Geekzone: technology news, blogs, forums
Guest
Welcome Guest.
You haven't logged in yet. If you don't have an account you can register now.




4940 posts

Uber Geek

Trusted

# 243755 30-Dec-2018 11:34
Send private message

I was just reading an article on Stuff about a teacher accused of inappropriate behaviour and it occurred to me to wonder if it's easier to cover one's tracks or not.

 

I know that even if you write over the contents of a HDD, some traces of the previous data can sometimes be recovered.


Create new topic
2981 posts

Uber Geek


  # 2152224 30-Dec-2018 13:37
Send private message

Well it's more that the OS won't actually remove the data from the disk. Ie it doesn't go and overwrite the area where the file(s) were. It just removes the pointers/indexes. So using the right tools you can "find" the deleted files assuming nothing else has used that part of the file system. I assume ssd drives would be the same.

A data wiping tool would erase all the zeroes and ones and normally make the file content be removed completely.
But there have been instances on conventional hdd drives where even wiped (overwritten) files could be recovered due to how hdd drives work. I don't think that same recovery method would apply to an ssd.




Nothing is impossible for the man who doesn't have to do it himself - A. H. Weiler

2005 posts

Uber Geek

Lifetime subscriber

  # 2152230 30-Dec-2018 13:59
One person supports this post
Send private message

If you really want to cover your tracks then you should use full drive-level encryption for all SSDs and HDDs.

 

SSDs are more difficult to erase to ensure that all user data has been erased. The electronic logic in SSDs does more than that in HDDs. This included copying data to other locations to improve wear leveling. The original data is not erased because that would increase wear for no immediate benefit to the SSD owner.

 

But SSDs are easier to permanently destroy - you can pulverise them with a hammer or vice (U.S. vise).

 

There are many articles on the topic but most I've read from tech companies and "experts" have been rather misleading. Here's one good discussion of key points: Can wiped SSD data be recovered? 

 

 


 
 
 
 


1473 posts

Uber Geek

Lifetime subscriber

  # 2152239 30-Dec-2018 14:11
One person supports this post
Send private message

Drive shredder only way to make sure data will never be recovered.

 

 





Ding Ding Ding Ding Ding : Ice cream man , Ice cream man


2130 posts

Uber Geek


  # 2152249 30-Dec-2018 14:43
One person supports this post
Send private message

Mspec:

Drive shredder only way to make sure data will never be recovered.


 


Or you get a self destructing SSD like the RunCore Invincible. They physically destroy the storage chips with the push of a button.




Location: Dunedin

 


Mad Scientist
20928 posts

Uber Geek

Trusted
Lifetime subscriber

  # 2152302 30-Dec-2018 15:35
One person supports this post
Send private message

andrewNZ:
Mspec:

 

Drive shredder only way to make sure data will never be recovered.

 

 

 

 

 


Or you get a self destructing SSD like the RunCore Invincible. They physically destroy the storage chips with the push of a button.

 

Should have been called Mission:Impossible





Involuntary autocorrect in operation on mobile device. Apologies in advance.


22529 posts

Uber Geek

Trusted
Subscriber

  # 2152318 30-Dec-2018 16:03
Send private message

SSDs will map space in and out of use as part of wear levelling, so there will be traces of past overwritten data that the OS cannot directly overwrite on the flash chips themselves.

 

 

 

In these cases of proving stuff was on the PC etc they just have to locate a small fraction of one file they suspect the guy has on there is in place on one of those chips. Trim support means that the OS just marks the sector as unused and the controller will just artificially return an blank block for any read of that sector. The data is still in the chip till it decides to erase that block to reuse, which will generally be when the rest of the sectors in that block get moved to others and the block can then be erased.

 

HDDs also have faulty sectors that get mapped out, but there may only be a few tens of them on a drive and the chances of data being in the fault ones that you want are way lower as a result. On the SSD there is a much better chance since you assume the suspect would have deleted the files so they would have been trimmed and be sitting there in a block of flash among other sectors that are still in use.

 

And recovering things from an overwritten HDD is a myth that persists from the days of 40 megabyte MFM harddrives with mechanical steppers. Any ability to read something overwritten would be capacity that is not being used and that is constantly being pushed to the limits. With shingled recording things are being overwritten and using the edges of the magnatisim remnants from the previous pass by the drive itself to boost capacity.





Richard rich.ms

3885 posts

Uber Geek

Subscriber

  # 2152325 30-Dec-2018 16:23

The OS itself is also a significant source of data leakage. Virtual memory and hibernation pagefiles are the most common ones.





 
 
 
 


452 posts

Ultimate Geek

Lifetime subscriber

  # 2152350 30-Dec-2018 18:43
Send private message

If you read the NZ Information Security Manual (on the GCSB website https://www.gcsb.govt.nz/publications/the-nz-information-security-manual/) you will see the only approved way to de-classify a classified SSD is to destroy it.
There is no approved way to "wipe" or otherwise erase it.

Nuff said?

1473 posts

Uber Geek

Lifetime subscriber

  # 2152405 30-Dec-2018 21:54
Send private message

Hahahaha I love this video where she says I just want to stand back from it a little. Yup real mission impossible.

 

 

 





Ding Ding Ding Ding Ding : Ice cream man , Ice cream man


2130 posts

Uber Geek


  # 2152446 30-Dec-2018 22:23
Send private message

When I googled to find this device again, I saw mention of ones you can SMS nuke...

Boy do I want to find someone with one of those.




