ELi5: Why is overwriting computer memory with all 0s or all 1s not enough to render the data entirely irretrievable?

Question

I heard on another post something about 0-ing out computer memory not being enough to stop a digital forensics expert with enough time and dedication from recovering the data. They said you needed to overwrite the data randomly at least 7 times to render it completely irretrievable. This seems completely unnecessary to me, unless computer memory has some sort of physical “residual memory” where you could identify the last change made to that bit. And even if that is the case, why wouldn’t overwriting every bit to 0, then 1, then back to 0 work just as well?

In: Technology

Answer 1

The ‘7 overwrites to be completely irretrievable’ is mostly just an overabundance of caution.

For example, a single overwrite, there may be some residual charge left behind that could be interpreted as having previously being a 1 or 0. Enough so that strong forensics could make a more conclusive prediction.

It’s been awhile since I’ve read the specifics, but somewhere between 3 to 4 overwrites is enough to render virtually anything unrecoverable on the current tech of the time that it became a standard. However, the US government needing to be absolutely certain that even with current and future tech that they don’t know about (you know, the kind our adversaries *could* theoretically have), data *couldn’t* be recovered. They pretty much doubled (and rounded up) the average number of rewrites they found to be reliable in rendering data completely gone.

It wasn’t that at 6 overwrites they could still recover data but they couldn’t at 7….it was more of a “but what if our enemies have something we don’t know about and *can* recover data more reliably”.

Additionally, zeroing a drive isn’t that reliable in all honesty. If you only do it once or twice, you may still detect enough of a field anywhere there was a one to make the assumption that it used to be a one. Places that have weaker fields would likely have been a zero before the wipe. Realistically you don’t want to zero a drive….you want to overwrite it with random data multiple times and *then* zero, so even if they can recover anything it’ll just be a random assortment of 1s and 0s.

I’d add, for the average user a single overwrite/zero is enough to prevent your data from being recovered. Unless you have some high level forensics team trying to peek at your overwritten data, nobody is going to bother trying to recover something that’s been fully deleted.