Are solid state drives easier to wipe clean vs. hard disc drives?

Forums › Desktop computing › Are solid state drives easier to wipe clean vs. hard disc drives?

DarthKermit

5346 posts

Uber Geek

Trusted

#243755 30-Dec-2018 11:34

I was just reading an article on Stuff about a teacher accused of inappropriate behaviour and it occurred to me to wonder if it's easier to cover one's tracks or not.

I know that even if you write over the contents of a HDD, some traces of the previous data can sometimes be recovered.

robjg63

4096 posts

Uber Geek

Subscriber

#2152224 30-Dec-2018 13:37

Well it's more that the OS won't actually remove the data from the disk. Ie it doesn't go and overwrite the area where the file(s) were. It just removes the pointers/indexes. So using the right tools you can "find" the deleted files assuming nothing else has used that part of the file system. I assume ssd drives would be the same.

A data wiping tool would erase all the zeroes and ones and normally make the file content be removed completely.
But there have been instances on conventional hdd drives where even wiped (overwritten) files could be recovered due to how hdd drives work. I don't think that same recovery method would apply to an ssd.

Nothing is impossible for the man who doesn't have to do it himself - A. H. Weiler

Hammerer

2476 posts

Uber Geek

Lifetime subscriber

#2152230 30-Dec-2018 13:59

If you really want to cover your tracks then you should use full drive-level encryption for all SSDs and HDDs.

SSDs are more difficult to erase to ensure that all user data has been erased. The electronic logic in SSDs does more than that in HDDs. This included copying data to other locations to improve wear leveling. The original data is not erased because that would increase wear for no immediate benefit to the SSD owner.

But SSDs are easier to permanently destroy - you can pulverise them with a hammer or vice (U.S. vise).

There are many articles on the topic but most I've read from tech companies and "experts" have been rather misleading. Here's one good discussion of key points: Can wiped SSD data be recovered?

JaseNZ

2576 posts

Uber Geek

ID Verified

Lifetime subscriber

#2152239 30-Dec-2018 14:11

Drive shredder only way to make sure data will never be recovered.

Ding Ding Ding Ding Ding : Ice cream man , Ice cream man

andrewNZ

2487 posts

Uber Geek
Inactive user

#2152249 30-Dec-2018 14:43

Mspec:
Drive shredder only way to make sure data will never be recovered.

Or you get a self destructing SSD like the RunCore Invincible. They physically destroy the storage chips with the push of a button.

Batman

Mad Scientist
29760 posts

Uber Geek

Trusted

Lifetime subscriber

#2152302 30-Dec-2018 15:35

andrewNZ:
Mspec:

Drive shredder only way to make sure data will never be recovered.

Or you get a self destructing SSD like the RunCore Invincible. They physically destroy the storage chips with the push of a button.

Should have been called Mission:Impossible

richms

28168 posts

Uber Geek

Trusted

Lifetime subscriber

#2152318 30-Dec-2018 16:03

SSDs will map space in and out of use as part of wear levelling, so there will be traces of past overwritten data that the OS cannot directly overwrite on the flash chips themselves.

In these cases of proving stuff was on the PC etc they just have to locate a small fraction of one file they suspect the guy has on there is in place on one of those chips. Trim support means that the OS just marks the sector as unused and the controller will just artificially return an blank block for any read of that sector. The data is still in the chip till it decides to erase that block to reuse, which will generally be when the rest of the sectors in that block get moved to others and the block can then be erased.

HDDs also have faulty sectors that get mapped out, but there may only be a few tens of them on a drive and the chances of data being in the fault ones that you want are way lower as a result. On the SSD there is a much better chance since you assume the suspect would have deleted the files so they would have been trimmed and be sitting there in a block of flash among other sectors that are still in use.

And recovering things from an overwritten HDD is a myth that persists from the days of 40 megabyte MFM harddrives with mechanical steppers. Any ability to read something overwritten would be capacity that is not being used and that is constantly being pushed to the limits. With shingled recording things are being overwritten and using the edges of the magnatisim remnants from the previous pass by the drive itself to boost capacity.

