Solid state drive erasures

9100 · Aug 3, 2020

It is well known that mechanical hard drives often leave a side track that can be read, even when the drive has been formatted. In a solid state drive it seems that a particular address is switched to 0 or 1 and that is the end of it. Can one be completely erased?

Bill

MattiJ · Aug 4, 2020

9100 said:
It is well known that mechanical hard drives often leave a side track that can be read, even when the drive has been formatted. In a solid state drive it seems that a particular address is switched to 0 or 1 and that is the end of it. Can one be completely erased?

Bill

That was true maybe 40 years ago with the low density drives. And even then it was expensive and time consuming "NSA with national budget" style operation.
With the modern hard drive density it is either impossible or crazy hard. I doubt anyone has demonstrated it successfully in last 30 years.
Scanning a modern 1TB drive would generate peta- or exabytes of data and processing time would be measured in years.

https://security.web.cern.ch/rules/images/HDD Data Reconstructiusing MFM.pdf
any hardware device to read hdd platters !! – Forensic Hardware – Forensic Focus Forums

OS/File system not overwriting the actual data is another matter...

With solid state drives the situation is complex.. Really easy to lose 99.9% of the data but if the drive is full of nuclear launch codes you might want 100%

If you just delete the files the data is still on the drive, OS/filesystem just doesn't care. Block is actually erased when SSD's internal logic thinks its suitable time. Could be right now, could be during night when SSD logic is doing "housekeeping" (trim or "garbage collection") or when the other areas of the drive get full. Or that particular block is never erased if drive logic decides that the block in question is unreliable and re-allocated to physically somewhere else.

MattiJ · Aug 4, 2020

File Recovery Specifics for SSD devices

jccaclimber · Aug 4, 2020

MattiJ said:
That was true maybe 40 years ago with the low density drives. And even then it was expensive and time consuming "NSA with national budget" style operation.
With the modern hard drive density it is either impossible or crazy hard. I doubt anyone has demonstrated it successfully in last 30 years.
Scanning a modern 1TB drive would generate peta- or exabytes of data and processing time would be measured in years.

https://security.web.cern.ch/rules/images/HDD Data Reconstructiusing MFM.pdf
any hardware device to read hdd platters !! – Forensic Hardware – Forensic Focus Forums

OS/File system not overwriting the actual data is another matter...

With solid state drives the situation is complex.. Really easy to lose 99.9% of the data but if the drive is full of nuclear launch codes you might want 100%

If you just delete the files the data is still on the drive, OS/filesystem just doesn't care. Block is actually erased when SSD's internal logic thinks its suitable time. Could be right now, could be during night when SSD logic is doing "housekeeping" (trim or "garbage collection") or when the other areas of the drive get full. Or that particular block is never erased if drive logic decides that the block in question is unreliable and re-allocated to physically somewhere else.

I've seen some interesting papers within the last decade where someone wrote data to a platter drive, did a random write over it (randomly 1 or 0 per bit), and then was still able to determine the original data. If I remember correctly in some cases they were even able to do this after two random writes.

It may well take an interested nation, opposed to interested individual, but unless you're controlling access, really you're just making the assumption that nobody cares enough to go after your data. It's not a terrible assumption, but I wouldn't use it on anything that truly needs to remain secure. Here's an example where a 4096 bit key was determined by placing a cell phone near the target computer. All the target needed to do was open an encrypted e-mail. Not an e-mail that releases a virus, just an e-mail of known content.
New attack steals e-mail decryption keys by capturing computer sounds | Ars Technica

As to if any of this is relevant to SSDs I'm not sure. Last time I needed to be sure something was destroyed I simply fixtured it an automatic surface grinder and hit cycle start. There are plenty of machine shop tools capable of melting, or at least reducing to minuscule pieces as needed.

