Tag Info

Hot answers tagged

49

Best stop doing that. Never overwrite an SSD/flash storage device completely in order to erase it, except as a last resort. NVRAM has a limited amount of write cycles available. At some point, after enough writes to an NVRAM cell, it will completely stop working. For modern versions, we're in the ballpark of an estimated lifespan of 3,000 write cycles. ...


40

Summary: it was marginally better on older drives, but doesn't matter now. Multiple passes erase a tree with overkill but miss the rest of the forest. Use encryption. The origin lies in work by Peter Gutmann, who showed that there is some memory in a disk bit: a zero that's been overwritten with a zero can be distinguished from a one that's been overwritten ...


26

Yes. If you do a normal format, the old data can be recovered. A normal format only deletes/overwrites a tiny bit of filesystem metadata, but does not overwrite all of the data itself. The data is still there. This is especially true on SSDs, due to wear levelling and other features of SSDs. The following research paper studies erasure of data on SSDs: ...


14

The only NIST approved method to securely erase a hard drive is by utilizing the secure erase internal command - documented at the Center for Magnetic Recording Research (CMRR) - and that is what everyone should be doing. It is an ATA command, and covers (S)ATA interfaces. After that, you can optionally degauss the drive to erase the firmware itself. Lots ...


10

From a theoretical standpoint the idea of total drive destruction may be the only way of destroying data on a hard drive fully. From a practical standpoint, I've not seen any evidence that it's possible to recover meaningful data from a standard hard drive (ie, not taking SSDs or other devices that use wear levelling or similar technologies) after a once ...


10

A paper from 2011 by four people from the University of California, San Diego writes in section "3.2.1 Built-in sanitize commands": Of the 12 drives we tested, [...] Eight of the drives reported that they supported the ATA SECURITY feature set. One of these encrypts data, so we could not verify if the sanitization was successful. Of the remaining ...


9

Logically deleting is very common in many application that handle huge amounts of data for performance reasons. This includes other email programs for example Microsoft Outlook and even database servers for example MySQL. Even files, that you delete from your hard disk, are not actually destroyed. The space is just flagged as empty and may be override in ...


8

No, it isn't necessary. With modern (less than 10 year old) hard drives, it is not required to overwrite a disk more than once. There is an often cited paper which says that you need to overwrite data at least 10 times to be sure, but that paper is over 20 years old and thus applies to outdated hard drives. Modern hard drives use much weaker magnetic ...


7

SSD's and Flash drives are an interesting problem... As @Bell pointed out as a response to this question: Yes, the effectiveness of the shredding operation is dependent on a fixed or physical mapping between a block number and piece of non-volatile storage. This works for spinning media but not for SSDs which virtaulise their blocks for performance ...


7

You are correct, in order for a file to be deleted the actual disk blocks it previously inhabited must be overwritten. This is generally done with random data; for example, the Windows tool 'cipher' overwrites unused (e.g., formerly used) disk space with 0s, then 1s, and then random data. If a forensic investigator were to look at your computer's disk, and ...


7

The problem with deleting files is that the file data is just one small part of what really gets saved onto your disk. On a modern filesystem there will be lots of metadata and other artefacts scattered around the disk: Journal entries on journalling filesystems, e.g. NTFS, ext3, ext4. Search index entries. Prefetch / superfetch cache entries. Shadow ...


6

Sounds like a fun project. I know you said "simple," but here are my thoughts anyway. The data you're writing the file over with isn't random, and one pass will still leave traces of the original data. It depends on the storage medium. For example, with magnetic devices, there's magnetic force microscopy. Even after ten rounds of the same thing, I'm not ...


6

There is a well-known reference article by Peter Gutmann on the subject. However, that article is a bit old (15 years) and newer harddisks might not operate as is described. Some data may fail to be totally obliterated by a single write due to two phenomena: We want to write a bit (0 or 1) but the physical signal is analog. Data is stored by manipulating ...


6

1) With modern filesystems, there is no more concept of securely deleting an individual file. It might have been copied around, snapshotted, written to a different location upon editing, etc. 2) With modern drives, there is no deletion / wipe without confirming it. Some drives have had a Secure Wipe command flat-out lies to you, returning immediately while ...


6

Do you need to erase the data, or do you need to persuade other people that the data has been erased? (I will only talk about 'entire disk' wiping; I'm not talking about wiping single files or slack space.) As far as I am aware there is no software package that claims to be able to recover data that has had a single overwrite. There are no companies that ...


5

Android Use SHREDroid. Perform a factory reset. iPhone As of iOS 2.0, the "Erase All Content and Settings" option will actually delete and overwrite the data on your phone, rendering them unrecoverable, or remove encryption keys on devices that supports hardware encryption. BlackBerry The "Security Wipe" option will delete and overwrite the data on ...


5

EEPROMs work by storing charge in floating-gate transistors. Think of these transistors like tiny capacitors that leak extremely slowly (typically with retention lifetimes of 10+ years), except with the added provision that you can tell whether it's charged or uncharged. Programming one simply involves feeding it a power source and pulling the gate to high ...


5

No on both counts, assuming the implementation is within spec. Secure erase works through encryption, usually AES. Essentially, everything that is written to the SSD is first encrypted with a master key. This happens all the time, is entirely managed by the device's on-board firmware, and is completely transparent. The master key is randomly generated on ...


4

As storage technologies change over time, using different encodings and remappings to deal with sector errors, the best way to permanently erase data changes also. Very smart people have expended enormous amounts of time and effort arguing over this problem. Most of them end up at the same bottom line, which is: the only method you can truly trust is ...


4

First of all, a single overwrite is adequate for all current magnetic hard drives. It has never been as easy to recover information from drives as people have claimed. Second of all, you can't erase flash drives simply by overwriting them. You'll wear them out with overwrites long before you actually overwrite all the data. The only way you can be ...


4

HIPAA regulations, as far as I can tell, do not specifically address the destruction of individual electronic files. Under HIPAA, you have an obligation to ensure that PHI does not fall into the wrong hands. You can best accomplish this by protecting systems and networks, not individual files.


4

Respond by asking them to prove that they brushed their teeth on the night of March 14th 2013. From a technical perspective, this isn't possible unless you've explicitly set up directory auditing to log when files are deleted. Since I almost guarantee that you haven't done this: no, there is pretty much no way you can prove such a thing. Even with ...


4

What you are talking about would require a perfect DRM system that can prove that you can only access the file in the way that is governed by a system that does not allow copying and provides a cryptographic receipt for deletion. There are systems that try to do this, but all are susceptible to being cracked as thus far DRM is not really a secure platform ...


4

The Center for Magnetic Recording Research at the University of California, San Diego has an interesting document on Data Sanitization in the form of a tutorial on secure wiping of storage media. They explain that securely destroying the decryption keys securely renders the data on the disk indecipherable and thus inaccessible (especially with strong ...


3

What gowenfawr says is completely correct, however, I would like to add something to that. Depending on the filesystem, there may be some remainings. On NTFS, indexes of files are not removed when wiping/deleting the file. So although you cannot recover the content of you file, there will always be traces of the file. See this blogpost from sans forensics ...


3

There are options related to email deletion in Thunderbird. It can happen that it is set in your client to only mark the message as deleted, but do not really delete it or not immediately. These are part of the standard IMAP protocoll what you use to connect to gmail. You should double check how yours are set up.


3

That entirely depends on the option chosen during the use of the Reset your PC tool:              As you can see in the image above, the user is presented with two options: Just remove my files option is the faster of the two, and is meant to be selected when you're resetting your PC for your ...



Only top voted, non community-wiki answers of a minimum length are eligible