3

In terms of data deletion everyone knows that once you delete something from your harddisk it stays there, and is recoverable, until it is overwritten.

With classical spinning harddrives, the best solution was to overwrite the entire drive, several times, with random data.

With solid state drives, this is no longer the case due to drive constraints such as over-provisioning and wear-leveling. However, the ATA TRIMcommand, theoretically, should produce a voltage spike in every NAND cell of a drive, rendering any data stored there irrecoverable.

My question is this: is Windows 10's implementation of the TRIM command (through the old disc defrag screen) secure?

  • 2
    The physical implementation is up to the drive manufacturer, not the OS. Windows simply sends the TRIM command to the drive controller. What the drive controller does with it is opaque. – Xander Jan 25 '17 at 17:16
  • 1
    @Xander are there any organizations auditing the security of individual drives? – Persistence Jan 25 '17 at 17:18
  • 1
    Unfortunately, not that I'm aware of. Often the manufactures hold the implementation (of anything in the drives, not just this) pretty close the the vest. Getting specific details can be pretty hard. – Xander Jan 25 '17 at 17:23
2

Just quickly addressing some broken premises in the introduction of this question. These will form the basis of an answer, which can be best summarised by the following: it depends...

... and unfortunately it can't just depend your storage device (though that is central to the discussion); it also depends upon various factors such as your OS (e.g. Windows 7 doesn't support TRIM for PCIe SSDs) and BIOS information (for some SSDs), and could even extend to the rest of your architecture (e.g. CPU, RAM, storage controller) as other components of your system might leak data from the file system.


In terms of data deletion everyone knows that once you delete something from your harddisk it stays there, and is recoverable, until it is overwritten.

According to a publication by the Trusted Computing Group dated October 1, 2011:

  • Within 2 years (by 2013) SED capability will be in over 80 percent of SSDs and likely in almost all SSDs within 3 years (2014).
  • By 2017, almost all HDDs will include SED capability.
  • By 2016 the high, median and low estimates for security adoption for SED HDDs are 411 million, 315 million and 122 million units.

Assuming these expectations have been met, one might have a very difficult time indeed recovering any data from a self-encrypted device following a modification to the key. To emphasise, the best solution for secure erasure of these newer encryption-supporting devices (both rotational and solid-state) is changing the encryption key, as opposed to...

With classical spinning harddrives, the best solution was to overwrite the entire drive, several times, with random data.

Even then, by examining the physical media of a newly produced, unused product compared to a used product, a forensic analyst could quite possibly draw conclusions based on slight residual leftovers. This kind of attack has been demonstrated quite publicly using volatile RAM (such as that which exists as cache memory in disk drives), so it's likely to work for the non-volatile stuff (such as flash memory), too. The security of an entire system is, after all, limited to the weakest link, which might not be the drive in question.

I imagine there are the following complications to extracting information from the drive alone:

  1. Encryption. We've already established that current drives (whether rotational or solid-state) are likely encrypted (transparently to external devices), and this is likely to impact upon success rates. If the key can be extracted from the device (which I imagine would be quite a bit more difficult than extracting keys from SIM cards, given how far we've advanced since the introduction of those), perhaps a forensic analyst could piece together some data. However, it seems manufacturers are keeping their precise encryption specifications in-house, so obtaining the required information (such as where exactly the key is stored) could be difficult.
  2. Wear leveling. The Achilles heal of the solid state storage, as it seemed initially; wear leveling was designed to distribute writes evenly across a drive, but there are multiple forms of this. All of them leave stale data, which is a double-edged sword as that data will indeed exist for all of time, unerasable, though likely to complicate the integrity of recovered data. Additionally, TRIM was not designed as a security feature, but a garbage collection feature; it exists to facilitate data reorganisation, perhaps at a later date. Part of the analysts job would be reversing the reorganisation which the GC might perform and excluding any bad flash cells (again, akin to extracting keys from a SIM card, but likely more difficult due to progress in technology). I don't imagine this would be a particularly easy job; it'd also involve some amount of data deduplication to recognise when and where data has been relocated in some instances.

These points are mentioned in another paper, dated 2014, where the entire article seems to paint a dire picture for our theoretical data recovery Scenario.

On the one hand, this article mentions the existence of bugs which might aid in recovery. On the other hand:

Self-encrypting SSD drives require a different approach altogether, while SSD drives using compressing controllers cannot be practically imaged with off-chip acquisition hardware. ... And even shutting the affected computer down immediately after a destructive command has been issued, does not stop the destruction. Once the power is back on, the SSD drive will continue wiping its content clear all by itself, even if installed into a write-blocking imaging device. If a self-destruction process has already started, there is no practical way of stopping it unless we’re talking of some extremely important evidence, in which case the disk accompanied with a court order can be sent to the manufacturer for low-level, hardware-specific recovery.

The emphasis here was not mine. As mentioned in the comments, Windows does not control the erasure and/or reorganisation of data; that happens within the drive itself, and it starts happening the moment the device is powered up.

Some SSD drives implement what is called Deterministic Read After Trim (DRAT) and Deterministic Zeroes After Trim (DZAT), returning all-zeroes immediately after the TRIM command released a certain data block, while some other drives do not implement this protocol and will return the original data until it’s physically erased with the garbage collection algorithm.


In summary, based on this information, I would not feel so confident recovering data from a system built by someone who has shopped around to find the least recovery-friendly configuration. However, data recovery from a typical impulse buy might be more successful. Might.

  • Even then, by examining [...] Are you referring to Gutmann's paper for MFM drives? He has recanted much of it. To date, there are no public demonstrations of recovering data from a hard drive with even a single pass overwrite, and most experts in drive recovery believe it to be impossible. After all, we still can't even recover a single, amateur overwrite on an old fashioned cassette tape, much less a modern, high-density, encoded hard drive. I am also curious why you say that this has been demonstrated with modern RAM (are you trying to describe cold boot attacks?). Perhaps I misunderstood. – forest Jan 26 '18 at 5:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.