We’re rewarding the question askers & reputations are being recalculated! Read more.
72

Yes. If you do a normal format, the old data can be recovered. A normal format only deletes/overwrites a tiny bit of filesystem metadata, but does not overwrite all of the data itself. The data is still there. This is especially true on SSDs, due to wear levelling and other features of SSDs. The following research paper studies erasure of data on SSDs: ...


43

To quote the ISM (Australia's military standards for cyber security). Security Control: 0359; In flash memory media, a technique known as wear levelling ensures that writes are distributed evenly across each memory block. This feature necessitates flash memory being overwritten with a random pattern twice as this helps ensure that all memory blocks ...


22

Next time you're about to put sensitive data on a flash drive, consider encrypting it first! Strongly encrypted data is useless without the key, and if you securely erase the drive first, all that will be left is an occasional sector of such encrypted data surviving due to wear leveling. If you're still unsatisfied by this technique because there's a small ...


17

A quick check at amazon.com shows 64GB USB drives in non-designer cases go for about $20. Less if you buy in bulk. Since you want "quick and efficient" lets factor in the time needed to overwrite the drive at least twice, and maybe running a drive scanner to verify the erasure. And then remembering to do it each time. A quick check of homedepot.com shows a ...


11

UPDATE: Upon looking back it looks like using random data is not really necessary as a successful platter-level 'previous state' attack on a zeroed drive has yet to be proven possible in a real-world attack. I've left the references below for posterity and because it does technically work fine if you're using random data, but given that just using 0s is ...


11

This topic has already been covered here and there. To sum up: If you simply overwrite the complete disk (as a block) with data (random, null bytes... it does not matter), then there may be parts of surviving data, which could potentially be recovered by extracting the chip and reading from it directly. You cannot know what data has survived without taking ...


9

Without adding any additional hardware, is RAM encryption possible? Sure. You can encrypt whatever you like in RAM, just like you encrypt everything else. The more interesting quesstion is "where are the keys". You can just leave the keys in RAM as well or give them to the OS which will also store them in RAM. You can apply some of the fancy techniques ...


9

Wikipedia is correct: on SD cards, you have to trust the host system (whatever the card is plugged in to) to honor the physical write protect switch. Here is the relevant text from the publicly available specification documents. Emphasis is mine. SD Specifications Part 1 Physical Layer Simplified Specification Version 4.10 January 22, 2013 ...


7

It largely depends on the chip and the person that programmed it. Microcontrollers usually have a feature that allows you to pull the existing firmware binary off, but in many cases that can be disabled with a so-called "secure flag", which disables the download process until a new firmware is uploaded containing directives that turn the secure flag off. Of ...


7

EEPROMs work by storing charge in floating-gate transistors. Think of these transistors like tiny capacitors that leak extremely slowly (typically with retention lifetimes of 10+ years), except with the added provision that you can tell whether it's charged or uncharged. Programming one simply involves feeding it a power source and pulling the gate to high ...


6

Without knowing your particular use case I'll supply an alternative answer that you might find useful, and it's one I use myself. Encrypt the data stored on the device. Use a device such as the LOKIT (http://www.lok-it.net/) which has built in encryption. Create a TC (TrueCrypt) container and put all data in this. Once you're done, change the password to a ...


5

I'd like to refer to this video. It explains how data can be recovered from HDDs using thresholds. Which includes that the given signal-level returned from a HDD ain't only based on the current content, but also on what was previously there. By changing the 'accuracy' of the signal-detection you can find what was previously there. However this is of course ...


4

Absolutely, particularly if you are using RAM as non-persistent storage in which case you can encrypt it like any disk, file or directory after partitioning it off and mounting it in namespace. However, executable program data needs to exist as 'plaintext' in memory at some point so it is ineffective to try and protect kernel and program memory in this ...


4

My very first thought: Nobody can be absolutely sure that something has not happened, so the only acceptable answer to your question would be an example. I'm trying to explain my thoughts on why you are very unlikely to get such an example. My argument is inspired by the Drake equation. Let me start with some facts that I think we all agree on (more or ...


3

Recovery is only possible under certain conditions: have an older SSD with no TRIM support or have Windows XP (as it does not support TRIM) or another old OS with no TRIM support or you connect the SSD as an external hard drive via USB port. or AHCI / SATA interfaces are not detected in your old MB - you use legacy mode/IDE mode or you have a RAID 0 setup ...


