7 ms·
SSD firmware destroys digital evidence, researchers find
- meroliph 16y agoSo I get huge speeds, virtually no i/o wait and when I delete something I can be sure it's gone forever? The only problem left to solve is huge capacities for these devices at relatively affordable prices.
- stcredzero 16y agoMy read is that the devices are still unfamiliar to investigators. I bet it's just a matter of time before someone starts figuring out how to read blocks that are waiting to be actually erased (which is a time consuming and energy-intensive operation for SLC flash, and sometimes deferred) on particular popular devices. Of course, it's going to be unfamiliar to those who have been working closely with HDDs at a low level for years. EDIT: Speaking of which: http://sec.pn.to/pw/?plugin=attach&pcmd=open&file=tapping.jpg&refer=Bases http://sec.pn.to/pw/?plugin=attach&pcmd=open&file=ta... tl;dr - That's just security by obscurity. Someone will figure out how to read unerased data. (That said, those blocks eventually will be erased and recycled, it's just a matter of when.)
- gvb 16y agoThe whole (rather breathless) point of the article is that SSDs erases the blocks quite rapidly. It isn't that the old blocks are still laying around but the researchers did not know how to access them, it is that (a) they are erased rapidly under normal conditions and (b) they are erased even when they researchers used a "write blocker" mechanism[1]. IOW, they (the article's author, anyway) were apparently surprised to find that the SDD garbage collected autonomously and regardless of the "write blocker" mechanism). The (a) case is likely OSes using the "trim" command and the (b) cases are inherent in how SSD firmware works (by necessity). WRT the (b) case, SSDs have to garbage collect. Their write speed, and thus user satisfaction, is dependent on it keeping a large number of erased blocks ready to be written to. [1] http://www.forensicswiki.org/wiki/Write_Blockers http://www.forensicswiki.org/wiki/Write_Blockers - apparently simply a "man in the middle" hardware that filters out write commands, lets through read commands. Obviously, there is no reasonable way for a SDD to even know that a "write blocker" is attached, so it is not surprising (to me) that the SDD garbage collects with it attached.
- stcredzero 16y agoThe whole (rather breathless) point of the article is that SSDs erases the blocks quite rapidly. Yes, so the proper way to analyse an SSD is to just access what's in the flash chips directly. Such methods and equipment will probably need to be developed specifically for each SSD controller chipset. Also, investigators will need to get to an SSD sooner.
- sskates 16y agoI'm not so sure about this being a good thing from the user's perspective. The fact that it's possible to recover deleted data from HDDs has saved people from grief over years of lost work. Not everyone is smart about backups.
- lutorm 16y agoIf being able to recover files you accidentally delete and not doing backups is more important to you than speed, then you are still free to use a hard drive. I bet the vast majority of people would not make that choice.
- reemrevnivek 16y agoForensic analysis of your hard drive for forgotten but not erased data is not an acceptable backup policy. Many people (both criminals and victims of criminals) have also been burned by thinking that data they thought they deleted was recoverable in this way.
- cdr 16y agoPer the end of the article, you can't be sure it's gone forever: http://news.techworld.com/storage/3262210/ssd-drives-difficult-to-wipe-securely-researchers-find/ http://news.techworld.com/storage/3262210/ssd-drives-difficu... If you're wiping the entire drive and the firmware isn't buggy, you should be ok - but being sure that single file(s) are actually deleted is not likely.
- jnsaff 16y agoI had exactly the same article in mind when reading the OP one. Exactly the opposite message. Who to believe?
- elehack 16y agoThey are not incompatible messages at all. This article says that SSDs delete stuff fast; the other says you can't reliably delete particular things. Basically, they're unpredictable. You can't reliably expect a particular file to be purged, and investigators can't expect data to stick around. So it might stick around, it might not, and no one has direct control.
- kovar 16y agoGreetings, There's some truth in here, and also a lot of hype. Plus ca la change, plus ca la meme chose. We've been losing digital evidence to technology ever since the first bit was written to a rotating drum. And, even more interesting, they're completely ignoring the other side of the coin - some evidence is very hard to destroy on SSDs. http://www.tomshardware.com/news/solid-state-flash-translation-layer-NAND-FAST-11-Sanitization,12252.html http://www.tomshardware.com/news/solid-state-flash-translati... If you want to securely store and then delete data from SSDs, use encrypted volumes. Otherwise, don't count on it being unrecoverable.
- pluies 16y agoGreetings, non-French comrade! Your quote is a bit off — it reads "the more it changes it, the more it the same". A better way to write it would be "Plus ça change, plus c'est la même chose." :) [/language pedantic]
- deleted 16y ago[deleted]
- pluies 16y agoTl;dr: when a user chooses to delete a file on an SSD, it actually gets deleted. Outrage!
- kmfrk 16y agoMore on the effect of erasing SSDs: http://www.storagenewsletter.com/news/flash/reliably-erasing-ssds http://www.storagenewsletter.com/news/flash/reliably-erasing....
