[roger_smith]

I understand who the NIST is. I'm just saying there is still some grey areas despite that.

I assume someone who is attempting to stay out of jail/prison would classify their information as high confidentiality. Based on this it sounds like clear techniques would not be suitable. But the clear techniques recommend 1 -2 overwrites for most devices, does continual reuse of the clear techniques on the device eventually lessen recovery? If 1-2 overwrites isn't the best choice for something with moderate + confidentiality, does 3-5, 7-10 overwrites make it suitable? Otherwise there's no reason to feel safer after re-writing when there's still too much risk unless you have the time/resources to purge and/or destroy.

I don't mean to undermine any of the work done here I'm just trying to point out where there might be grey areas for some people. I hope you understand what I'm getting at.

I believe I understand what you're getting at, but it's not really gray area. It ultimately depends on the risk appetite of the data owner. If they're willing to "take that chance" then that is their decision. They need to do a risk assessment and decide how much risk they are willing to live with, and apply the appropriate controls. In the case of Top Secret data, the US is unwilling to take a chance of that data being recoverable, regardless of the number of passes a clear or purge does. The only acceptable solution in terms of Top Secret data is total destruction of the storage media. They are planning not only for current known recovery methods, but potentially unknown methods as well.

As an end user, one has to decide the value of the data on their system, and how willing they are to "tempt fate" should that data fall into the wrong hands.

This document may be of interest to you. It shows the author attempting to recover data w/ the use of an electron microscope. He draws the conclusion that recovery of data after a number of write passes is infeasible.

https://www.vidarholen.net/~vidar/overwr...e_data.pdf

Now let me ask you this: How long do you think it takes to perform a wipe that effective on a modern hard drive? The answer is a VERY long time. When exploring DoD wipe standards for hard drives exceeding 1TB on a dedicated drive wiping machine, we had estimates of about 1 week to fully complete a wipe. Grab a Snickers...

Okay, I think I'm pretty much with you here. I'll read through that document after this post but I appreciate the friendly discourse from you and the information you find and share.

No problem friendo The main goal at the end of the day is learnings :-D