Why are drives overwritten three times when being disposed of?

Question

I am looking at the secure disposal of old flash drives, and one of the standards I have come across says that they should be overwritten three times. Why is one time not enough? I assume doing the process three times is more expensive than doing it once.

Answer 1

Overwriting the data is either insufficient or useless, depending on how things are done internally by the device itself. Flash memory has a limited life, expressed in terms of read/write cycles. To sum it up, you can have one block of data full of zeros; bits can be changed from zero to one individually, but the reset to zero can be done only for a complete block at a time, and if you do it more than 10000 times or so, then the block fails down. Blocks have a size of a few dozens of kilobytes.

Thus, if Flash-based drives simply used a direct mapping from the logical sectors (as seen from the computer) to the Flash blocks, they would be slow and unreliable: each write of a sector over a previous value which is not all-zeros would entail reading the whole block, clearing it, then writing it back with the new sector value. Instead, Flash drives use wear levelling methods in which the writes get spread throughout the device blocks, so as to both minimize the number of required block clearings, and avoid having some blocks more used than others. Moreover, Flash drives often have more physical blocks than their nominal size, both to give some breathing room to the wear levelling algorithms, and to allow for remapping a few failed blocks, thus augmenting the drive lifetime when blocks begin to break down.

A consequence is that you cannot be sure, when you overwrite the whole disk, that you really wiped out all the data on the physical medium. In fact, if wear levelling is applied by the drive, then it is pretty much guaranteed that a single overwrite will not overwrite all traces of the data at the physical level, because there are more physical blocks than the logical total drive size.

Using three successive overwrites is an attempt at ensuring a more complete coverage. But it relies on some assumptions on how the wear levelling works, which may be unwarranted since there is no standard. Since the wear levelling is entirely handled by the drive itself, in its firmware, there is no reason for such algorithms to be standardized or even documented; one may even be so bold as to point out that wear levelling algorithms are part of the trade secrets of drive vendors, so they are unlikely to be all documented. Whether three overwrites are more than need, or, to the contrary, insufficient to ensure data destruction, is simply not known.

Moreover, if the drive remaps fails block transparently, then a failed block still contains mostly intact data, and since the firmware will thereafter avoid using that block, that data will remain in place until the end of times, regardless of how many overwrites you perform. That failed block is permanently out of reach of the host computer. (Note that this argument also applies to magnetic disks, but remapping of failed sectors is a rare event for classic disks, whereas it is very common in Flash drives.)

So the main benefit of the three overwrites is psychological. It is a very visible procedure that helps convince managers and auditors that security is happening, thereby justifying the corresponding budget line. If you want to really wipe out an old drive, burn it.

Answer 2

It's to remove any trace of the previous memory. Not an expert but here is what I understand.

Memory is stored in binary format : 0 and 1. So you can see your memory as a big array of 0 and 1 that we will call bits. Bits are not exactly 0 and 1, maybe 0.01 or 0.99 for example.

If a bit was 1 and you rewrite it to 0, it might be 0.02. On the other hand if a bit was 0 (0.01) before and you rewrite it to 0, it might still be 0.01. Hence, the previous 1 bit is leaving a trace that is possible to detect.

By rewriting it many times, you remove that trace.

Edit

This answer only apply to magnetic tapes which are no longer used in modern computer. Rewriting many times come from that time but now it's probably useless and only done by habits.

Answer 3

It is a futile thing to do as explained well by Tom Leek, but luckily it also isn't necessary. The idea of overwriting several times is very old, the intent being that there remains a residue when overwriting data on a magnetic medium. Overwriting several times would (should) make lab recovery harder or impossible.

All modern drives, including magnetic ones, regularly perform transparent remapping, and solid state drives stack wear levelling on top of that, so you do not really have a chance of knowing if you really overwrite what you think, nor what remains on the disk.
That is the reason why you will always want to make sure that critical security-relevant data is in a non-swappable memory area. Once on the disk, you can't control its lifetime any more.

Now for the good news...

Other than conventional harddisks which add forward error correction to the data, flash drives encrypt all data (well, they should anyway, and most do that). This has, apart from being a cool marketing gag (the "uses AES encryption" sticker on the box), two effects.

First, some wear-levelling algorithms work more efficiently, since all data is "random looking". Overall lifetime is increased.

Second, you can toss the drive's key away (depending on whom you ask, this may be called a factory reset, a secure wipe, or bare metal format, or some other fancy name -- the manufacturer's setup tool will do it). Doing so will render all data on the drive, including sectors that have been remapped, unreadable.