- rlpb 16y ago"Forensic analysis" as it works today on magnetic hard drives works is heavily based on the principles under which these type of drives operate. They take advantage of the fact that deleting a file does not actually delete a file on disk, as it is more efficient to simply mark those areas as unused. They are taking advantage of an optimisation that has been done for decades. SSDs are completely different. The optimisation no longer works, since flash memory has no overwrite operation, only a block-erase operation (which is a slow operation - and the erase blocks are relatively huge). In order to stay efficient, SSDs must perform background free space management, which includes erasing unused blocks in advance in order to be ready for new data. This should be obvious to anyone who understands how flash memory works. SSD manufacturers have no option here. It's a fundamental side-effect of the technology. "Forensic analysis" that depends on an optimisation performed on a system using a hard drive will no longer work with a different technology that cannot use that optimisation. They were exploiting something that is not necessarily going to be possible any more. If they want a clean equivalent of a "write blocker", they are going to have to somehow disable the SSD's background management before powering up the drive. This might not help so much though if the background management has already erased unused blocks after the user deleted files. I will accept though that this means that people working in the field will need to change their procedures. Summary: forensic analysis only works because of an optimisation that systems using magnetic hard drives did but systems using SSDs can't. How is this surprising?
- kovar 16y agoIt also means that the courts will need to accept that the image taken of an SSD will not match a second image. The courts, and the computer forensics community, had a hard time accepting collecting RAM but that's now a pretty standard part of the process. It will be easy to extend RAM analysis procedures to SSDs.
- kragen 16y agoWhat is this about collecting RAM? Are you saying that if someone's office gets audited for compliance, they'll power off their machines, freeze-spray their DIMMs, extract them, and put them into a DIMM reader to image the RAM contents?
- rbanffy 16y agoI strongly suspect that, in the future, SSDs will have to respect a "cooperate with the police" signal in order to be sold in some places. As for drives that don't, experts can always disassemble the drive and read the memories directly. It's not like the flash memories inside them are special (albeit it's a matter of time - if not already - that smart memory controllers are built into the chips themselves).
- pyre 16y ago> disassemble the drive and read the memories directly What will this accomplish if the data has actually been erased? Some sort of low-level analysis to recover erased data? That seems like something that would only be at the CIA/NSA level, and they probably wouldn't want to tip their hand just to put a 'common criminal' behind bars.
- rbanffy 16y ago> What will this accomplish if the data has actually been erased? You can, at least, recover files the owner of the disk just erased before being handcuffed. It would be trivial to setup a background task that overwrites all free blocks of the (physical) disk when the drive is idle. Or insert that in the filesystem driver, to be done when a file is erased. You could even maintain two write queues, one high-priority for the data you want to keep, one low-priority for the data you want not to keep.
- lispm 16y ago'Deleted data' = 'evidence'? 'Fascism' = 'Peace'?
- jodrellblank 16y agoInformation gleaned from the world can be evidence and deleted data at the same time; so what are you really saying?
- kgo 16y agoHow is this any different than analyzing any other evidence that someone tried to destroy? Using some infrared or whatever filter do determine what a burnt document said? Determining that your fireplace has human remains? Does the acceptance of these techniques indicate we're living in a police state?
- reemrevnivek 16y agoIt's different because they are not assigning guilt based on forensic analysis of evidence that someone tried - but failed - to destroy. Instead, they're assigning guilt because something, which may or may not be evidence, was destroyed. It's as if they discovered that you used some documents (now unreadable) which you'd run through your paper shredder to light a fire, and that you cleaned out your fireplace after you were done. A clean fireplace? You must be burning human remains in it!
- kovar 16y ago"Facts not in evidence." You're ascribing malice to the judicial system and making it sound like a conspiracy. There's a fact - data was destroyed. An investigation may be able to determine what that data was. Either the human who deleted the data or the firmware can tell you why. No guilt.
- bugsy 16y agoI delete files all the time and so do you. Describing this normal and routine occurrence using the nefarious sounding and certainly biased term "destroying data" is absurd.
- pyre 16y agoHow long before legislators start drafting up laws to require SSD firmwares to have commands to turn off the garbage collection?
- pnathan 16y agoInteresting. There was a paper recently that argues the opposite. http://www.usenix.org/events/fast11/tech/full_papers/Wei.pdf http://www.usenix.org/events/fast11/tech/full_papers/Wei.pdf What's the truth here? Are they arguing at different abstraction layers?
- wmf 16y agoThe truth is the same in both cases: sometimes "deleted" data is actually deleted, and sometimes it isn't. The difference is perspective: the user wants "deleted" data to be deleted and forensics people want it to be preserved.
- InclinedPlane 16y agoBoth. Yes, they're arguing from different positions. With a magnetic disk it's straightforward to force data be overwritten at a physical level. With an SSD it is less straightforward and it may not be possible to ensure that the data from a particular file has been erased. So from the perspective of a diligent user an SSD is riskier than an HD. However, typical usage of a hard-drive will leave a significant amount of "deleted" data still on the drive, except for unusual circumstances (such as subsequently using the drive to near capacity). While typical usage of an SSD will tend to erase most data fairly soon after it has been "deleted". So from the perspective of a non-diligent user an HD is riskier than an SSD.
