2 cissp ® Official Study Guide Eighth Edition

Erasing 
Erasing
media is simply performing a delete operation against a fi le, a selection of 
fi les, or the entire media. In most cases, the deletion or removal process removes only the 
directory or catalog link to the data. The actual data remains on the drive. As new fi les are 
written to the media, the system eventually overwrites the erased data, but depending on the 
size of the drive, how much free space it has, and several other factors, the data may not be 
overwritten for months. Anyone can typically retrieve the data using widely available unde-
lete tools. 
Clearing 
Clearing
, or
overwriting
, is a process of preparing media for reuse and ensuring 
that the cleared data cannot be recovered using traditional recovery tools. When media is 
cleared, unclassifi ed data is written over all addressable locations on the media. One method 

---

174
Chapter 5 
■
Protecting Security of Assets
writes a single character, or a specific bit pattern, over the entire media. A more thorough 
method writes a single character over the entire media, writes the character’s complement 
over the entire media, and finishes by writing random bits over the entire media. It repeats 
this in three separate passes, as shown in Figure 5.2. Although this sounds like the origi-
nal data is lost forever, it is sometimes possible to retrieve some of the original data using 
sophisticated laboratory or forensics techniques. Additionally, some types of data storage 
don’t respond well to clearing techniques. For example, spare sectors on hard drives, sectors 
labeled as “bad,” and areas on many modern SSDs are not necessarily cleared and may still 
retain data.
F I g u r e 5 . 2
Clearing a hard drive
1
First character
2
Complement
3
Random bits
1010 0001
0101 1110
1101 0100