Q Recently, I read the Which? article on erasing hard drives: www.theregister.co.uk/2009/01/08/hard_drive_hammer_destruction. I know that the Which? advice, which recommends taking a hammer to old drives, is a shade excessive, but what would your advice be? I'd normally use Darik's Boot And Nuke (DBAN), but lately I've started using dd to zero out a drive. The Great Zero Challenge information at http://16systems.com/zero.php explicitly says that using dd to zero the drive is pretty much a guarantee that the data isn't recoverable.
After I found that out, I used dd to zero a drive and then ran the Ontrack disk recovery program for over two weeks without finding a single byte of data. Do you know if it's better to use /dev/urandom rather than
/dev/zero for the input, though?
A It's true that deleting files doesn't adequately remove their contents, but Which? magazine is also correct in stating the only way to guarantee that data won't be recovered is to destroy the drive. After all, TestDisk can easily recover the contents of deleted files and even blanking with zeros is considered insufficient defence against forensic data recovery equipment. That said, smashing your hard drive with a hammer isn't a good idea, however satisfying it may feel. Even if you don't get hit by flying shrapnel, destroying a drive in this manner is quite environmentally unsound.
Ultimately, the lengths you need to go to will depend on the value of your data. No one's going to waste their time and use expensive forensic equipment to recover your holiday snaps (regardless of how good they are), but confidential company information is another matter. Again, though, the data isn't usually sensitive enough to justify physically shredding the drive. There's another aspect to consider here as well: if you're storing personal data about others - be they co-workers, minors, dependents or any other person - you are liable for the security of that information under the Data Protection Act.
You've mentioned Darik's Boot And Nuke and this is an excellent tool for completely and thoroughly erasing all data from a drive - far more so than a simple overwriting of zeros. Running DBAN over a hard disk may take longer, but that's just a sign of how thorough it is. You also get the confidence boost of trusting the details of your data erasure to people who understand what's really needed. So, it really depends on how important this process is to you and how much time you feel it deserves.
A simple zeroing will stop roughly 99% of attempts to recover data - ask yourself, is that enough for you?
If you're storing sensitive data, you should also consider using filesystem encryption in the first place. Not only does it protect your data in the event of the theft or loss of your computer (desktop computers get stolen as well as laptops, so they're worth encrypting too), but it adds an extra layer to the recovery process after erasure. This is due to the fact that any recovery attempt will only find encrypted data, leaving yet more work to do to get at the real data. You only need to make it more effort to access your data than the data is worth to effectively protect yourself and others, so the 100% certainty of a destroyed drive is unnecessary unless you work for the security services or a crime syndicate.