2 improved spelling and formatting
source | link

... and unfortunately it can't just depend your storage device (though that is central to the discussion); it also depends upon various factors such as your OS (i.e.g. Windows 7 doesn't support TRIM for PCIe SSDs) and BIOS information (for some SSDs), and could even extend to the rest of your architecture (e.g. CPU, RAM, storage controller) as other components of your system might leak data from the file system.

  1. Encryption. We've already established that current drives (whether rotational or solid-state) are likely encrypted (transparently to external devices), and this is likely to impact upon success rates. If the key can be extracted from the device (which I imagine would be quite a bit more difficult than extracting keys from SIM cards, given how far we've advanced since the introduction of those), perhaps a forensic analyst could piece together some data. However, it seems manufacturers are keeping their precise encryption specifications in-house, so obtaining the required information (such as where exactly the key is stored) could be difficult.
  2. Wear levellingWear leveling. The Achilles heal of the solid state storage, as it seemed initially; wear levellingleveling was designed to distribute writes evenly across a drive, but there are multiple forms of this. All of them leave stale data, which is a double-edged sword as that data will indeed exist for all of time, unerasable, though likely to complicate the integrity of recovered data. Additionally, TRIM was not designed as a security feature, but a garbage collection feature; it exists to facilitate data reorganisation, perhaps at a later date. Part of the analysts job would be reversing the reorganisation which the GC might perform and excluding any bad flash cells (again, akin to extracting keys from a SIM card, but likely more difficult due to progress in technology). I don't imagine this would be a particularly easy job; it'd also involve some amount of data deduplication to recognise when and where data has been relocated in some instances.

... and unfortunately it can't just depend your storage device (though that is central to the discussion); it also depends upon various factors such as your OS (i.e. Windows 7 doesn't support TRIM for PCIe SSDs) and BIOS information (for some SSDs), and could even extend to the rest of your architecture (e.g. CPU, RAM, storage controller) as other components of your system might leak data from the file system.

  1. Encryption. We've already established that current drives (whether rotational or solid-state) are likely encrypted (transparently to external devices), and this is likely to impact upon success rates. If the key can be extracted from the device (which I imagine would be quite a bit more difficult than extracting keys from SIM cards, given how far we've advanced since the introduction of those), perhaps a forensic analyst could piece together some data. However, it seems manufacturers are keeping their precise encryption specifications in-house, so obtaining the required information (such as where exactly the key is stored) could be difficult.
  2. Wear levelling. The Achilles heal of the solid state storage, as it seemed initially; wear levelling was designed to distribute writes evenly across a drive, but there are multiple forms of this. All of them leave stale data, which is a double-edged sword as that data will indeed exist for all of time, unerasable, though likely to complicate the integrity of recovered data. Additionally, TRIM was not designed as a security feature, but a garbage collection feature; it exists to facilitate data reorganisation, perhaps at a later date. Part of the analysts job would be reversing the reorganisation which the GC might perform and excluding any bad flash cells (again, akin to extracting keys from a SIM card, but likely more difficult due to progress in technology). I don't imagine this would be a particularly easy job; it'd also involve some amount of data deduplication to recognise when and where data has been relocated in some instances.

... and unfortunately it can't just depend your storage device (though that is central to the discussion); it also depends upon various factors such as your OS (e.g. Windows 7 doesn't support TRIM for PCIe SSDs) and BIOS information (for some SSDs), and could even extend to the rest of your architecture (e.g. CPU, RAM, storage controller) as other components of your system might leak data from the file system.

  1. Encryption. We've already established that current drives (whether rotational or solid-state) are likely encrypted (transparently to external devices), and this is likely to impact upon success rates. If the key can be extracted from the device (which I imagine would be quite a bit more difficult than extracting keys from SIM cards, given how far we've advanced since the introduction of those), perhaps a forensic analyst could piece together some data. However, it seems manufacturers are keeping their precise encryption specifications in-house, so obtaining the required information (such as where exactly the key is stored) could be difficult.
  2. Wear leveling. The Achilles heal of the solid state storage, as it seemed initially; wear leveling was designed to distribute writes evenly across a drive, but there are multiple forms of this. All of them leave stale data, which is a double-edged sword as that data will indeed exist for all of time, unerasable, though likely to complicate the integrity of recovered data. Additionally, TRIM was not designed as a security feature, but a garbage collection feature; it exists to facilitate data reorganisation, perhaps at a later date. Part of the analysts job would be reversing the reorganisation which the GC might perform and excluding any bad flash cells (again, akin to extracting keys from a SIM card, but likely more difficult due to progress in technology). I don't imagine this would be a particularly easy job; it'd also involve some amount of data deduplication to recognise when and where data has been relocated in some instances.
1
source | link

Just quickly addressing some broken premises in the introduction of this question. These will form the basis of an answer, which can be best summarised by the following: it depends...

