Geekzone: technology news, blogs, forums
Guest
Welcome Guest.
You haven't logged in yet. If you don't have an account you can register now.




4609 posts

Uber Geek
+1 received by user: 2574

Trusted

Topic # 243755 30-Dec-2018 11:34
Send private message quote this post

I was just reading an article on Stuff about a teacher accused of inappropriate behaviour and it occurred to me to wonder if it's easier to cover one's tracks or not.

 

I know that even if you write over the contents of a HDD, some traces of the previous data can sometimes be recovered.


Create new topic
2789 posts

Uber Geek
+1 received by user: 559


  Reply # 2152224 30-Dec-2018 13:37
Send private message quote this post

Well it's more that the OS won't actually remove the data from the disk. Ie it doesn't go and overwrite the area where the file(s) were. It just removes the pointers/indexes. So using the right tools you can "find" the deleted files assuming nothing else has used that part of the file system. I assume ssd drives would be the same.

A data wiping tool would erase all the zeroes and ones and normally make the file content be removed completely.
But there have been instances on conventional hdd drives where even wiped (overwritten) files could be recovered due to how hdd drives work. I don't think that same recovery method would apply to an ssd.




Nothing is impossible for the man who doesn't have to do it himself - A. H. Weiler

1866 posts

Uber Geek
+1 received by user: 478

Lifetime subscriber

  Reply # 2152230 30-Dec-2018 13:59
One person supports this post
Send private message quote this post

If you really want to cover your tracks then you should use full drive-level encryption for all SSDs and HDDs.

 

SSDs are more difficult to erase to ensure that all user data has been erased. The electronic logic in SSDs does more than that in HDDs. This included copying data to other locations to improve wear leveling. The original data is not erased because that would increase wear for no immediate benefit to the SSD owner.

 

But SSDs are easier to permanently destroy - you can pulverise them with a hammer or vice (U.S. vise).

 

There are many articles on the topic but most I've read from tech companies and "experts" have been rather misleading. Here's one good discussion of key points: Can wiped SSD data be recovered? 

 

 


 
 
 
 


1212 posts

Uber Geek
+1 received by user: 416

Subscriber

  Reply # 2152239 30-Dec-2018 14:11
One person supports this post
Send private message quote this post

Drive shredder only way to make sure data will never be recovered.

 

 





Ding Ding Ding Ding Ding : Ice cream man , Ice cream man


2040 posts

Uber Geek
+1 received by user: 1137


  Reply # 2152249 30-Dec-2018 14:43
One person supports this post
Send private message quote this post

Mspec:

Drive shredder only way to make sure data will never be recovered.


 


Or you get a self destructing SSD like the RunCore Invincible. They physically destroy the storage chips with the push of a button.




Location: Dunedin

Mad Scientist
19494 posts

Uber Geek
+1 received by user: 2569

Trusted
Lifetime subscriber

  Reply # 2152302 30-Dec-2018 15:35
One person supports this post
Send private message quote this post

andrewNZ:
Mspec:

 

Drive shredder only way to make sure data will never be recovered.

 

 

 

 

 


Or you get a self destructing SSD like the RunCore Invincible. They physically destroy the storage chips with the push of a button.

 

Should have been called Mission:Impossible





Swype on iOS is detrimental to accurate typing. Apologies in advance.


21709 posts

Uber Geek
+1 received by user: 4484

Trusted
Subscriber

  Reply # 2152318 30-Dec-2018 16:03
Send private message quote this post

SSDs will map space in and out of use as part of wear levelling, so there will be traces of past overwritten data that the OS cannot directly overwrite on the flash chips themselves.

 

 

 

In these cases of proving stuff was on the PC etc they just have to locate a small fraction of one file they suspect the guy has on there is in place on one of those chips. Trim support means that the OS just marks the sector as unused and the controller will just artificially return an blank block for any read of that sector. The data is still in the chip till it decides to erase that block to reuse, which will generally be when the rest of the sectors in that block get moved to others and the block can then be erased.

 

HDDs also have faulty sectors that get mapped out, but there may only be a few tens of them on a drive and the chances of data being in the fault ones that you want are way lower as a result. On the SSD there is a much better chance since you assume the suspect would have deleted the files so they would have been trimmed and be sitting there in a block of flash among other sectors that are still in use.

 

And recovering things from an overwritten HDD is a myth that persists from the days of 40 megabyte MFM harddrives with mechanical steppers. Any ability to read something overwritten would be capacity that is not being used and that is constantly being pushed to the limits. With shingled recording things are being overwritten and using the edges of the magnatisim remnants from the previous pass by the drive itself to boost capacity.





Richard rich.ms

3340 posts

Uber Geek
+1 received by user: 1339

Subscriber

  Reply # 2152325 30-Dec-2018 16:23
Send private message quote this post

The OS itself is also a significant source of data leakage. Virtual memory and hibernation pagefiles are the most common ones.





