Geekzone: technology news, blogs, forums
Guest
Welcome Guest.
You haven't logged in yet. If you don't have an account you can register now.


DarthKermit

5346 posts

Uber Geek

Trusted

#243755 30-Dec-2018 11:34
Send private message

I was just reading an article on Stuff about a teacher accused of inappropriate behaviour and it occurred to me to wonder if it's easier to cover one's tracks or not.

 

I know that even if you write over the contents of a HDD, some traces of the previous data can sometimes be recovered.


Create new topic
robjg63
4096 posts

Uber Geek

Subscriber

  #2152224 30-Dec-2018 13:37
Send private message

Well it's more that the OS won't actually remove the data from the disk. Ie it doesn't go and overwrite the area where the file(s) were. It just removes the pointers/indexes. So using the right tools you can "find" the deleted files assuming nothing else has used that part of the file system. I assume ssd drives would be the same.

A data wiping tool would erase all the zeroes and ones and normally make the file content be removed completely.
But there have been instances on conventional hdd drives where even wiped (overwritten) files could be recovered due to how hdd drives work. I don't think that same recovery method would apply to an ssd.




Nothing is impossible for the man who doesn't have to do it himself - A. H. Weiler




Hammerer
2476 posts

Uber Geek

Lifetime subscriber

  #2152230 30-Dec-2018 13:59
Send private message

If you really want to cover your tracks then you should use full drive-level encryption for all SSDs and HDDs.

 

SSDs are more difficult to erase to ensure that all user data has been erased. The electronic logic in SSDs does more than that in HDDs. This included copying data to other locations to improve wear leveling. The original data is not erased because that would increase wear for no immediate benefit to the SSD owner.

 

But SSDs are easier to permanently destroy - you can pulverise them with a hammer or vice (U.S. vise).

 

There are many articles on the topic but most I've read from tech companies and "experts" have been rather misleading. Here's one good discussion of key points: Can wiped SSD data be recovered? 

 

 


  #2152239 30-Dec-2018 14:11
Send private message

Drive shredder only way to make sure data will never be recovered.

 

 





Ding Ding Ding Ding Ding : Ice cream man , Ice cream man




andrewNZ
2487 posts

Uber Geek
Inactive user


  #2152249 30-Dec-2018 14:43
Send private message

Mspec:

Drive shredder only way to make sure data will never be recovered.


 


Or you get a self destructing SSD like the RunCore Invincible. They physically destroy the storage chips with the push of a button.

Batman
Mad Scientist
29760 posts

Uber Geek

Trusted
Lifetime subscriber

  #2152302 30-Dec-2018 15:35
Send private message

andrewNZ:
Mspec:

 

Drive shredder only way to make sure data will never be recovered.

 

 

 

 

 


Or you get a self destructing SSD like the RunCore Invincible. They physically destroy the storage chips with the push of a button.

 

Should have been called Mission:Impossible


richms
28168 posts

Uber Geek

Trusted
Lifetime subscriber

  #2152318 30-Dec-2018 16:03
Send private message

SSDs will map space in and out of use as part of wear levelling, so there will be traces of past overwritten data that the OS cannot directly overwrite on the flash chips themselves.

 

 

 

In these cases of proving stuff was on the PC etc they just have to locate a small fraction of one file they suspect the guy has on there is in place on one of those chips. Trim support means that the OS just marks the sector as unused and the controller will just artificially return an blank block for any read of that sector. The data is still in the chip till it decides to erase that block to reuse, which will generally be when the rest of the sectors in that block get moved to others and the block can then be erased.

 

HDDs also have faulty sectors that get mapped out, but there may only be a few tens of them on a drive and the chances of data being in the fault ones that you want are way lower as a result. On the SSD there is a much better chance since you assume the suspect would have deleted the files so they would have been trimmed and be sitting there in a block of flash among other sectors that are still in use.

 

And recovering things from an overwritten HDD is a myth that persists from the days of 40 megabyte MFM harddrives with mechanical steppers. Any ability to read something overwritten would be capacity that is not being used and that is constantly being pushed to the limits. With shingled recording things are being overwritten and using the edges of the magnatisim remnants from the previous pass by the drive itself to boost capacity.





Richard rich.ms

Aredwood
3885 posts

Uber Geek


  #2152325 30-Dec-2018 16:23

The OS itself is also a significant source of data leakage. Virtual memory and hibernation pagefiles are the most common ones.





 
 
 

Cloud spending continues to surge globally, but most organisations haven’t made the changes necessary to maximise the value and cost-efficiency benefits of their cloud investments. Download the whitepaper From Overspend to Advantage now.
  #2152350 30-Dec-2018 18:43
Send private message

If you read the NZ Information Security Manual (on the GCSB website https://www.gcsb.govt.nz/publications/the-nz-information-security-manual/) you will see the only approved way to de-classify a classified SSD is to destroy it.
There is no approved way to "wipe" or otherwise erase it.

Nuff said?