... and unfortunately it can't just depend your storage device (though that is central to the discussion); it also depends upon various factors such as your OS (i.e. Windows 7 doesn't support TRIM for PCIe SSDs) and BIOS information (for some SSDs), and could even extend to the rest of your architecture (e.g. CPU, RAM, storage controller) as other components of your system might leak data from the file system.


In terms of data deletion everyone knows that once you delete something from your harddisk it stays there, and is recoverable, until it is overwritten.

According to a publication by the Trusted Computing Group dated October 1, 2011:

  • Within 2 years (by 2013) SED capability will be in over 80 percent of SSDs and likely in almost all SSDs within 3 years (2014).
  • By 2017, almost all HDDs will include SED capability.
  • By 2016 the high, median and low estimates for security adoption for SED HDDs are 411 million, 315 million and 122 million units.

Assuming these expectations have been met, one might have a very difficult time indeed recovering any data from a self-encrypted device following a modification to the key. To emphasise, the best solution for secure erasure of these newer encryption-supporting devices (both rotational and solid-state) is changing the encryption key, as opposed to...

With classical spinning harddrives, the best solution was to overwrite the entire drive, several times, with random data.

Even then, by examining the physical media of a newly produced, unused product compared to a used product, a forensic analyst could quite possibly draw conclusions based on slight residual leftovers. This kind of attack has been demonstrated quite publicly using volatile RAM (such as that which exists as cache memory in disk drives), so it's likely to work for the non-volatile stuff (such as flash memory), too. The security of an entire system is, after all, limited to the weakest link, which might not be the drive in question.

I imagine there are the following complications to extracting information from the drive alone:

  1. Encryption. We've already established that current drives (whether rotational or solid-state) are likely encrypted (transparently to external devices), and this is likely to impact upon success rates. If the key can be extracted from the device (which I imagine would be quite a bit more difficult than extracting keys from SIM cards, given how far we've advanced since the introduction of those), perhaps a forensic analyst could piece together some data. However, it seems manufacturers are keeping their precise encryption specifications in-house, so obtaining the required information (such as where exactly the key is stored) could be difficult.
  2. Wear levelling. The Achilles heal of the solid state storage, as it seemed initially; wear levelling was designed to distribute writes evenly across a drive, but there are multiple forms of this. All of them leave stale data, which is a double-edged sword as that data will indeed exist for all of time, unerasable, though likely to complicate the integrity of recovered data. Additionally, TRIM was not designed as a security feature, but a garbage collection feature; it exists to facilitate data reorganisation, perhaps at a later date. Part of the analysts job would be reversing the reorganisation which the GC might perform and excluding any bad flash cells (again, akin to extracting keys from a SIM card, but likely more difficult due to progress in technology). I don't imagine this would be a particularly easy job; it'd also involve some amount of data deduplication to recognise when and where data has been relocated in some instances.

These points are mentioned in another paper, dated 2014, where the entire article seems to paint a dire picture for our theoretical data recovery Scenario.

On the one hand, this article mentions the existence of bugs which might aid in recovery. On the other hand:

Self-encrypting SSD drives require a different approach altogether, while SSD drives using compressing controllers cannot be practically imaged with off-chip acquisition hardware. ... And even shutting the affected computer down immediately after a destructive command has been issued, does not stop the destruction. Once the power is back on, the SSD drive will continue wiping its content clear all by itself, even if installed into a write-blocking imaging device. If a self-destruction process has already started, there is no practical way of stopping it unless we’re talking of some extremely important evidence, in which case the disk accompanied with a court order can be sent to the manufacturer for low-level, hardware-specific recovery.

The emphasis here was not mine. As mentioned in the comments, Windows does not control the erasure and/or reorganisation of data; that happens within the drive itself, and it starts happening the moment the device is powered up.

Some SSD drives implement what is called Deterministic Read After Trim (DRAT) and Deterministic Zeroes After Trim (DZAT), returning all-zeroes immediately after the TRIM command released a certain data block, while some other drives do not implement this protocol and will return the original data until it’s physically erased with the garbage collection algorithm.


In summary, based on this information, I would not feel so confident recovering data from a system built by someone who has shopped around to find the least recovery-friendly configuration. However, data recovery from a typical impulse buy might be more successful. Might.