MattiJ · Aug 4, 2020

Would you mind to throw a link to any of those papers?
All I have been able to find refers to 90’s Gutmann papers.
How Many Times Must You Overwrite a Hard Disk? - Blancco

2006 to Today: DoD Drops 3-Pass Requirement, Other Governments Tout 1 to 3 Passes
NIST 800-88: The Current U.S. Government Standard States 1 Pass is Sufficient

Later in 2006, the DoD 5220.22-M operating manual removed text mentioning any recommended overwriting method. Instead, it delegated that decision to government oversight agencies (CSAs, or Cognizant Security Agencies), allowing those agencies to determine best practices for data sanitization in most cases.
”
Meanwhile, the U.S. National Institute of Standards and Technology (NIST), in its Guidelines for Media Sanitization of 2006 (PDF), stated that “for ATA disk drives manufactured after 2001 (over 15 GB) clearing by overwriting the media once is adequate to protect the media.” When NIST revised its guidelines in late 2014, it reaffirmed that stance. NIST 800-88, Rev. 1 (PDF) states, “For storage devices containing magnetic media, a single overwrite pass with a fixed pattern such as binary zeros typically hinders recovery of data even if state of the art laboratory techniques are applied to attempt to retrieve the data.” (It noted, however, that hidden areas of the drive should also be addressed.)
”

jccaclimber · Aug 5, 2020

They were shown to me as a result of making the same claim you made by a former room mate who was working in that area. I'll reach out to him for the sources and post pack if anything comes up.

Toolroomguy · Aug 5, 2020

jccaclimber said:
Last time I needed to be sure something was destroyed I simply fixtured it an automatic surface grinder and hit cycle start. There are plenty of machine shop tools capable of melting, or at least reducing to minuscule pieces as needed.

I did that with a floppy disk and was still able to read the disk after a demag cycle on the chuck.

jccaclimber · Aug 5, 2020

Toolroomguy said:
I did that with a floppy disk and was still able to read the disk after a demag cycle on the chuck.

I was not sufficiently clear, I ground through it and turned it to dust.
Be warned, there is often a fair bit of aluminum and things that get loose in a drive.

DavidScott · Aug 5, 2020

Wouldn't a hammer do the trick? Or do you want to keep it in a useable condition?

MattiJ · Aug 5, 2020

DavidScott said:
Wouldn't a hammer do the trick? Or do you want to keep it in a useable condition?

Better pulverize it totally if it contains some uber-Secret nuclear launch code material. Otherwise erase and random fill is sufficient and possibly even more reliable than few hammer strikes. Sloppy hammering could leave some of the actual chips nearly intact if the villain has unlimited resources for data recovery.

NIST link above gives guidelines and recommendations for various media types.

as9100d · Aug 5, 2020

What's neat is ssd drives rely on quantum mechanics to store data.i wonder how far the gov is at super computers, quantum entanglement, etc...

Foil hat says they can read all your data some day without even being near it.

Sent from my Pixel 3 using Tapatalk

CarbideBob · Aug 5, 2020

Why do you ask?...Doing things you should not? .. :skep:

..

ChipSplitter · Aug 5, 2020

Rewrite with random data.......3 times.
Crush with hammer.
Bury 4 feet under in the back forty in the middle of a rainy night.

If that ^^ doesn't make you feel secure nothing will.

NRDock · Aug 5, 2020

Foil hat says they can read all your data some day without even being near it. [/QUOTE said:
Close has been good enough for a while:
Van Eck phreaking - Wikipedia

Oldwrench · Aug 5, 2020

ChipSplitter said:
Rewrite with random data.......3 times. Crush with hammer. Bury 4 feet under in the back forty in the middle of a rainy night.
If that ^^ doesn't make you feel secure nothing will.

Yes, there's something confidence-inspiring about physically destroying the media. This drive obviously wasn't solid state to begin with but it's now a lot less solid state. Sure, NSA could probably reconstitute the data, but where industrial espionage is concerned I'm not worried about it reassembling itself like Christine or the Terminator...

