Blogger, trial lawyer, and self-described computer forensics/EDD special master Craig Ball has boldly traveled the “back roads of listservs and blogs”, and lived to blog another day. We are lucky that he survived; in a highly entertaining and informative read, Ball eviscerates the “flea bitten claim” that forensic examiners can recover overwritten data; apparently, threats to recover such data are mere puffery.
Ball’s blog, “Busting the Multipass Erasure Myth,” was posted March 26 on Law.com. In it, he traces the origin of the “myth” that data cannot be overwritten to a paper published in 1996 by Peter Gutmann. Ball reports that Gutmann developed a 35-pass overwriting process to eliminate data -- the “Gutmann Method erasure.” Not one to mince words, Ball pronounces that method “all a lot of hogwash.” There is no need to take 35 passes, says Ball, or anything close to it. Indeed, Ball goes so far as to say that only one overwrite is needed: “No tool and no technique extant today can recover overwritten data on 21st century hard drives. Nada. Zip. Zilch.”
So, contrary to popular belief, data really can be erased. But Ball's readers should make no mistake: Overwriting data is different than simply pressing "delete."