5 ms·

Follow up question, as someone who knows even less about forensics, what kind of traces stay on a hard drive if you just delete a file?

aliceryhl 6y ago
Generally when you just delete a file, its contents are marked as "unused", but not actually erased. This is why deleting a large file takes the same time as deleting a small file. Then, whenever a new file is created, it might be put (partially) on top of the old file, overwriting the old contents for good.
bsamuels 6y ago
the whole file is still there until it gets overwritten by new data
bsder 6y ago
A lot. You need to write a drive with zeros(minimum)/random data(preferably) at least once to make forensic recovery difficult. I know all about the "5 times" rule, but I've never heard of anyone recovering a drive after even a single overwrite. Personally, I just hammer a screwdriver through the platter. It generally converts it into glass shards--the drive sounds like a maraca afterward. Flash, of course, is different. I suspect that writing zeros/random once is probably enough. However, I tend to just use diagonal cutters and slice through the chips. If someone wants to reconstruct my drive after I've physically destroyed it, they've probably got enough money to just fabricate the evidence against me anyway.
- desine 6y ago
  I have a few HDs with bullet holes in them, and the platters are still intact. I've messed around with a lot of drives and never shattered a disk like glass. I've heard that there's labs that specialize in reading disks without even needing to spin them, but information seems to be tightly guarded about the processes.
  - daniel_reetz 6y ago
    The platters I've seen are aluminum alloy.
  - deleted 6y ago
    [deleted]
- astrange 6y ago
  > Flash, of course, is different. I suspect that writing zeros/random once is probably enough. SSDs won't necessarily actually erase a block when you tell them to, due to wear-leveling and weird internal RAID setups they could be doing anything in there.
Jtsummers 6y ago
https://en.wikipedia.org/wiki/Data_remanence https://en.wikipedia.org/wiki/Data_remanence That link has a bit more, but the main issue is what the others wrote. Deleting a file from your disk may not actually delete it. It can leave an entry in the file system that marks it as deleted (for undeletion later) or it may just remove the entry, in which case the data is still on the disk and recoverable.
Sylamore 6y ago
On most file systems, just deleting a file simply deletes the link between the filename and the data on disk, the actual data remains fully intact until the blocks are overwritten by new data. It's trivial to recover recently deleted files, and often not much more effort to recover less recently deleted files. It only becomes a challenge if the data has been long deleted or was intentionally overwritten before deletion (or the disk wiped using random data), in some cases becoming effectively impossible to recover.
desine 6y ago
The file is still there. A regular delete just tells the disk that the segments of memory are available to be overwritten. Zeroing out (or /dev/urandom) the memory is an option, but even that is not 100% safe, especially when it comes to forensic labs with the ability to read and analyze platters removed from a complete, sealed disk. Really safe deleters will overwrite the segments of memory multiple times to scramble magnetic signatures
- noir_lord 6y ago
  The world has moved on. You can’t transplant a platter into another reader, the old days of Guttman method don’t really apply anymore, density is so high that outside of research settings it’s just not practical. That said I still put a drill through mine before disposing of them, because close to zero isn’t zero.
  - XorNot 6y ago
    The reality though is we have no idea what's possible here: we just know what's not commercially viable to offer as a service. HDD recovery research is almost certainly a well-funded area of intelligence services, so I imagine their are a few electron microscopes and STMs which can do it. There's certainly no military data destruction guide which doesn't start with "shred the platter to this grain size".
  - layoutIfNeeded 6y ago
    >You can’t transplant a platter into another reader Then why do I get tons of results on YouTube of people doing exactly that, when searching for “HDD transplant”?
    - Judgmentality 6y ago
      I typed it into YouTube and every result (of the first dozen or so) is years old, including the most recent video citing an example where it's impossible. https://www.youtube.com/watch?v=bml8ovt4nfI https://www.youtube.com/watch?v=bml8ovt4nfI

aliceryhl 6y ago

Generally when you just delete a file, its contents are marked as "unused", but not actually erased. This is why deleting a large file takes the same time as deleting a small file. Then, whenever a new file is created, it might be put (partially) on top of the old file, overwriting the old contents for good.

bsamuels 6y ago

the whole file is still there until it gets overwritten by new data

bsder 6y ago

A lot. You need to write a drive with zeros(minimum)/random data(preferably) at least once to make forensic recovery difficult. I know all about the "5 times" rule, but I've never heard of anyone recovering a drive after even a single overwrite. Personally, I just hammer a screwdriver through the platter. It generally converts it into glass shards--the drive sounds like a maraca afterward. Flash, of course, is different. I suspect that writing zeros/random once is probably enough. However, I tend to just use diagonal cutters and slice through the chips. If someone wants to reconstruct my drive after I've physically destroyed it, they've probably got enough money to just fabricate the evidence against me anyway.

desine 6y ago
I have a few HDs with bullet holes in them, and the platters are still intact. I've messed around with a lot of drives and never shattered a disk like glass. I've heard that there's labs that specialize in reading disks without even needing to spin them, but information seems to be tightly guarded about the processes.
- daniel_reetz 6y ago
  The platters I've seen are aluminum alloy.
- deleted 6y ago
  [deleted]
astrange 6y ago
> Flash, of course, is different. I suspect that writing zeros/random once is probably enough. SSDs won't necessarily actually erase a block when you tell them to, due to wear-leveling and weird internal RAID setups they could be doing anything in there.

Jtsummers 6y ago

https://en.wikipedia.org/wiki/Data_remanence https://en.wikipedia.org/wiki/Data_remanence That link has a bit more, but the main issue is what the others wrote. Deleting a file from your disk may not actually delete it. It can leave an entry in the file system that marks it as deleted (for undeletion later) or it may just remove the entry, in which case the data is still on the disk and recoverable.

Sylamore 6y ago

On most file systems, just deleting a file simply deletes the link between the filename and the data on disk, the actual data remains fully intact until the blocks are overwritten by new data. It's trivial to recover recently deleted files, and often not much more effort to recover less recently deleted files. It only becomes a challenge if the data has been long deleted or was intentionally overwritten before deletion (or the disk wiped using random data), in some cases becoming effectively impossible to recover.

desine 6y ago

The file is still there. A regular delete just tells the disk that the segments of memory are available to be overwritten. Zeroing out (or /dev/urandom) the memory is an option, but even that is not 100% safe, especially when it comes to forensic labs with the ability to read and analyze platters removed from a complete, sealed disk. Really safe deleters will overwrite the segments of memory multiple times to scramble magnetic signatures

noir_lord 6y ago
The world has moved on. You can’t transplant a platter into another reader, the old days of Guttman method don’t really apply anymore, density is so high that outside of research settings it’s just not practical. That said I still put a drill through mine before disposing of them, because close to zero isn’t zero.
- XorNot 6y ago
  The reality though is we have no idea what's possible here: we just know what's not commercially viable to offer as a service. HDD recovery research is almost certainly a well-funded area of intelligence services, so I imagine their are a few electron microscopes and STMs which can do it. There's certainly no military data destruction guide which doesn't start with "shred the platter to this grain size".
- layoutIfNeeded 6y ago
  >You can’t transplant a platter into another reader Then why do I get tons of results on YouTube of people doing exactly that, when searching for “HDD transplant”?
  - Judgmentality 6y ago
    I typed it into YouTube and every result (of the first dozen or so) is years old, including the most recent video citing an example where it's impossible. https://www.youtube.com/watch?v=bml8ovt4nfI https://www.youtube.com/watch?v=bml8ovt4nfI