2

From a security standpoint, given two drives having the same capacity (i.e. 256 GB), source drive (A) and target drive (B), will performing a full dd clone of Drive A effectively "wipe" the contents of Drive B such that its previous contents are sufficiently irrecoverable?

  • There are drives with more internal space than exposed space. These extra space are usually used to replace corrupted sectors automatically by the drive's firmware and they can be quite large in SSD. The only way to overwrite these extra sectors is to use ATA Secure Erase command, but you'll have to rely on drive manufacturers implementing that correctly. – Lie Ryan Mar 18 '17 at 2:06
2

That depends on what you mean by "sufficiently".

For magnetic disks, yes, overwriting the data like this should erase it sufficiently, and dd will write every block on the target drive. The idea that magic spy forensics can recover data from a magnetic hard drive that hasn't been overwritten some huge number of times is a myth derived from this paper by Peter Gutmann (see the several epilogues he's since added at the end).

Nothing about this applies if the target drive is flash storage, like an SSD. SSD drives have different data remanance properties. This paper suggests overwriting the entire storage container twice to guarantee that every block has been re-used. Properly implemented OSes can also inform the drive to wipe particular blocks via the TRIM, but the drive isn't guaranteed to act on these commands in any particular amount of time.

  • 1
    That paper states that overwriting an SSD twice cleared all of the data in some, but not all, of their tests, so it's certainly not a guarantee. In fact, they explicitly state that you shouldn't rely on it: "Overall, the results for overwriting are poor: while overwriting appears to be effective in some cases across a wide range of drives, it is clearly not universally reliable. It seems unlikely that an individual or organization expending the effort to sanitize a device would be satisfied with this level of performance." – Josh Townzen Feb 15 '17 at 21:06
  • Yeah, I agree. It really depends on OP's level of "sufficient" - what are we relying on it for?. If he's comfortable with a 1% chance of any given block being left behind, then the double-write technique in the paper should work for him. If his organization is putting in the effort to sanitize drives, they might also be able to test and purchase particular models for effectiveness. – Devin R Feb 15 '17 at 21:10
  • These were magnetic drives for a laptop, not SSDs. – Original Poster Feb 16 '17 at 17:19
  • @JoshTownzen In the interest of national security and law enforcement, the "unreliability" of overwriting SSDs may even be more of vendor "feature." Quoting Gutmann's paper, "To erase SSDs.... well, you're on your own there." – Original Poster Feb 16 '17 at 17:27
  • The only sure way to erase an SSD is to Encrypt all data and dump the encryption key when you "delete". The next best way is to use ATA Secure Erase command, but this feature is sometimes not implemented correctly, resulting in remnants or using weak encryption mode like ECB that may leak data, you'd have to research the particular drive model to see how well it implements secure erase. – Lie Ryan Mar 18 '17 at 2:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.