Flash drives dangerously hard to purge of sensitive data

[Airbot]

When secure wiping isn't

In research that has important findings for banks, businesses and security buffs everywhere, scientists have found that computer files stored on solid state drives are sometimes impossible to delete using traditional disk-erasure techniques.

Even when the next-generation storage devices show that files have been deleted, as much as 75 percent of the data contained in them may still reside on the flash-based drives, according to the research, which is being presented this week at the Usenix FAST 11 conference in California. In some cases, the SSDs, or sold-state drives, incorrectly indicate the files have been "securely erased" even though duplicate files remain in secondary locations.

more..

 

[Golden]

Very interesting....might just hang onto all those old flashdrives for a while yet.

 

[Ciara]

Could that cause a problem when performing a clean install of an Operating System ? residue of the previous Operating System could cause system problems.

 

[metalmania31]

Looks like the only sure fire way is to actually physically destroy the drive after using it to it's max life.

 

[seekermeister]

I had thought about buying an SSD, but this may change that. It is not that I have all that much data that I need to secure, but it doesn't take much to be significant. The idea of a lost or stolen drive has never been very nice, but with these I would even be concerned about RMAing one. It makes it sound as though the only safe method of securing data is a big hammer.

EDIT: Seems that metalmania31 and I were thinking along the same lines.

 

[Fayla]

I always physically destroy my old flash drives / hard drives anyway, so this isn't a concern for me. But as someone said, this makes SSDs even more unappealing.

 

[Ciara]

I was to buy a SSD drive later this year as part of a new computer build ... I may well be looking at a mechanical drives now :shock:

 

[Golden]

Hi,

Perhaps one way to "secure wipe" it would be to put it through a looping defragmentation. Perhaps even a constant and looping performance test using HDTUNE or similar. These are known to shorten the life of the SSD (although I'm not sure exactly what that means).

Perhaps some SSD guru's could comment on that?

I tend to keep my sensitive data off the SSD, so perhaps its not as big an issue at the moment.

Regards,
Golden

 

[Zepher]

I was to buy a SSD drive later this year as part of a new computer build ... I may well be looking at a mechanical drives now :shock:

Why would this info change your mind? do you often lose your hard drive?
Also, if your mechanical drive fails and you RMA it, the Data is still on it.

 

[Dzomlija]

This is no problem that an incinerator won't solve...

 

[seekermeister]

I was to buy a SSD drive later this year as part of a new computer build ... I may well be looking at a mechanical drives now :shock:

Why would this info change your mind? do you often lose your hard drive?
Also, if your mechanical drive fails and you RMA it, the Data is still on it.

It is not a question of how often a drive is lost (although with thumb drives that is not so rare), but how much and what kind of data is lost. I can't speak for anyone else, but even if I have to RMA a drive, I low level format it first. I see no reason to trust my data to someone that works for a manufacturer, than I do with anyone else.

 

[Golden]

Hi,

I think the issue is more of a case of how well a SSD disk is "scrubbed" or "erased". A disk format is not the same as "scrubbing", even on a mechanical disk. See here for some background reading:

Data recovery - Wikipedia, the free encyclopedia

There is lots of software out there that is able to scrub mechanical disks, but the article in the first post raises questions as to how well this software scrubs non-mechanical (ie. SSD, flash, thumb) disks.

If an SSD dies on you, and an RMA is not an issue, then the safest method is absolute destruction.

Regards,
Golden

 

[Buddahfan]

Someone will figure out how to solve the problem

In fact that person could be a poster on Windows SevenForums

 

[Zepher]

I was to buy a SSD drive later this year as part of a new computer build ... I may well be looking at a mechanical drives now :shock:

Why would this info change your mind? do you often lose your hard drive?
Also, if your mechanical drive fails and you RMA it, the Data is still on it.

It is not a question of how often a drive is lost (although with thumb drives that is not so rare), but how much and what kind of data is lost. I can't speak for anyone else, but even if I have to RMA a drive, I low level format it first. I see no reason to trust my data to someone that works for a manufacturer, than I do with anyone else.

If the drive can't be accessed to be low level formatted, what do you do, just destroy the drive and not RMA it?

 

[Ciara]

I was to buy a SSD drive later this year as part of a new computer build ... I may well be looking at a mechanical drives now :shock:

Why would this info change your mind? do you often lose your hard drive?
Also, if your mechanical drive fails and you RMA it, the Data is still on it.

Loosing is not the issue its not being able to get rid of data, as I said ...

Could that cause a problem when performing a clean install of an Operating System ? residue of the previous Operating System could cause system problems.

 

[seekermeister]

Why would this info change your mind? do you often lose your hard drive?
Also, if your mechanical drive fails and you RMA it, the Data is still on it.

It is not a question of how often a drive is lost (although with thumb drives that is not so rare), but how much and what kind of data is lost. I can't speak for anyone else, but even if I have to RMA a drive, I low level format it first. I see no reason to trust my data to someone that works for a manufacturer, than I do with anyone else.

If the drive can't be accessed to be low level formatted, what do you do, just destroy the drive and not RMA it?

Possibly. That depends on what I was using the drive for, and what it contained.

 

[lehnerus2000]

I'm confused

Is this article saying, if I delete ALL of the files on a USB stick (lets say 4 GB) and I then write a 4 GB file (lets say a bmp) my original data can be recovered?

 

[Golden]

That is what it is suggesting, yes. But, it does take some effort to do that - its not straight forward to simply "get" to the original files.

Its worth reading the paper referenced at the bottom of the article that Airbot referenced, posted here (mods please remove if its not OK to post a direct link to that paper):

http://www.usenix.org/events/fast11/tech/full_papers/Wei.pdf

In the their paper, the researchers conclude:

overwriting the entire visible address space of an SSD twice is usually, but not always, sufficient to sanitize the drive.​

​

​

​

 

[Zepher]

I was to buy a SSD drive later this year as part of a new computer build ... I may well be looking at a mechanical drives now :shock:

Why would this info change your mind? do you often lose your hard drive?
Also, if your mechanical drive fails and you RMA it, the Data is still on it.

Loosing is not the issue its not being able to get rid of data, as I said ...

Could that cause a problem when performing a clean install of an Operating System ? residue of the previous Operating System could cause system problems.

I keep my old drives and when I no longer need them (usually due to the small size of the drive or the interface style) then I'll physically destroy them.
About 5 years ago I was cleaning up and had a stack of 9GB Seagate SCSI drives that I wouldn't be using anymore. Brought them to the garage and hammered the shit out of them with a 5lbs mallet.

I've got about 15 old drives in my drawer and soon I'll dispose of those as well using the mallet.

 

[Stratos]

First of all low level formatting does not guarantee complete erasure, there are methods that may still allow for some recovery of data. Most of the tools HDD manufacturers offer as free downloads aren't the same as the ones they use at the factory which lays out the sectors and such.

The most effective method is overwriting the memory addresses in the SSD with null data. Using a multi-pass drive erasure tool will do a fine job. So what if someone can recover a few bits of data here and there, what matters is they can't piece together a complete file or a single complete line of data. I've never seen anyone to include Ontrack's services to be able to extract/recover data that's undergone 10 or more overwrites.

If you're that paranoid of data recovery, you can simply use disk encryption, something IBM/Lenovo users have been doing for many years. You can either setup an encrypted partition ahead of time then install your OS ontop of it OR you can use something like TrueCrypt which allows you to create a virtual disk on-the-fly where your OS is already installed.