OK, so, as a network engineer who has studied topics on encryption and security, I know damn well how easy it is to recover stuff like a highly compromising legal declaration, or let's be honest, that folder of lewd Japanese drawings of fictional girls, so in order to avoid this I religiously encrypt absolutely everything I wouldn't like others to see and I erase my hard drives' contents every week. The only thing that keeps me from using full disk encryption is the fact that Truecrypt doesn't supports dual-boot systems, and I require Windows because I'm a huge fan of Touhou Project in my experience it's been rather hard to get Touhou games running on Debian Wheezy (I've only managed to run EOSD, Imperishable Night and Mountain of Faith).

The erasure process goes like this:

• Weekly erasing: Just a quick pass of Eraser for Windows, then I fill my Linux partition with /dev/urandom noise and then I run sfill and sswap to clear anything that remained as well as my swap partition.
• Bi-weekly erasing: Create a Truecrypt volume spanning all the partitions' free space, run one pass of Eraser on them, then /dev/urandom, sfill and sswap on my Linux partitions.
• Monthly erasing: Eraser on Windows is run with Bruce Schneier's 7-pass method (encrypted), Linux erasure is done with 6 passes of encrypted /dev/urandom as well. This is finished with one final pass of encrypted /dev/urandom on everything.
• Annual erasing: Uses 35-pass Gutmann instead of Schneier's 7-pass. This is followed with 7 passes of encrypted /dev/urandom on all my drives' free space.

Destroying a drive with DBAN and restoring its contents with Clonezilla is out of the question because it would be extremely lengthy and I don't have that much time to spare.

Thing is, because I spend very little time at home these erasing cycles have been starting to become very time-consuming, so now I'm forced to cut back on my disk cleaning efforts. That, and I'm also starting to become far more careful to not save plaintext on my computer in the first place (I always open a private window on Chromium prior to browsing 4chan or Danbooru).

So, basically, the question is: are these disk cleaning procedures enough?

The question you really need to ask is, "what are you trying to protect against?"
Once you answer that question, you will be able to determine if your procedures are enough.

In my opinion, it sounds like your procedures would be sufficiently adequate against the types of situations most individuals would be likely to encounter. The best defense, of course, is to not have compromising data on your machine in the first place. As you pointed out, though, there is still information that, while legal, we would rather not have anyone else find for various legitimate reasons, e.g. tax returns. Keeping this data in a crypt volume would be your best bet. Under Windows, storing your documents in a Truecrypt volume is a good idea. Periodic wiping of the unused space, which I assume is what you are talking about is a reasonable precaution as Windows is notorious for leaving bits and pieces all over the place, such as links to recent documents, registry items, etc. You should also run a clean up utility like CC to remove unused links, registry keys, etc, which in general seems to help Windows performance. For Windows you may want to consider a commercial application, such as Data Defense which comes as close to whole drive encryption as your going to find coupled with data destruction should the machine wind up in the wrong hands, such as stolen. In my opinion, whole drive encryption isn't really necessary as there is probably little reason to encrypt the OS binary folders or boot sector, this applies to both Windows and Linux.

For Linux consider using automatic encryption of your home partition and you should be 99% of the way covered. A periodic wipe of your swap space won't hurt, but may be overkill.

As far as the method, simply overwriting the data with a pattern of all 1's, 0's, or random values a single time should be sufficient to render the data irrecoverable by all but those with resources beyond that of an individual. There have been several papers and articles on this subject, which you might seek out. Quite frankly, if you are facing this kind of threat, you've got bigger problems than periodic drive wiping or a forum can help you with. You should also be aware that these process work well with magnetic media, but not SSD media, where the only real option is to keep everything encrypted.

1 members found this post helpful.

get a second computer, remove it's harddrive (put it away, throw it away, whatever).

PC 1- fulling encrypted with truecrypt, windows installed. this is the computer you email your mom with and do your taxes. you do not surf the internet on this pc, and it get's no viruses (heh - that's the plan anyway).
if authorities demand you decrypt it, do so, there's nothing there to hide from them.
if someone steals it, you don't care, your tax information is encrypted with a 20+ character long phrase. no one will break this password while you're still alive.

PC 2 - the one without the harddrive. download and burn Tails.
use this computer to surf the net over TOR and do all of your illicit crap that you don't want anyone to know about.
without TOR - your ISP knows everything you've ever looked up on the internet.
without a harddrive - there's no local record of what you're doing.
read more about TOR and Anonymity here: http://cryptome.org/0005/tor-opsec.htm

1 members found this post helpful.

If I were that worried I would use an external drive and keep it in my instant erase box. Better yet I would stop visiting those sites.

You really don't need more than one or two passes at most on a modern hard drive. The multipass protocols were developed when there was a lot of variation and much looser tolerances in head alignment when writing to the disk, so several passes were needed to ensure all data, regardless of the head alignment, were overwritten. With the current areal density and drive tolerances of modern drives this really isn't necessary.

If your drives are already fully encrypted, you really don't need to keep wiping then at all. If you still wanted to a single pass of dd from /dev/urandom or /dev/zero would be plenty. If it will keep snoops out when it's in use it certainly will when it's erased.

As for dual-boot and Truecrypt, I multi boot as well and both the windows and *nix drives are all full encryption. The trick is to use separate drive for each OS, so that each may use the appropriate encryption scheme, rather than try and fit multiple FDE types (eg Truecrypt and LUKS) on a single drive.One can then use the BIOS alternate boot menu available on most systems to chose which to boot into.

If you're really worried get a hardware based FDE drive from Stonewood, Seagate or Toshiba, and flash keys from Ironkey.

To quote Pink FloydSo here are a couple of ideas.

Install your favorite OS as the host OS on the PC. For work such as your tax returns create a virtual machine with full disk encryption. I have Ubuntu 10.04 thus configured running under VMWare Player. All of the files associated with the virtual machine and its "disk" are encrypted. If you want to do your dirty work with Windoze try creating a large TrueCrypt container and install the VM into the container. To prevent leakage back to the host OS either encrypt the host swap space or just do not use swap if you have enough RAM.

Ken

p.s. Keep a large caliber handgun close to the computer in case you need to erase the disk in a hurry

You've been hanging out in carolinashootersforum and carolinashotersclub too much :P