Securely wiping a drive with DD, /dev/zero or /dev/urandom?

Question

I have to securely wipe all data from a hard drive as I'm going to give it away. I plan on using the dd under linux utility to do so, after a little bit of research, I found two ways of doing so:

• dd if=/dev/zero of=/dev/sde Will overwrite the WHOLE hard drive with 0 characters, this technique apparently makes data easier to recover, althought still hard to pull of.
• dd if=/dev/urandom of=/dev/sde Will overwrite the WHOLE hard drive with random data.

Which one of these two technique is the best? Would overwriting the whole hard drive with random data put to much strain on it?

Solution

In practice using either will work similay only a modern drive (with caveats below) however using /dev/urandom is slower and safer. Slower because it needs to build entropy, safer because it prevents the (practical on very old drives) attack of amplifying the read signal to recover and differentiate a 1 from a 0. The reality is data is spaced so close together on modern drives the zero amplification attack can not work because drive tolerances are to tight and close to theoretical limits.

A more realistic issue with both solutions is that DD may not write parts of the drive marked bad and thus fragments of data might be recoverable.

Comments

[phuclv]

can you elaborate a bit on the attack? why do you need to read data when you're just writing new data into the drive?

[davidgo]

Analogy - Imagine using a pen to write a on a pad of paper. (secure data). You then remove the top sheet of paper. (Overwrite with 0's). I then get the blank pad. If you pressed hard enough, I could recover the writing from the blank pad by using a pencil to lightly rub over the area so as to expose where it was indented (amplify the signal coming from the heads). Old disks used enough of a magnetic field to allow this (by amplifying the read so a zero which was a one is different to a zero which was a zero), but newer disks cram more into same space (so less writing pressure)