1

It can be understood that if i delete some data, those bytes may not be written by other data can be extracted because the data actually resides on those sectors/cells.

But i wounder how the bytes can be recovered from the sectors/memory-cells, when the sectors are already written.

Why people say that to be sure that your data can't be extracted from your media, leaving aside the encryption, physically destroying the media is the ultimate option.

Suppose i have a flash drive, it size is X-bytes and i write some random bytes to the whole X-byte cells, how can a person recover the previous data as the cells contains random data ?

I am not interested in the technique(s), but just curious about how recovery works in this kind of scenario.

1

As you said you were not interested in technical detail, I will give a rough, top level approach to answer your question.

First off, flash drives have a built-in process called wear leveling where the controller does select the sectors that will be written to level the wear on all available sectors (which are more than those offered to you to be written to, usually). Thus, when you randomize all sectors available to you, there might be still "old" data in the sectors currently not on wear leveling duty.

Apart from that, there are minor differences in between memory sections that contained a 0 before an 1 and one that did contain a 1 before another 1. (technicalities differ between magnetic disks flash devices) and thus, assuming you have written random data and the data written before wasn't random (i.e. has intrinsic structure), you can statistically remove the noise from the random data and have some good guesses as to what was written before the random data.

That is the reason, multiple rewrites with randomness are considered more secure than one single go. Yet, the capabilities to make out those minor differences mentioned before are sparse and usually consider a state actor of some kind being the attacker in your threat model.

1
  • Thx, like, it will be awesome if you will add some links to that assumptions. Jul 9 '19 at 1:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.