We are told to erase (overwrite) sensitive files, not only simply "delete" it (i.e. only remove the information where it exists). For the moment being, I'd like to focus on the following and ignore other aspects (e.g. wear leveling on SSD) that may result in data leaks .
Taking this a step farther: does secure erase / overwriting with a special pattern leave the indication that there was a file? I learned that (full) formatting may behave differently depending on the OS (e.g. write zeros in/since(?) MS Vista (1st comment on this Q). In this example (all zeros), random overwriting even with a close-to-paranoid multipass algorithm such as DOD 5220-2M (last pass writes random data) would indicate that and where was/were some file(s) in the first place on media that has disputedly been used or not - one would needto choose one that produces the original "shelf" pattern.
Questions:
- How would brand new media from shelf (HDD, SSD, USB drive, SD card...) look like (before a customer posibly (re-)formats it), i.e. all 0, all 1, random 0/1, specific pattern...? (I do not know (but may learn) how to examine non-file data, and I am not sure how "representative this would be)
- Is there a (at least partial) list of formatting behaviour of the plenty of different OS and OS versions (e.g. Win-8, Win-10, Ubuntu and other distros, Mac-OS, Apple/Andoroid phones...)?