  #2152405 30-Dec-2018 21:54
Send private message

Hahahaha I love this video where she says I just want to stand back from it a little. Yup real mission impossible.

 

 

 





Ding Ding Ding Ding Ding : Ice cream man , Ice cream man


andrewNZ
2487 posts

Uber Geek
Inactive user


  #2152446 30-Dec-2018 22:23
Send private message

When I googled to find this device again, I saw mention of ones you can SMS nuke...

Boy do I want to find someone with one of those.

amiga500
1484 posts

Uber Geek
Inactive user


  #2152478 31-Dec-2018 07:23
Send private message

I've found that what is easily recoverable from a conventional hard drive by using Recuva from Piriform or Linux Photorec, seems to have gone  if you have deleted it from a SSD.  Of course this may be just a limitation of consumer level software - I have no idea.


richms
28168 posts

Uber Geek

Trusted
Lifetime subscriber

  #2152554 31-Dec-2018 10:22
Send private message

amiga500:

 

I've found that what is easily recoverable from a conventional hard drive by using Recuva from Piriform or Linux Photorec, seems to have gone  if you have deleted it from a SSD.  Of course this may be just a limitation of consumer level software - I have no idea.

 

 

You are only seeing what the controller chip wants you to see, you read a block marked as deleted and you get emptyness back. Its still in the chips awaiting the next shuffle around of data for wear levelling which is why the places that have the real recovery gear can get a hell of a lot back off an SSD





Richard rich.ms

MadEngineer
4271 posts

Uber Geek

Trusted

  #2152558 31-Dec-2018 10:50
Send private message

Aredwood: The OS itself is also a significant source of data leakage. Virtual memory and hibernation pagefiles are the most common ones.
Fortunately Windows has disabled hibernation for quite a while now if it detects an SSD drive.  You'd be a fool to enable it with an SSD





You're not on Atlantis anymore, Duncan Idaho.

xpd

xpd
Geek @ Coastguard NZ
13765 posts

Uber Geek

Retired Mod
ID Verified
Trusted
Lifetime subscriber

  #2152566 31-Dec-2018 11:23
Send private message

Batman:

 

andrewNZ:
Mspec:

 

Drive shredder only way to make sure data will never be recovered.

 

 

 

 

 


Or you get a self destructing SSD like the RunCore Invincible. They physically destroy the storage chips with the push of a button.

 

Should have been called Mission:Impossible

 

 





       Gavin / xpd / FastRaccoon / Geek of Coastguard New Zealand

 

                      LinkTree

 

 

 


xpd

xpd
Geek @ Coastguard NZ
13765 posts

Uber Geek

Retired Mod
ID Verified
Trusted
Lifetime subscriber

  #2152567 31-Dec-2018 11:25
Send private message

Common misconception is that reinstalling an OS will cover everything - wrong. On older OS'es anyway.

 

I once backed up a friends Win98 system, then formatted it and reinstalled Win98.... then discovered the backup was corrupt. (Yes I know, shouldve checked it first)

 

Ran Recuva or similar and managed to pull back all their documents/photos from the original HDD. No data loss.

 

 





       Gavin / xpd / FastRaccoon / Geek of Coastguard New Zealand

 

                      LinkTree

 

 

 


Create new topic





News and reviews »

Air New Zealand Starts AI adoption with OpenAI
Posted 24-Jul-2025 16:00


eero Pro 7 Review
Posted 23-Jul-2025 12:07


BeeStation Plus Review
Posted 21-Jul-2025 14:21


eero Unveils New Wi-Fi 7 Products in New Zealand
Posted 21-Jul-2025 00:01


WiZ Introduces HDMI Sync Box and other Light Devices
Posted 20-Jul-2025 17:32


RedShield Enhances DDoS and Bot Attack Protection
Posted 20-Jul-2025 17:26


Seagate Ships 30TB Drives
Posted 17-Jul-2025 11:24


Oclean AirPump A10 Water Flosser Review
Posted 13-Jul-2025 11:05


Samsung Galaxy Z Fold7: Raising the Bar for Smartphones
Posted 10-Jul-2025 02:01


Samsung Galaxy Z Flip7 Brings New Edge-To-Edge FlexWindow
Posted 10-Jul-2025 02:01


Epson Launches New AM-C550Z WorkForce Enterprise printer
Posted 9-Jul-2025 18:22


Samsung Releases Smart Monitor M9
Posted 9-Jul-2025 17:46


Nearly Half of Older Kiwis Still Write their Passwords on Paper
Posted 9-Jul-2025 08:42


D-Link 4G+ Cat6 Wi-Fi 6 DWR-933M Mobile Hotspot Review
Posted 1-Jul-2025 11:34


Oppo A5 Series Launches With New Levels of Durability
Posted 30-Jun-2025 10:15









Geekzone Live »

Try automatic live updates from Geekzone directly in your browser, without refreshing the page, with Geekzone Live now.



Are you subscribed to our RSS feed? You can download the latest headlines and summaries from our stories directly to your computer or smartphone by using a feed reader.