This is a professional analysis of secure data erasure. It comes from the Center for Magnetic Recording Research. It clearly sates that multiple writes are no more effective than a single write (I highlight the comments in the text). Full analysis is here: http://cmrr.ucsd.edu/people/Hughes/DataSanitizationTutorial.pdf TL;DR Physical destruction is the most secure data erasure method, but surprisingly, "simply bending a disk makes [data recovery] nearly impossible." Data Sanitization in Hard Disk Drives Four basic sanitization security levels can be defined: weak erase (deleting files), block erase (overwrite by external software), normal secure erase (current drives), and enhanced secure erase (see below). The CMRR at UCSD has established test protocols for software secure erase. Block erase is most commonly used. While it is significantly better than no erase, or file deletion, or drive formatting, it is vulnerable to malware and incomplete erasure of all data blocks. Examples are data blocks reassigned by drives, multiple drive partitions, host protected areas, device configuration overlays, and drive faults. Normal secure erase is approved by NIST 800-88 for legal sanitization of user data up to Confidential, and enhanced secure erase for higher levels. Enhanced level has only recently been implemented, initially in Seagate drives, and these drives are under evaluation by the CMRR. These four erasure protocols exist because users make tradeoffs between sanitization security level and the time required. A high security protocol that requires special software and days to accomplish will be avoided by most users, making it little used and of limited practical value. For example, the old data overwrite document DoD 5220 calls for multiple block overwrites of Confidential data, which can take more than a day to complete in today's large capacity drives. So users make tradeoffs between the time required to erase data and the risk that the next drive user may know and use recovery techniques which can access weakly erased data. For all but top-secret information, users will usually turn to erasure methods that take minutes rather than hours or days. They will select a method that gives them an acceptable level of security in a reasonable time window. Physical Drive Destruction To positively prevent data from recovery, disks can be removed from disk drives and broken up, or even ground to microscopic pieces. (Actually, simple disk bending is highly effective, particularly in emergency situations.) Obsolete government document DoD 5220 required physical destruction of the storage medium (the magnetic disks) for data classified higher than Secret. Even such physical destruction is not absolute if any remaining disk pieces are larger than a single 512-byte record block in size, about 1/125" in today's drives. As linear and track densities increases, the maximum allowable size of disk fragments become ever smaller. Destroyed disk fragments of this size have been studied by the CMRR. Magnetic microscopy is used to image stored recorded media bits. Some storage products are more easily destroyed than hard disk drives, such as magnetic disk data cartridges, tape cartridges, secure USB drives, and optical media. Disk Drive Degaussing Degaussers are used to erase magnetic data on disk drives. They create high intensity magnetic fields that erase all magnetic recordings in a hard disk drive, including the sector header information on drive data tracks (information necessary for drive head positioning and data error recovery). In addition, track and disk motor magnets are often also erased by degausser magnetic fields. Like physical destruction, when a disk drive has been successfully degaussed it is no longer useable. Drive designers continually increase the linear density of magnetic recording to create higher data storage capacity per disk. This raises the disk magnetic coercivity, the field required to write bits on the magnetic media. As the magnetic coercivity increases, the fields required to erase the data on recorded disks increases. Thus an older degausser may not fully erase data on a newer hard disk drive. New perpendicular recording drives may not be erasable by present degaussers designed for past longitudinal recording drives. Future generations of magnetic recording media may use very high magnetic coercivity disks to achieve areal densities greater than 500 gigabits per square inch. These drives may have technology using laser light in the magnetic write element of the disk drive, to raise the temperature of a spot on the magnetic medium in order to lower the magnetic coercivity to the point where the write element can record a bit on the very high coercivity magnetic media. For disk drives using this Heat or Thermally Assisted Magnetic Recording (HAMR/TAMR) technology the degausser field required to erase the disk drive at room temperatures may be impossible or impractical to achieve. In this case the drive may have to be physically destroyed. "Hybrid drives" are now being introduced for notebook or laptop computers that have flash memory write cache on hard disk drive circuit boards. Magnetic degaussing would not affect any resident data on such semiconductor memory chips. Data on these non-volatile semiconductors would have to be sanitized using some other technique. For all these reasons degaussing of all the data on hard disk drives will become increasingly impractical. Nondestructive Data Erasure Sanitization of data on a hard disk drive is not a simple task. Deleting a file merely removes its name from the directory structure's special disk sectors. The user data remains in the drive data storage sectors where it can be retrieved until the sectors are overwritten by new data. Reformatting a hard disk drive clears the file directory and severs the links between storage sectors, but the user data remains and can be recovered until the sectors are overwritten. Software utilities that overwrite individual data files or an entire hard drive are susceptible to error or malicious virus attack, and require constant modifications to accommodate new hardware and evolving computer operating systems. It is difficult for external software to reliably sanitize user data stored on a hard disk drive. Many commercial software packages are available using variations of DoD 5220, making as many as 35 overwrite passes. But in today's drives, MULTIPLE OVERWRITES ARE NO MORE EFFECTIVE THAN A SINGLE OVERWRITE. Off-track overwrites could be effective in some drives, but there is no such drive external command for a software utility to move heads offtrack. And even three overwrites can take more than a day to erase a large capacity hard disk drive. In busy IT facilities, such time is often not available and IT personnel are likely to take short cuts. DoD 5220 overwriting has other vulnerabilities, such as erasing only to a drive's Maximum Address, which can be set lower than its native capacity; not erasing reallocated (error) blocks; or miss extra partitions. External overwrites cannot access the reallocated sectors on most drives, and any data once recorded is left on these sectors. These sectors could conceivably be recovered and decoded by exotic forensics. While enterprise-class drives and drive systems (SCSI/FC/SAS/iSCSI) allow software commands to test all the user blocks for write and read ability, mass market drives (PATA/SATA) cannot read, write, or detect reassigned blocks since they have no logical block address for a user to access.