How does writing zeroes to a drive remove data from it?

Question

I know a fair bit about the process of securely wiping drives, including that one wipe is usually sufficient and that no-one has yet (publicly) been able to recover a bit of data from one pass of zeroes, but I realise that I'm still none the wiser as to why actually writing zeroes - or any other pattern - to a HDD is sufficient to wipe it from data.

What exactly is happening when I write zeroes to a disk that purges it of data? Are the drive's bits being flipped, and if so, what exactly does that even mean?

Does the particular pattern being written affect it - is there a relation between the zeroes being written and the zeroes and ones (bits) that make up the drive?

Answer 1

What exactly is happening when I write zeroes to a disk that purges it of data?

You are overwriting data with those zeros.

A HDD is basically a sequence of bits. A single bit can hold either a single 0 or a single 1. These bits are used to store data. Each disk has a fixed number of them. The more bits there are, the larger the disk and more data can be stored.

Your data is stored on the disk by setting these bits to zeros and ones. Computer programs know how to interpret them to make sense of data.

Writing zeros (or something else) to the disk replaces previous bit values with new values, overwriting what was previously there with the new values.

With SSDs it's a bit more complicated and overwriting them is not a reliable method of erasing them securely.

Answer 2

Any pattern is as good as the zeroes. There is nothing special about zeroes.

The idea is to set every bit on the disk, not only allocated sectors, because unallocated (but used previously) sectors can still have left-over data in them.

Zero is just the easiest constant to write, just one character - 0, but 1 to 9 would all be equally good (but perhaps psychologically expressing less the idea of "nothing").

Answer 3

The simple answer is that it's (mostly, see below) the same as covering an entire printed page with correction fluid, you're just replacing the information that's there with blank space.

The exact pattern technically does not matter in most cases, as any overwrite of a byte on a storage device will replace what's stored there. For traditional hard-drives zeroes are historically preferred because that results in the appearance of blank media, though some people preferentially use random data (this is preferred if you're going to re-use the media with full-disk encryption, as it will hide how much data you've got stored on the device), and for some flash drives it's better to use bytes with all the bits set (because that's how an unprogrammed cell of certain types of flash memory looks).

However, just like with correction fluid, this does not guarantee that the data can't be recovered, and even if it does prevent recovery of the exact data, it usually does not remove evidence that there was ever any data there. Most modern storage devices do some form of remapping of bad sectors/blocks/bytes, and old data can still inger in those previously used and now bad areas of the media. Similarly, for some types of media, there are actual irreversible physical changes that result from writing to the media (for example, flash storage degrades a bit each time it's written to), though this may be difficult to detect without destructive testing of the media.

Additionally, with some media types, the actual data being 'overwritten' may not in fact get overwritten for quite some time afterwards. Due to the above mentioned degradation of flash media each time it's written to, most flash storage devices utilize a virtual block mapping to prevent the same physical cells of flash memory from being overwritten more than other cells of flash memory, with the net result being that a write to a flash storage device usually writes to a new empty physical location and then marks the old physical location for that address as empty.

Answer 4

Binary is made up of ones and zeros, one being true or on and zero being false or off. We refer to these as bits. 8 of these bits makes up a byte. 1024 bytes makes up a kilobyte, etc.

When you write a zero, you are essentially turning off that byte. Although this is useful if you simply want to destroy data, it's not useful if you want to make it look like there is nothing there. Writing zeros to a drive can be construed as intentional destruction.

Therefore, it's better, from a standpoint of plausible deniability, to evoke a random write pattern, randomly writing ones and zeroes to the drive. If your drive is ever captured, it will simply look like random data.