Just as the title states I'm wondering if its possible for the government to recover data from a encrypted ssd that was wiped? Thanks in advance!

  • “The government” is very ambiguous in a world with hundreds of countries. Also, one could fairly assume that information about sensitive techniques won’t be available, therefore this becomes an opinion based question. Consider removing “the government” to make this a generic question about data recovery from encrypted / wiped drives. – David Jan 3 '19 at 23:34
  • Unfortunately this entirely depends on what you mean by "wiped." Done correctly, no data will be available, as the SSD will have been encrypted, and the encryption key "lost" to wipe it. Incorrectly, and you could retrieve all sorts of data. – Rory Alsop Jan 3 '19 at 23:37
  • Need more info such as what government, the type of encryption used on the SSD, how bad they are going to want to recover said data, etc. Specify these and I'm sure the gatekeepers will let you stick around. – Henry F Jan 4 '19 at 0:18

I would clearly say yes. To explain this let's take a look at the differences between HDDs and SSDs. On HDDs data is always written on free space in one order. So you definitely know when you have overwritten one block often enought the data is gone. (also depends on the HDD. On some there are spare parts to recover the data)

At SSDs is a big difference. To comply with wear levelling, the SSD must constantly move data around the drive to ensure all blocks are worn at an equal rate. So if one data block is more worn out than an other, you overwrite just that "good" block multiple times, but the data is still in the "bad" sector (your encrypted data). As you can see it won't work with normal eraser which just overwrite the space.

If you want to secure erase your data on a SSD you need to take a look at ATA Secure Erase. At this procedure the command instructs the drive to flush all stored electrons, forcing the drive to “forget” all stored data. But this is not the only way to delete it. On some drives you can delete the encryption key which is used at the SSD. It dependes on your SSD. Look at your manufacturer to get better information about it.

To answer you question more specific: If you use normal erasers it is possible that there are some datablocks left behind. But these blocks are encrypted anyway. Normally it should not be possible to decrypt them (only if you set the encryption correct up). Anyway, if you want to delete the whole data look at your manufacturer to get to know how to delete it safe.

  • 1
    This is not how secure erase works on many drives. It’s very common for SSD based storage to transparently encrypt internal storage. Secure erase simply deletes the key, (hopefully) rendering the data unrecoverable. See: thomas-krenn.com/en/wiki/SSD_Secure_Erase – David Jan 3 '19 at 23:38
  • 1
    Also all modern magnetic hard drives have spare sectors to remap failed parts of the disk. This is not a new phenomenon. – David Jan 3 '19 at 23:41
  • @David thank you for your input. I forget about that. I added it in the answer – CD Rohling Jan 3 '19 at 23:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.