Wiping a computer

I need to wipe the university computer in my house before I leave. Ideally I would leave Windows/whatever but I don't really care as long as my data is as gone as it can be.

An internet search just confused me. Any advice short of torching the computer? 

Try a look at http://www.majorgeeks.com (which, by the way, is in our Links pages...)

It's a little easier to work with than download.com, and I know they offer deep-erasure and other security software. Some of it's even free...look for the word "freeware".

I just looked at this board, saw this tops and thought, 'whoa! That's what I want to do!'

Seems I may have had more 伏特加 than I give myself credit for.

In fact, you are the only poster on this board and we are all just figments of your (vodka-fuelled) imagination.   



CCleaner (formerly 'Crap Cleaner', hehe) cleans up all your unused files (internet cache, recylce bin etc) and cleans up your registry, but also offers a 'wipe free space' option with a maximum of 35 passes (someone elsewhere said 7 passes is sufficient to overwrite any old data, I think?).

I am guessing if one re-installs Windows and then runs CCleaner with all guns blazing, should be in the clear?

Well, that explains a few things - I think.

Uninstalling and reinstalling Windows is probably a little above my head. Can I run these things without doing that step?

I prefer to wipe mine with soap and a paper towel.  

It depends on the level of security you need.  Uninstalling programs, deleting your stuff, clearing the cache and browser history, followed by emptying the trash is enough to hide from typical annoying roommates.  Renaming all the files with a new and unusable extension (like xyz) before deletion can also help, since anyone successfully recovering them will need to waste even more time figuring out what program is needed to run each one.  Running a disk defrag afterwards adds a higher degree of security, since many of the sectors containing parts of your files will get overwritten.  Beyond that, if you feel paranoid, then those overwrite programs are a good idea if you can't fdisk, format, and reinstall.

One other thing to check on - does your computer automatically create restore points.  If so, that's something else you need to deal with.  Otherwise, all your privacy efforts might get undone with a few mouseclicks.

Of course, if you've been doing anything interesting enough to have your computer sent in for a CIA-equivalent recovery attempt, you should take a hammer to the hard drive and throw the remains into a smelter.  It probably won't help in those circumstances, since they've already been monitoring you anyway.  

'Fraid I'm a little too boring for any law enforcement folks to bother with my hard drive. More interested in keeping my stuff mine. I'll try all these things some time after I've gone to the roof to drink some beer.

If you want, when you cone to play with me, I'll get my students to show you how to KILL everything!!

Even robots? I'd like to zap robots!

But that does sound very useful. I know you leave all sorts of traces on a computer. Heck, I don't even care if Windows is uninstalled in the process. A blank computer is ok with me.

I can give you a virus.......   

I've had my shots! 

Thanks for the advice so far. Advice on which programs others have used is appreciated. I'll check out the various options and see how I go.

This is a common problem. There was a long thread on it on a tech writers' mailing list
http://web.techwr-l.com/pipermail/techwr-l/2008-November/033870.html

Here's one of my posts in that thread:

Nancy Allison <maker at verizon.net> wrote:

> I thought that reformatting the hard drive removes all data except for
> the most determined forensic investigator. If you have, or can borrow,
> someone's installation disk for your operating system, you can reformat
> the hard drive. If you have any doubt, reformat it a couple of times.

Unless you need to defend against professionals, that should do it.
Beware of a "quick format" which leaves most of the disk untouched,
though. Change the partitions to avoid that.

I'd use a different  OS than what you are running; just download a free
Linux or one of the BSD's
ubuntu.com, freebsd.org, netbsd.org, etc.

An easier way is to just download a free utility. That's what I'd do:
http://freshmeat.net/projects/dban/

The classic paper on recovering data from allegedly erased disks
is http://www.cs.auckland.ac.nz/~pgut001/pubs/secure_del.html
It recommends 35 writes with particular patterns of bits.

However, it is for defending against people who do things like
dismantling the disk and using custom-programmed disk
controllers to look for traces of data. Also, it was written in
1996, so it is probably out of date now.

Here's something I wrote on the topic in a newsgroup 10 years ago:

This comes up often enough to be a FAQ, but I'm not sure which FAQ
document would have it.

To do it really well is difficult.

For example, suppose the file is written & then a disk-check program
finds a bad block in it, copies data elsewhere & maps the bad block out.
Now nothing running on your OS sees that bad block, but it may contain
data which an attacker bypassing the OS could recover. You cannot defend
against that without bypassing the OS yourself to overwrite the block. Even
then, are you sure your overwrite worked, given that the block has problems?

This gets even harder if the disk drive is smart enough to map out bad blocks.
Does it even tell the controller about that?

You also have to be careful that everything gets physically written to the
disk. 20 overwrites are pretty ineffective if all they're doing is changing
data in a RAM cache.

There are also papers around on sophisticated attacks using specialised
hardware & measuring small differences in disk magnetism & . . . I don't
think there's a certain defense against them short of destroying the disk.

At one point, I had a copy of a US gov't standard for clearing off disks
with mildly secure stuff on them. The hard part was as above; dealing
with bad blocks & providing guarantees they'd been dealt with.

Also, little details. Suppose you have a six-block file that gets truncated
to 3.5 blocks by some user action. When it's later deleted, should your
overwrite do 3.5 blocks or 4? What about the other two blocks?

The easy part was just overwriting files. as I recall (this was years back),
that needed at least three writes, one all-0s, one all-1s & one random.

Two points I recall from the code I wrote:

    for( i = 0; i < 256 ; i += 85)

puts a byte through binary values:
    00000000
    0101010101
   1010101010
   11111111
which is handy.

You do the loops inside out. For any other application you might
do the file stuff in the outer loop & bit-fiddling in the inner. For this,
you write a function that writes the same byte to every byte of a
file, with frequent fflush()s & an fclose() at the end.

You then call that inside the for() loop above, four times with
different bytes each time, & a time or two with random data.

The computer at my first university position in China had a hard disk that had an Mb capacity less than the IQ of your average College student in China.
When the IT department refused to replace it my Head of English suggested that I do what he did to solve the problem:
Step 1. remove the Hard Drive
Step 2. put it in a bucket of water
Step 3. take it out and drain until water stops running
Step 4. re-install
Step 5. turn power on and stand back
Step 6. when the smoke clears take computer to IT department for repairs
Step 7. reclaim computer with new Hard Drive installed
It strikes me that this technique (up to Step 6) could also be used to keep your information secure ...... after the disk has been overwritten, re-partioned, reformatted, etc 

Step 1. remove the Hard Drive
Step 2. put it in a bucket of water
Step 3. take it out and drain until water stops running
Step 4. re-install
Step 5. turn power on and stand back
Step 6. when the smoke clears take computer to IT department for repairs
...
It strikes me that this technique (up to Step 6) could also be used to keep your information secure ...... after the disk has been overwritten, re-partioned, reformatted, etc

Against a serious attacker -- the intelligence agency of any major government, or whatever conspiracy you want to be paranoid about, or even a detective in a nasty divorce proceeding -- that almost certainly does not work.

You've fried the electric motor and/or the controller board, but the data is still on the platters. The enemy can replace the motor and controller and read everything.

Use a utility like dban, based on Guttman's paper, both references in my earlier post. Those techniques are designed to be secure even against an enemy who builds custom electronics and a custom read/write head to get absolutely everything off the disk.

If that's not enough, melting the disk to slag or grinding it to powder are the best ways. If you need to destroy it irrevocably, the bucket of water treatment is not thorough enough. 

melting the disk to slag or grinding it to powder are the best ways.

seems a bit extreme just to get rid of a bit of porn.