Are solid state drives easier to wipe clean vs. hard disc drives?

Forums › Desktop computing › Are solid state drives easier to wipe clean vs. hard disc drives?

DarthKermit

4940 posts

Uber Geek

Trusted

# 243755 30-Dec-2018 11:34

I was just reading an article on Stuff about a teacher accused of inappropriate behaviour and it occurred to me to wonder if it's easier to cover one's tracks or not.

I know that even if you write over the contents of a HDD, some traces of the previous data can sometimes be recovered.

robjg63

2981 posts

Uber Geek

# 2152224 30-Dec-2018 13:37

Well it's more that the OS won't actually remove the data from the disk. Ie it doesn't go and overwrite the area where the file(s) were. It just removes the pointers/indexes. So using the right tools you can "find" the deleted files assuming nothing else has used that part of the file system. I assume ssd drives would be the same.

A data wiping tool would erase all the zeroes and ones and normally make the file content be removed completely.
But there have been instances on conventional hdd drives where even wiped (overwritten) files could be recovered due to how hdd drives work. I don't think that same recovery method would apply to an ssd.

Nothing is impossible for the man who doesn't have to do it himself - A. H. Weiler

Hammerer

2005 posts

Uber Geek

Lifetime subscriber

# 2152230 30-Dec-2018 13:59

One person supports this post

If you really want to cover your tracks then you should use full drive-level encryption for all SSDs and HDDs.

SSDs are more difficult to erase to ensure that all user data has been erased. The electronic logic in SSDs does more than that in HDDs. This included copying data to other locations to improve wear leveling. The original data is not erased because that would increase wear for no immediate benefit to the SSD owner.

But SSDs are easier to permanently destroy - you can pulverise them with a hammer or vice (U.S. vise).

There are many articles on the topic but most I've read from tech companies and "experts" have been rather misleading. Here's one good discussion of key points: Can wiped SSD data be recovered?

JaseNZ

1473 posts

Uber Geek

Lifetime subscriber

# 2152239 30-Dec-2018 14:11

One person supports this post

Drive shredder only way to make sure data will never be recovered.

Ding Ding Ding Ding Ding : Ice cream man , Ice cream man

andrewNZ

2130 posts

Uber Geek

# 2152249 30-Dec-2018 14:43

One person supports this post

Mspec:
Drive shredder only way to make sure data will never be recovered.

Or you get a self destructing SSD like the RunCore Invincible. They physically destroy the storage chips with the push of a button.

Location: Dunedin

Batman

Mad Scientist
20928 posts

Uber Geek

Trusted

Lifetime subscriber

# 2152302 30-Dec-2018 15:35

One person supports this post

andrewNZ:
Mspec:

Drive shredder only way to make sure data will never be recovered.

Or you get a self destructing SSD like the RunCore Invincible. They physically destroy the storage chips with the push of a button.

Should have been called Mission:Impossible

Involuntary autocorrect in operation on mobile device. Apologies in advance.

richms

22529 posts

Uber Geek

Trusted

Subscriber

# 2152318 30-Dec-2018 16:03

SSDs will map space in and out of use as part of wear levelling, so there will be traces of past overwritten data that the OS cannot directly overwrite on the flash chips themselves.

In these cases of proving stuff was on the PC etc they just have to locate a small fraction of one file they suspect the guy has on there is in place on one of those chips. Trim support means that the OS just marks the sector as unused and the controller will just artificially return an blank block for any read of that sector. The data is still in the chip till it decides to erase that block to reuse, which will generally be when the rest of the sectors in that block get moved to others and the block can then be erased.

HDDs also have faulty sectors that get mapped out, but there may only be a few tens of them on a drive and the chances of data being in the fault ones that you want are way lower as a result. On the SSD there is a much better chance since you assume the suspect would have deleted the files so they would have been trimmed and be sitting there in a block of flash among other sectors that are still in use.

And recovering things from an overwritten HDD is a myth that persists from the days of 40 megabyte MFM harddrives with mechanical steppers. Any ability to read something overwritten would be capacity that is not being used and that is constantly being pushed to the limits. With shingled recording things are being overwritten and using the edges of the magnatisim remnants from the previous pass by the drive itself to boost capacity.