3

While SD cards cannot be programmed to behave as a different key of USB device like a keyboard (i.e. Bad USB) they have their own vulnerabilities since they also contain firmware which can be hacked. From On Hacking MicroSD Cards (12/2013): ... code execution on the memory card enables a class of MITM (man-in-the-middle) attacks, where the card seems to ...


3

It is indeed possible that the block containing the key cannot be properly erased. That's why LUKS uses AFsplit to store the key on disk. The idea is essentially to expand a key that would normally be stored on a single disk block, into a format that requires many more, ensuring that the loss of a single of those blocks makes the key lost. So when erasing ...


3

Very plausible. Windows stores device information from connected USB devices in the registry, this is commonly used in forensics. If you attach an iPod/iPhone, it can leave traces on the local system as well and traces of the system you connected to my be left on the device. Endpoint DLP and antivirus may also scan removable media and leave traces. If a ...


2

Who are you defending against? No, really, because remember, with SSD, there are sectors that go bad that are no longer writable. With ATA Secure Erase, the drive is also supposed to erase the mapped-out bad blocks, but if the blocks are actually no longer writable, it cannot succeed. You can't blame a vendor for not doing the impossible. A custom ...


2

In the Mobile Operating System Protection Profile, it's said: Compliance to Guidelines for Media Sanitization (SP 800-88 Rev1, dated Sept 2012) Appendix A, Table A-3 Mobile Device Sanitization is recommended. And on the SP 800-88 Rev1 - draft you can find the following recomendations: Table A-8. Flash-Based Storage Device Sanitization SSD (...) ...


2

Encrypt a large picture of noise such that the file size occupies most of the drive. Do the same for a medium sized picture and then a small picture. Copy the large picture to the drive and if you have any room left over copy the smaller pictures to it. Avoid copying the same file to the drive more than once. Repeat the process with new pictures of noise. ...


2

Make a big file full of random data that fills the entire device. Delete it then do it all over again a few times. This should defeat load leveling.


2

This depends on the logging which was in place on your system when you were doing the copy. Logging the file copy is not enabled by default. There are other programs you can indirectly get that information form, specifically antivirus software which may log the history of its checks. This is also possible via the program you used to open the file with (this ...


2

First, there's a terminology issue when talking about this stuff. Strictly, 'BIOS' and 'UEFI' are different programming interfaces for the firmware present on PC motherboards. However, in a PC context, 'BIOS' is often used to refer to the firmware irrespective of its API -- that is, "UEFI BIOSes" should strictly read "UEFI firmwares". (Just to be clear: ...


2

Flash storage is inherently different from spinning disk storage at a physical, and operational level. Unlike spinning disks, flash storage has a limited amount of write cycles. The solution to increasing the lifespan of the media to something usable that storage makers have come up with is called wear leveling. Essentially what this means is that when ...


1

To wipe the entire drive, all you have to do is wipe the spot that stores the encryption of K That statement is correct under its theoretical form. If you can guarantee you can wipe the key, and no one had ever access to that block, you have wiped the disk. I mean that if you have low-level disk access and got the right block copied somewhere, then you can ...


1

You mean that when you overwrite or delete data on a flash-drive, the microcontroller in that flash-drive doesn't immediately delete or overwrite the block, but instead put them on a 'delete-in-future-list' to improve performance. That's true, but also read: delete-in-future-list, that 'future' is when the microcontroller has no other actions to do. As soon ...


1

Unfortunately all the slick methods of Full Disk Encryption are all native to the OS, and so only available on that OS, so if you need cross-platform support you have to use a more nerdy solution like GPG. In my experience the easiest way to achieve something like this usually ends up, as Matthew suggests, to be an encrypted zip file. You can find plenty of ...


1

Generally on a computer, software encryption often runs on shared architecture such as your computers CPU. True hardware encryption would run on something like a Secure Cryptoprocessor or similar dedicated chipset. This can help isolate secure procedures from the rest of the system and often have architecture to very quickly run the needed calculations. ...


1

Ultimately, there is no difference: both "types" of encryption will end up running some software on top of some hardware so this is mostly a marketing argument. How an encryption stack works exactly depends, of course, from case to case and it is very important to review the details. For instance, some hard drive will implement some encryption layer in ...


Only top voted, non community-wiki answers of a minimum length are eligible