- kordless 16y ago"The fact that data has been purged does not mean a human knowingly did it (e.g. accidental guilt). [But] data purging may make a guilty person look innocent (e.g. accidental innocence)," says Bell. That's just the most asinine statement I've ever heard. They might as well say, "We think you look guilty, and even though we have no idea what you are doing, or how you are doing it you should come with us now."
- kovar 16y agoIt isn't asinine at all, at least when considered in light of the investigative process. "Data was purged" is a fact. Now, you still need to put that in context, and that context includes hundreds, if not thousands, of other facts. Only then should LE say "It is time to come with us."
- fleitz 16y agoIt's unfortunate that innocent targets of the police will now go free. I'm sure prosecutors everywhere are lamenting the fact that they can't pad their stats by putting innocent people in jail on flimsy evidence, such as the 'guilt' associated with ensuring your hard drive is clean, encrypted, and generally unavailable for police inspection. No guilt should be associated with affirming your rights to be secure against unreasonable search and seizure.
- extension 16y agoThe write blocking issue could be solved if manufacturers added a read-only jumper to their devices.
- kovar 16y agoWhat is the incentive to the manufacturer to do so? There are some specialty devices, mostly for law enforcement, that are essentially WORM SD cards. Evidence, a photograph most often, is written to it but cannot be modified. These command a serious premium. Write blockers are pretty common, and not too expensive. The major issue is that writeblockers lag behind drive technology. Not sure how we'll write block the first Thunderbolt hard drives other than through software.
- goombastic 16y agoWonderful!
- tlrobinson 16y agoI'm not sure I'd using the FUD-inducing "destroy evidence" to describe what's happening.
- deleted 16y ago[deleted]
- reemrevnivek 16y agoI agree. The worst part was this little tidbit: > As far as SSDs are concerned, the state of the drive cannot be taken to indicate that its owner did or did not interact with it in ways that allow prosecutors to infer guilt or innocence. > "The fact that data has been purged does not mean a human knowingly did it (e.g. accidental guilt). [But] data purging may make a guilty person look innocent (e.g. accidental innocence)," says Bell. Wait - Prosecutors can infer guilt because I purged my hard drive? Because, of course, the only thing that I might want to delete personally must be criminal in nature, and not, say, personal correspondence or confidential information. This article seems like good news to me. The only bad news that I see is that the analysts who worked on the article will have more difficult jobs in the future.
- jemfinch 16y agoHuh? You said this: > Wait - Prosecutors can infer guilt because I purged my hard drive? Right after quoting this: > "The fact that data has been purged does not mean a human knowingly did it (e.g. accidental guilt). How did you manage to infer the exact opposite of what you just quoted?
- jrockway 16y agoIt's odd to trust a drive's controller and firmware, anyway. How do you prove that the firmware isn't buggy or intentionally tampered with? The solution is to open up the drive, take out the flash, and attach it to your own controller that isn't going to randomly erase stuff.
- dotBen 16y agoThis article assumes that having zero forensic footprint left on your storage device is a bad thing. I'm still waiting to be convinced of that presupposition.
- 46Bit 16y agoFor you and me, it's a good thing. But, for the same reasons that the government never gives it's support to encrypting all web traffic, it's bad for when they want to pin charges on you. My ideal storage has some sort of wipe-from-a-jail-cell-when-drive-is-unplugged functionality. I'm not a criminal, I just don't like to think of my life being open for perusal by any prosecutor/judge/jury.
- losethos 16y agoIf you think police are intrusive, try God! Then, you'll stop worrying about police. Relax -- God's in control. It's His world. God says... actually holiness pernicious gnawing slippery indued dryness vaster unthankful belonging regeneration regeneratedst bereaved Carthaginian plenty retiring graceful Edition Does preserved tree corresponding indulgent poor Whether during weal speaking wayward hideous Hereat occurred words goodness regardless submitting rites stated sacrificed First Curiosity such cleared accuse feelings rising standeth Example energy followest remembrances ignorant Forsake recognises stirring cast punished bemoaned unstayed nourished beforehand vice gladness faculties devoured bath one nostrils glorieth confiding unrulily impious withstood sore unreal ripened rude listing apostles gone vexed imparted weighing punctuation familiar thanks unresolved distraction reject your Envy lightly Artificer order Jew Instantly distrusted keeper vowed prudent departure devoutness garlands herself soundness infinitely obviously solemnise
- TwoBit 16y agoSomebody ought to make an SSD that promises to wipe data ASAP and use that as a selling point.
- bugsy 16y agoSo it has the potential of preserving your privacy and macworld spins that into a story that it is bad because what if the state wants to violate that privacy, well it might not be as easy as they would hope and that is a bad thing. It's very interesting that only one perspective is presented in these sorts of articles, it smacks of placement as part of an anti-freedom propaganda campaign orchestrated by governmental interests. Frame the debate not as privacy violation, but of terrorists getting away with something.