Location: Dunedin

 


1402 posts

Uber Geek


  # 2152478 31-Dec-2018 07:23
Send private message

I've found that what is easily recoverable from a conventional hard drive by using Recuva from Piriform or Linux Photorec, seems to have gone  if you have deleted it from a SSD.  Of course this may be just a limitation of consumer level software - I have no idea.


22529 posts

Uber Geek

Trusted
Subscriber

  # 2152554 31-Dec-2018 10:22
One person supports this post
Send private message

amiga500:

 

I've found that what is easily recoverable from a conventional hard drive by using Recuva from Piriform or Linux Photorec, seems to have gone  if you have deleted it from a SSD.  Of course this may be just a limitation of consumer level software - I have no idea.

 

 

You are only seeing what the controller chip wants you to see, you read a block marked as deleted and you get emptyness back. Its still in the chips awaiting the next shuffle around of data for wear levelling which is why the places that have the real recovery gear can get a hell of a lot back off an SSD





Richard rich.ms

1906 posts

Uber Geek


  # 2152558 31-Dec-2018 10:50
Send private message

Aredwood: The OS itself is also a significant source of data leakage. Virtual memory and hibernation pagefiles are the most common ones.
Fortunately Windows has disabled hibernation for quite a while now if it detects an SSD drive.  You'd be a fool to enable it with an SSD


xpd

Chief Trash Bandit
10039 posts

Uber Geek

Mod Emeritus
Trusted
Lifetime subscriber

  # 2152566 31-Dec-2018 11:23
Send private message

Batman:

 

andrewNZ:
Mspec:

 

Drive shredder only way to make sure data will never be recovered.

 

 

 

 

 


Or you get a self destructing SSD like the RunCore Invincible. They physically destroy the storage chips with the push of a button.

 

Should have been called Mission:Impossible

 

 





XPD / Gavin / DemiseNZ

 

Server : i5-3470s @ 3.50GHz  16GB RAM  Win 10 Pro    Workstation : i5-3570K @ 3.40GHz  20GB RAM  RX580 4GB Win 10 Pro    Console : Xbox One

 

https://www.xpd.co.nz - Games, emulation, geekery, and my attempts at photography.     Now on BigPipe 100/100 and 2Talk

 

Emulation - The art of getting your $4000 PC to run an 80's system - and still fails.

 

Add me on Steam


xpd

Chief Trash Bandit
10039 posts

Uber Geek

Mod Emeritus
Trusted
Lifetime subscriber

  # 2152567 31-Dec-2018 11:25
Send private message

Common misconception is that reinstalling an OS will cover everything - wrong. On older OS'es anyway.

 

I once backed up a friends Win98 system, then formatted it and reinstalled Win98.... then discovered the backup was corrupt. (Yes I know, shouldve checked it first)

 

Ran Recuva or similar and managed to pull back all their documents/photos from the original HDD. No data loss.

 

 





XPD / Gavin / DemiseNZ

 

Server : i5-3470s @ 3.50GHz  16GB RAM  Win 10 Pro    Workstation : i5-3570K @ 3.40GHz  20GB RAM  RX580 4GB Win 10 Pro    Console : Xbox One

 

https://www.xpd.co.nz - Games, emulation, geekery, and my attempts at photography.     Now on BigPipe 100/100 and 2Talk

 

Emulation - The art of getting your $4000 PC to run an 80's system - and still fails.

 

Add me on Steam


Create new topic



Twitter and LinkedIn »



Follow us to receive Twitter updates when new discussions are posted in our forums:



Follow us to receive Twitter updates when news items and blogs are posted in our frontpage:



Follow us to receive Twitter updates when tech item prices are listed in our price comparison site:





News »

Arlo unveils its first video doorbell
Posted 21-Oct-2019 08:27


New Zealand students shortlisted for James Dyson Award
Posted 21-Oct-2019 08:18


Norton LifeLock Launches Norton 360
Posted 21-Oct-2019 08:11


Microsoft New Zealand Partner Awards results
Posted 18-Oct-2019 10:18


Logitech introduces new Made for Google keyboard and mouse devices
Posted 16-Oct-2019 13:36


MATTR launches to accelerate decentralised identity
Posted 16-Oct-2019 10:28


Vodafone X-Squad powers up for customers
Posted 16-Oct-2019 08:15


D Link ANZ launches EXO Smart Mesh Wi Fi Routers with McAfee protection
Posted 15-Oct-2019 11:31


Major Japanese retailer partners with smart New Zealand technology IMAGR
Posted 14-Oct-2019 10:29


Ola pioneers one-time passcode feature to fight rideshare fraud
Posted 14-Oct-2019 10:24


Spark Sport new home of NZC matches from 2020
Posted 10-Oct-2019 09:59


Meet Nola, Noel Leeming's new digital employee
Posted 4-Oct-2019 08:07


Registrations for Sprout Accelerator open for 2020 season
Posted 4-Oct-2019 08:02


Teletrac Navman welcomes AI tech leader Jens Meggers as new President
Posted 4-Oct-2019 07:41


Vodafone makes voice of 4G (VoLTE) official
Posted 4-Oct-2019 07:36



Geekzone Live »

Try automatic live updates from Geekzone directly in your browser, without refreshing the page, with Geekzone Live now.


Support Geekzone »

Our community of supporters help make Geekzone possible. Click the button below to join them.

Support Geezone on PressPatron



Are you subscribed to our RSS feed? You can download the latest headlines and summaries from our stories directly to your computer or smartphone by using a feed reader.

Alternatively, you can receive a daily email with Geekzone updates.