Richard rich.ms

Aredwood

3885 posts

Uber Geek

#2152325 30-Dec-2018 16:23

The OS itself is also a significant source of data leakage. Virtual memory and hibernation pagefiles are the most common ones.

Equinox IT

Cloud spending continues to surge globally, but most organisations haven’t made the changes necessary to maximise the value and cost-efficiency benefits of their cloud investments. Download the whitepaper From Overspend to Advantage now.

PolicyGuy

1726 posts

Uber Geek

ID Verified

Lifetime subscriber

#2152350 30-Dec-2018 18:43

If you read the NZ Information Security Manual (on the GCSB website https://www.gcsb.govt.nz/publications/the-nz-information-security-manual/) you will see the only approved way to de-classify a classified SSD is to destroy it.
There is no approved way to "wipe" or otherwise erase it.

Nuff said?

JaseNZ

2576 posts

Uber Geek

ID Verified

Lifetime subscriber

#2152405 30-Dec-2018 21:54

Hahahaha I love this video where she says I just want to stand back from it a little. Yup real mission impossible.

Ding Ding Ding Ding Ding : Ice cream man , Ice cream man

andrewNZ

2487 posts

Uber Geek
Inactive user

#2152446 30-Dec-2018 22:23

When I googled to find this device again, I saw mention of ones you can SMS nuke...

Boy do I want to find someone with one of those.

amiga500

1484 posts

Uber Geek
Inactive user

#2152478 31-Dec-2018 07:23

I've found that what is easily recoverable from a conventional hard drive by using Recuva from Piriform or Linux Photorec, seems to have gone if you have deleted it from a SSD. Of course this may be just a limitation of consumer level software - I have no idea.

richms

28168 posts

Uber Geek

Trusted

Lifetime subscriber

#2152554 31-Dec-2018 10:22

amiga500:

I've found that what is easily recoverable from a conventional hard drive by using Recuva from Piriform or Linux Photorec, seems to have gone if you have deleted it from a SSD. Of course this may be just a limitation of consumer level software - I have no idea.

You are only seeing what the controller chip wants you to see, you read a block marked as deleted and you get emptyness back. Its still in the chips awaiting the next shuffle around of data for wear levelling which is why the places that have the real recovery gear can get a hell of a lot back off an SSD

Richard rich.ms

MadEngineer

4271 posts

Uber Geek

Trusted

#2152558 31-Dec-2018 10:50

Aredwood: The OS itself is also a significant source of data leakage. Virtual memory and hibernation pagefiles are the most common ones.

Fortunately Windows has disabled hibernation for quite a while now if it detects an SSD drive. You'd be a fool to enable it with an SSD

You're not on Atlantis anymore, Duncan Idaho.

xpd

Geek @ Coastguard NZ
13765 posts

Uber Geek

Retired Mod

ID Verified

Trusted

Lifetime subscriber

#2152566 31-Dec-2018 11:23

Batman:

andrewNZ:
Mspec:

Drive shredder only way to make sure data will never be recovered.

Or you get a self destructing SSD like the RunCore Invincible. They physically destroy the storage chips with the push of a button.

Should have been called Mission:Impossible

Gavin / xpd / FastRaccoon / Geek of Coastguard New Zealand

LinkTree

xpd

Geek @ Coastguard NZ
13765 posts

Uber Geek

Retired Mod

ID Verified

Trusted

Lifetime subscriber

#2152567 31-Dec-2018 11:25

Common misconception is that reinstalling an OS will cover everything - wrong. On older OS'es anyway.

I once backed up a friends Win98 system, then formatted it and reinstalled Win98.... then discovered the backup was corrupt. (Yes I know, shouldve checked it first)

Ran Recuva or similar and managed to pull back all their documents/photos from the original HDD. No data loss.

Gavin / xpd / FastRaccoon / Geek of Coastguard New Zealand

LinkTree