format/read/write the track. Problem is, many cheap floppy drives these days
aren't capable of seeking beyond track 80 when the FDC asks them to. You can
write the data there and give the floppy to a friend who won't be able to read
it from there.

Microsoft uses a variation of this scheme when it formats its distribution
diskettes for some products with additional sectors on every track (and
presumably a smaller inter-sector gap, and good media). Some may recall that
the original PC DOS 1.x formatted disks with 8 sectors/track (for 160K/320K)
and 2.x and later started formatting 9 sectors. There was a popular hack to put
10 sectors on a track (including a DOS device driver to read such disks).
This too can be accomplished by BIOS without any FDC hacking.

(Thanks also to tallpaul for info on Vogons)

---

Dr. Dimitri Vulis
Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

Tim May writes:

> Much more expensive would be various electron microscope-based imaging
> methods to directly image the domains and extract subtle signs of past
> write cycles.

I recently took a tour of Park Scientific, the scanning-probe
microscopy people, in Sunnyvale.  One of their demo-stations
showed a small portion of a hard disk (taken with an AFM
tip fitted with a small magnet to generate the force).  Most
impressive.  (I did look closely at the edges of the track,
but saw no sign of previous writes.)

Cheers,
Peter Monta   pmonta@qualcomm.com
Qualcomm, Inc./Globalstar