229 posts

Master Geek
+1 received by user: 109

Lifetime subscriber

  Reply # 2152350 30-Dec-2018 18:43
Send private message quote this post

If you read the NZ Information Security Manual (on the GCSB website https://www.gcsb.govt.nz/publications/the-nz-information-security-manual/) you will see the only approved way to de-classify a classified SSD is to destroy it.
There is no approved way to "wipe" or otherwise erase it.

Nuff said?

1212 posts

Uber Geek
+1 received by user: 416

Subscriber

  Reply # 2152405 30-Dec-2018 21:54
Send private message quote this post

Hahahaha I love this video where she says I just want to stand back from it a little. Yup real mission impossible.

 

 

 





Ding Ding Ding Ding Ding : Ice cream man , Ice cream man


2040 posts

Uber Geek
+1 received by user: 1137


  Reply # 2152446 30-Dec-2018 22:23
Send private message quote this post

When I googled to find this device again, I saw mention of ones you can SMS nuke...

Boy do I want to find someone with one of those.




Location: Dunedin

1208 posts

Uber Geek
+1 received by user: 307


  Reply # 2152478 31-Dec-2018 07:23
Send private message quote this post

I've found that what is easily recoverable from a conventional hard drive by using Recuva from Piriform or Linux Photorec, seems to have gone  if you have deleted it from a SSD.  Of course this may be just a limitation of consumer level software - I have no idea.


21709 posts

Uber Geek
+1 received by user: 4484

Trusted
Subscriber

  Reply # 2152554 31-Dec-2018 10:22
One person supports this post
Send private message quote this post

amiga500:

 

I've found that what is easily recoverable from a conventional hard drive by using Recuva from Piriform or Linux Photorec, seems to have gone  if you have deleted it from a SSD.  Of course this may be just a limitation of consumer level software - I have no idea.

 

 

You are only seeing what the controller chip wants you to see, you read a block marked as deleted and you get emptyness back. Its still in the chips awaiting the next shuffle around of data for wear levelling which is why the places that have the real recovery gear can get a hell of a lot back off an SSD





Richard rich.ms

1700 posts

Uber Geek
+1 received by user: 442


  Reply # 2152558 31-Dec-2018 10:50
Send private message quote this post

Aredwood: The OS itself is also a significant source of data leakage. Virtual memory and hibernation pagefiles are the most common ones.
Fortunately Windows has disabled hibernation for quite a while now if it detects an SSD drive.  You'd be a fool to enable it with an SSD


xpd

Chief Trash Bandit
9208 posts

Uber Geek
+1 received by user: 1463

Mod Emeritus
Trusted
Lifetime subscriber

  Reply # 2152566 31-Dec-2018 11:23
Send private message quote this post

Batman:

 

andrewNZ:
Mspec:

 

Drive shredder only way to make sure data will never be recovered.

 

 

 

 

 


Or you get a self destructing SSD like the RunCore Invincible. They physically destroy the storage chips with the push of a button.

 

Should have been called Mission:Impossible

 

 





XPD / Gavin / DemiseNZ

 

Server : i3-3240 @ 3.40GHz  16GB RAM  Win 10 Pro    Workstation : i5-3570K @ 3.40GHz  16GB RAM  Win 10 Pro    Console : Xbox One

 

https://www.xpd.co.nz - Games, geeks, and more.    


xpd

Chief Trash Bandit
9208 posts

Uber Geek
+1 received by user: 1463

Mod Emeritus
Trusted
Lifetime subscriber

  Reply # 2152567 31-Dec-2018 11:25
Send private message quote this post

Common misconception is that reinstalling an OS will cover everything - wrong. On older OS'es anyway.

 

I once backed up a friends Win98 system, then formatted it and reinstalled Win98.... then discovered the backup was corrupt. (Yes I know, shouldve checked it first)

 

Ran Recuva or similar and managed to pull back all their documents/photos from the original HDD. No data loss.

 

 





XPD / Gavin / DemiseNZ

 

Server : i3-3240 @ 3.40GHz  16GB RAM  Win 10 Pro    Workstation : i5-3570K @ 3.40GHz  16GB RAM  Win 10 Pro    Console : Xbox One

 

https://www.xpd.co.nz - Games, geeks, and more.    


Create new topic



Twitter »

Follow us to receive Twitter updates when new discussions are posted in our forums:



Follow us to receive Twitter updates when news items and blogs are posted in our frontpage:



Follow us to receive Twitter updates when tech item prices are listed in our price comparison site:



Geekzone Live »

Try automatic live updates from Geekzone directly in your browser, without refreshing the page, with Geekzone Live now.


Geekzone Live »

Our community of supporters help make Geekzone possible. Click the button below to join them.

Support Geezone on PressPatron



Are you subscribed to our RSS feed? You can download the latest headlines and summaries from our stories directly to your computer or smartphone by using a feed reader.

Alternatively, you can receive a daily email with Geekzone updates.