Richard rich.ms

Aredwood

3885 posts

Uber Geek

Subscriber

# 2152325 30-Dec-2018 16:23

The OS itself is also a significant source of data leakage. Virtual memory and hibernation pagefiles are the most common ones.

PolicyGuy

452 posts

Ultimate Geek

Lifetime subscriber

# 2152350 30-Dec-2018 18:43

If you read the NZ Information Security Manual (on the GCSB website https://www.gcsb.govt.nz/publications/the-nz-information-security-manual/) you will see the only approved way to de-classify a classified SSD is to destroy it.
There is no approved way to "wipe" or otherwise erase it.

Nuff said?

JaseNZ

1473 posts

Uber Geek

Lifetime subscriber

# 2152405 30-Dec-2018 21:54

Hahahaha I love this video where she says I just want to stand back from it a little. Yup real mission impossible.

Ding Ding Ding Ding Ding : Ice cream man , Ice cream man

andrewNZ

2130 posts

Uber Geek

# 2152446 30-Dec-2018 22:23

When I googled to find this device again, I saw mention of ones you can SMS nuke...

Boy do I want to find someone with one of those.

Location: Dunedin

amiga500

1402 posts

Uber Geek

# 2152478 31-Dec-2018 07:23

I've found that what is easily recoverable from a conventional hard drive by using Recuva from Piriform or Linux Photorec, seems to have gone if you have deleted it from a SSD. Of course this may be just a limitation of consumer level software - I have no idea.

richms

22529 posts

Uber Geek

Trusted

Subscriber

# 2152554 31-Dec-2018 10:22

One person supports this post

amiga500:

I've found that what is easily recoverable from a conventional hard drive by using Recuva from Piriform or Linux Photorec, seems to have gone if you have deleted it from a SSD. Of course this may be just a limitation of consumer level software - I have no idea.

You are only seeing what the controller chip wants you to see, you read a block marked as deleted and you get emptyness back. Its still in the chips awaiting the next shuffle around of data for wear levelling which is why the places that have the real recovery gear can get a hell of a lot back off an SSD

Richard rich.ms

MadEngineer

1906 posts

Uber Geek

# 2152558 31-Dec-2018 10:50

Aredwood: The OS itself is also a significant source of data leakage. Virtual memory and hibernation pagefiles are the most common ones.

Fortunately Windows has disabled hibernation for quite a while now if it detects an SSD drive. You'd be a fool to enable it with an SSD

xpd

Chief Trash Bandit
10039 posts

Uber Geek

Mod Emeritus

Trusted

Lifetime subscriber

# 2152566 31-Dec-2018 11:23

Batman:

andrewNZ:
Mspec:

Drive shredder only way to make sure data will never be recovered.

Or you get a self destructing SSD like the RunCore Invincible. They physically destroy the storage chips with the push of a button.

Should have been called Mission:Impossible

XPD / Gavin / DemiseNZ

Server : i5-3470s @ 3.50GHz 16GB RAM Win 10 Pro Workstation : i5-3570K @ 3.40GHz 20GB RAM RX580 4GB Win 10 Pro Console : Xbox One

https://www.xpd.co.nz - Games, emulation, geekery, and my attempts at photography. Now on BigPipe 100/100 and 2Talk

Emulation - The art of getting your $4000 PC to run an 80's system - and still fails.

Add me on Steam

xpd

Chief Trash Bandit
10039 posts

Uber Geek

Mod Emeritus

Trusted

Lifetime subscriber

# 2152567 31-Dec-2018 11:25

Common misconception is that reinstalling an OS will cover everything - wrong. On older OS'es anyway.

I once backed up a friends Win98 system, then formatted it and reinstalled Win98.... then discovered the backup was corrupt. (Yes I know, shouldve checked it first)

Ran Recuva or similar and managed to pull back all their documents/photos from the original HDD. No data loss.

XPD / Gavin / DemiseNZ

Server : i5-3470s @ 3.50GHz 16GB RAM Win 10 Pro Workstation : i5-3570K @ 3.40GHz 20GB RAM RX580 4GB Win 10 Pro Console : Xbox One

https://www.xpd.co.nz - Games, emulation, geekery, and my attempts at photography. Now on BigPipe 100/100 and 2Talk

Emulation - The art of getting your $4000 PC to run an 80's system - and still fails.

Add me on Steam