forensic evidence storage

How to erase a drive – difference between full erase vs quick erase

What is the difference between all those erase modes? Do you feel confused every time when you want to erase a drive.

Let's talk about the difference among so many erase modes, and when to use them. When we talk about wiping a drive, we usually mention about different kinds of modes. The most common modes are quick, full, 3-pass DOD and 7-pass DOD.


Quick erase is used when you're in a hurry, cause it's the fastest option. Also, if you're going to write over the disk, just use quick erase would be enough, cause once the drives overwritten with something else, it would hardly get recovered. Basically, quick erase just simply remove the references to the tracks and session, it means that (most) data is still unaffected until is overwritten by other data, it just seems like it's empty. Therefore, quick erase is still possible to get recovered by using special tools.


Full erase, on the other hand, would clean data in all sectors of the disc by overwriting once, which means the old data is gone forever and make the whole disk erase back to the 'unwritten' state. There are no magical ways to find the data back anymore. Of course, compare to quick erase, it takes more time to erase.


DOD Erase (3 pass DOD), is rewriting with random bytes three times bit by bit. The content will not be retrieved by software anymore. The process as following: overwrites all addressable locations and indexing location three times on the drives with binary zeros, binary ones(complement) and random characters.


DOD Erase (7 pass DOD): 7-pass is actually what the military use, and only on mechanical hard drive. It's ensure using random data will do a complete job to prevent restoration of the data on the drive. It takes the longest time to finish.


‧ ‧ ‧


Multiple erase is usually used if you were selling/giving away the drives and you want to be 100% sure no one could ever access your data. Actually, overwriting a drive once would be hard to recover already. Most drive recovery companies can't recover a drive that has had it's data overwritten even once. If you don't have any other specially sensitive data, 3-pass DOD is enough for usual use. However, like the old saying says “always better safe than sorry”.
Above all, if the drives are no longer required, another simple method you can consider is to achieve data sanitation by physical destruction, such as degaussing, disintegrating etc.