Re: Destruction of electronic records

["Peter Graham, RUL" <psgraham@gandalf.rutgers.edu>]

From:  Peter Graham, Rutgers University Libraries
The following will be of interest to a subset of ExLibris; it concerns the
ability to retrieve "erased" information on magnetic media.  The ability
exists, it is widespread, and it is expensive.   (This too is
forwarded from ERECS-L, the electronic records discussion list.)  --pg
***********************************************************************
                ---------------
Date:         Mon, 15 Apr 1996 12:28:04 -0400
Sender: Management & Preservation of Electronic Records
              <ERECS-L@CNSIBM.ALBANY.EDU>
Subject:      (Fwd) Re: Destruction of electronic records -- reply
From: HAROLD E. THIELE <HTHEILE@sec.state.vt.us>
To: erecs-l@CNSIBM.ALBANY.EDU
Subject: (Fwd) Re: Destruction of electronic records -- reply

Alan Zaben asked me to share my comments with the entire list.

------- Forwarded Message Follows -------

To:            survivor@indirect.com
Subject:       Re: Destruction of electronic records -- reply
Date:          Fri, 12 Apr 1996 09:03:05 EST

Alan,

> However, at the ARMA Rio Grande Chapter's annual conference today, Curtis
> Karnow, a lawyer from California, told us that the technology exists to make
> it possible to recover a file, even after it has been 'wiped'.  It is the
> first time I have heard that.  Anyone heard about it?

There are a small number of computer firms (often associated with law
firms) that specialize in retrieving erased, expunged, or damaged
data.  In fact some of the utilities on your system designed to
'repair' or 'recover' missing or damaged data are simple underpowered
versions of what these firms do.  The word of mouth information I
have is that they have been able to recover data from drives and
other forms of media that have been reformatted three or four times.
They are also able to recover data from media that have been exposed
to severe environmental stress.  This service is very expensive.  It
is my understanding that the DoD and related Intelligent Services
require that media be shredded and then reduced by fire or chemical
treatment to ensure that the data can not be recovered.

Related to this was a demonstration a few weeks ago on one of the pop
science programs on TV.  They took a PC and threw it into a pond (I
was unclear wither it was fresh, salt, or brackish).  After a month
or more of submersion, they retrieved the PC and sent it to a firm
that specializes in this area.  They were able to recover the entire
contents of the hard drive.  It only cost $1000 for this single hard
drive.

When I was living in Austin, TX,  I had a drive crash, and I called
the local computer store to see if the data could be recovered.  They
were able to give me a list of four or five local companies that had
expertise in this area,   I contacted several of them, and they all
said that they could recover the information on the drive.  The least
expensive one used a version of Norton utilities, and they charged
only $100 per hour with NO guarantees.  At that point I decided that
I really didn't need the missing data.  Luckily I had backups for
every thing except for the latest inputs.  I could live with that.

2nd note:  The Federal government was recycling old computers by
reformatting the drives (the ultimate media wipe) and then selling
them through the salvage market.  When the Feds found out that people
were getting the old drives and recovering data from them, they stopped
the recycling program for all areas that dealt with 'sensitive'
materials.  In these programs they require that the drives be
physically destroyed before the old PC is released to the reseller
markets.

What is happening now is that the techniques developed by NASA and
the astronomical community to resolve or 'clarify' data from
background noise is being used to recover data from various types of
media.   In addition, the techniques developed by NTSB to
recover information from the various types of data recorders on
airplanes, trains, etc. that survive the crashes and environmental
stress is becoming more available.  With the easy availability of
more and more powerful computers at very reasonable prices, these
techniques will become more widespread.

It doesn't matter what a vendor says about the ability of his/her
program to 'wipe' the data from what ever media you are talking
about.  There are people, techniques, and equipment out there that
can, for enough money, recover some if not most of the wiped data.
The only sure method is to copy the data you wish to keep to fresh
media, and then shred the old media and reduce it by either fire or
chemicals.  (Iran proved that you can not depend on shredding to
protect your materials.  With time and patience any shredded material
can be put back together again.  The archaeologists and
palaeontologists have been doing this for years)

Harold

Harold Thiele
Electronic Records Archivist
Vermont State Archives
htheile@sec.state.vt.us


Peter Graham    psgraham@gandalf.rutgers.edu    Rutgers University Libraries
169 College Ave., New Brunswick, NJ 08903   (908)445-5908; fax (908)445-5888
              <URL:http://aultnis.rutgers.edu/pghome.html>