Use the app 'shredit!' and do the 35 time overwrite. Then you fill the phone with unnecessary data and then reset it to factory settings and erase. What are the chances of recovery of data that was stored one year ago?
7
-
9I log into your iCloud and grab the data from there– schroeder ♦Nov 5, 2016 at 10:12
-
What data are you talking about?– schroeder ♦Nov 5, 2016 at 10:12
-
1Frankly, on any modern system with support for encrypting drives, that app is worthless. The modern systems all do the actual encryption with much longer keys, then protect the key with your passcode (this also prevents reencrypting everything when you change passcodes). Set up your encryption, then throw away/force overwrite the key, and the data is unrecoverable.– Clockwork-MuseDec 10, 2016 at 8:21
-
35 times? You using old MFM drives on that iPhone?– forestMar 5, 2018 at 3:24
-
1@forest As I recall, not even Gutmann said 35 overwrites were required with MFM drives. It was only required to do the full set of pattern overwrites (not just 35 passes, but 35 specific passes) if you had no idea whatsoever whether you had a drive doing MFM, RLL or some other kind of encoding.– userAug 2, 2018 at 9:45
|
Show 2 more comments
2 Answers
Doing this is complete nonsense.
All data on a modern iPhone (5s upward) is encrypted with a key which is derived from a key inside the CPU, another key stored in two copies in the flash memory, and usually the passcode is used as the third key.
All you need to do is erase the two copies of the second of these three keys which is stored in the flash memory, and it's game over. You cannot find the decryption keys anymore, they are 256 bit keys, and they are different for every single file - cracking 256 bit keys is considered physically impossible, and you would have to repeat this for every single file.
Apple also uses an API that can erase physical blocks on a flash drive, so you can safely assume that overwritten encryption keys are not recoverable
I wonder why it is 35 times, lol. If it is ovewritten once then that is enough. But how do you know it overwrote everything? It probably didn't if you are running this app from the phone. Filling it with other data afterward is probably going to do the trick as well. The encryption scheme on the iPhone 5s is pretty solid. It requires the processor on the phone for decrypting so there is no offline recovery, and you have to get around the auto-reset to able to try many passcodes. That may require a signed iOS image from Apple that excludes the auto-reset, but there may be another way since the FBI was able to do it with some help after Apple refused.
Bottom line, I can't say no 100.00% on the chance of recovery, but really probably not recoverable from the phone.
-
but what if we never used a passcode– user119003Nov 11, 2016 at 5:47
-
@badaboo I believe then the data is still encrypted with the rest of the encryption process (several layers), so someone trying to recover it would still need to use the phone to be able to read the data, but wouldn't have to worry about figuring out any passcode.– mikatoNov 15, 2016 at 20:31
-
335X write is a US DoD standard for magnetic disks. It has nothing useful to do on flash memory.– user2497Jul 7, 2017 at 22:45
-
635x is not an erasure standard. The DoD only overwrites unclassified data 2 or 3 times. Anything top secret cannot be disposed of using these methods at all.– IvanAug 7, 2017 at 3:49
-
3@Ivan The standard is DoD 5220.22-M (3 pass). I think the standard was deprecated anyway in favor of degaussing and physical destruction. 35x is Gutmann's old technique for MFM and RLL drives, which are obsolete. Note also that the iPhone uses solid state storage, which has completely different behavior when trying to wipe (issues with overprovisioning space, etc).– forestMar 5, 2018 at 3:26