5 ms·

And most of them have the option to secure erase either after every scan, or on a schedule. But it's amazing how few people outside of IT know that most devices

And most of them have the option to secure erase either after every scan, or on a schedule. But it's amazing how few people outside of IT know that most devices have embedded websites, let alone the security implications.

djsumdog 8y ago
Secure erase of a metal/spinny drive is really not enough. There are data recovery companies who can pull data on metal hard drives from hundreds of writes in the past. These hard drives should be pulled and re-purposed internally for sensitive information in data centers (to reduce waste), and if they can't be, they should be physically destroyed. (US government agencies shred or melt drives). Ideally, copier companies should (if they insist on not removing the drives) encrypt them by default. That way when you "wipe" the copier for sale, it just deletes the encryption key from flash memory. Then the bar for data recovery becomes incredibly difficult and you don't have to waste the drive.
- fooker 8y ago
  Source for 'hundreds of writes in the past'?
- tinus_hn 8y ago
  That only works on a disk using a format from the 90s. On a modern disk once you overwrite a sector the contents are no longer retrievable. There are no companies that can read a sector that has been overwritten. They can only recover damaged drives and files that have been deleted by the operating system and not been overwritten. On the other hand, deleting flash memory is very difficult because the controller doesn’t really do what you ask it to do.
  - BoorishBears 8y ago
    These days controllers have secure delete / wipe commands too
- jacquesm 8y ago
  > There are data recovery companies who can pull data on metal hard drives from hundreds of writes in the past. That's great, that means we can store 100's of times more data on the drives than we do!
- ClassyJacket 8y ago
  > There are data recovery companies who can pull data on metal hard drives from hundreds of writes in the past. This isn't true - if it was, hard drive companies would use that space to store primary data, increasing the capacity of their drives by hundreds of times compared to the competition.
- c22 8y ago
  For what it's worth I gave you an upvote because even though your unsourced assertion in the first paragraph is clearly absurd, I liked your message about recycling and agree that an encrypted ring buffer that loses the key on "factory reset" would be an elegant solution to this problem that would not impact other functionality.
- kalleboo 8y ago
  The "you can recover overwritten data" thing is a myth. There was a paper that showed a theory behind it (for old drives using a different technology than is used today), but there's no proof anyone has ever actually done it. http://www.infosecisland.com/blogview/16130-The-Urban-Legend-of-Multipass-Hard-Disk-Overwrite.html http://www.infosecisland.com/blogview/16130-The-Urban-Legend...

djsumdog 8y ago

Secure erase of a metal/spinny drive is really not enough. There are data recovery companies who can pull data on metal hard drives from hundreds of writes in the past. These hard drives should be pulled and re-purposed internally for sensitive information in data centers (to reduce waste), and if they can't be, they should be physically destroyed. (US government agencies shred or melt drives). Ideally, copier companies should (if they insist on not removing the drives) encrypt them by default. That way when you "wipe" the copier for sale, it just deletes the encryption key from flash memory. Then the bar for data recovery becomes incredibly difficult and you don't have to waste the drive.

fooker 8y ago
Source for 'hundreds of writes in the past'?
tinus_hn 8y ago
That only works on a disk using a format from the 90s. On a modern disk once you overwrite a sector the contents are no longer retrievable. There are no companies that can read a sector that has been overwritten. They can only recover damaged drives and files that have been deleted by the operating system and not been overwritten. On the other hand, deleting flash memory is very difficult because the controller doesn’t really do what you ask it to do.
- BoorishBears 8y ago
  These days controllers have secure delete / wipe commands too
jacquesm 8y ago
> There are data recovery companies who can pull data on metal hard drives from hundreds of writes in the past. That's great, that means we can store 100's of times more data on the drives than we do!
ClassyJacket 8y ago
> There are data recovery companies who can pull data on metal hard drives from hundreds of writes in the past. This isn't true - if it was, hard drive companies would use that space to store primary data, increasing the capacity of their drives by hundreds of times compared to the competition.
c22 8y ago
For what it's worth I gave you an upvote because even though your unsourced assertion in the first paragraph is clearly absurd, I liked your message about recycling and agree that an encrypted ring buffer that loses the key on "factory reset" would be an elegant solution to this problem that would not impact other functionality.
kalleboo 8y ago
The "you can recover overwritten data" thing is a myth. There was a paper that showed a theory behind it (for old drives using a different technology than is used today), but there's no proof anyone has ever actually done it. http://www.infosecisland.com/blogview/16130-The-Urban-Legend-of-Multipass-Hard-Disk-Overwrite.html http://www.infosecisland.com/blogview/16130-The-Urban-Legend...