1953chevB · Aug 5, 2020

being out of the loop for 10 years, the old drives a low level format completely re-formatted the entire drive,
this was a factory reset, and it was not for the faint hearted. software use to be free from the MFG.
no idea on the new SS hard drives.
that being said anyone try the free GNU Linux programs to destroy all data on the hard drives?
Ghost for Linus worked exceptionally good for mirrored drives for emergency, all file saved on an FTP Linux server.
cool beans, and did not cost a dime, free.

TeachMePlease · Aug 7, 2020

There's free software for such. One that I used as a kid, that is probably still around is DBAN... Derek's Boot and Nuke. You can use it to write random data to a hard drive repeatedly, as many times as you want, ensuring all ghosts of actual data are gone.

Fal Grunt · Aug 7, 2020

Boot Nuke was what we always used. . .

Anymore I find most any high velocity projectile works fine.

Brandenberger · Aug 7, 2020

To answer the original post: on an SSD the locations of each piece of data are not fixed. The SSD itself maintains a mapping of where things are stored, to avoid as many writes as possible to the actual memory cells. So data that is modified nevertheless stays in original form until it is rewritten much later.

The algorithms also will actively manage wear to the underlying cells and stop using areas that have high wear, meaning in theory data you thought was erased or overwritten can remain.

So overall, I would say all bets are off about erasing an SSD with certainty, other than by mechanical means.

thermite · Aug 7, 2020

Brandenberger said:
To answer the original post: on an SSD the locations of each piece of data are not fixed. The SSD itself maintains a mapping of where things are stored, to avoid as many writes as possible to the actual memory cells. So data that is modified nevertheless stays in original form until it is rewritten much later.

The algorithms also will actively manage wear to the underlying cells and stop using areas that have high wear, meaning in theory data you thought was erased or overwritten can remain.

So overall, I would say all bets are off about erasing an SSD with certainty, other than by mechanical means.

The question hasn't even been coming up much for about ten years if not twenty in high capacity storage unit data center operations.

Long and short of it is that NEW storage is faster, better, smaller, cheaper, less power-hungry, some combination of all of the above so:

A) The goal is VERY rarely to "recycle" the old media, for use of a new user by destroying any hope of access to the data of a former user. Just give them (or yourself) "Virgin", new media, and go back to USEFUL work.

B) ALL of the storage densities had gotten so DAMNED HIGH, it takes HOURS and HOURS to do a seven-pass random over-write of a typical sized drive, solid state OR rotating. Why would a sane entity tie up a machine and power and costly human over-sight for such unproductive nonsense?

C) "mechanical means", thermal or chemical, mostly, don't give the least damn about storage capacity. Only mass and type of material. Even so, given an appropriate means is applied to any given mass, it takes about the same time and expense to smelt or dissolve either type into unrecoverable slag or slurry, regardless of data stored or possible capacity FOR it.

So "mechanical means" it what we doos. It is cheap. It takes less time. Human time is expensive and hard to replace, once wasted.

End of data. End of problem. End of story.

And ZERO "host computer" OS or software involved.

Last batch I did, 60-plus still-good "preventive maintenance" and/or upgrade data server HDD "pulls"?

- Step One: a drillpress was depth-stop-set to ruin PCB, plus platter(s), AND NOT exit the far side,

- Step Two: Muriatic Acid was injected through the hole, then a bit of jackleg sealant.

- Step Three: They were left to "cook" for a period of time at a mildly elevated temperature.

Only THEN sent off to the ordinary scrappers of such goods, special high-security disposal credentials no longer of any concern whatsoever.

SSD? MAPP gas torch, decent exhaust extractor, soon done. Or the kitchen range with range hood for the under-resourced.

Mechanical means are all about "BFBI" - Brute Force and Bloody Ignorance.. because "ignorance" .... of any prior data ... is the actual operative goal.

KISS method applies.

Keep It Simple, Stupid.

Solid state drive erasures

Diamond

Titanium

Titanium

Stainless

Titanium

Stainless

Cast Iron

Stainless

Diamond

Titanium

Stainless

Diamond

Titanium

Cast Iron

Titanium

Attachments

Cast Iron

Diamond

Titanium

Hot Rolled

Diamond

Similar threads