5 ms·
So, did the YouTuber extract any data from that drive or not? If not, I suspect there wouldn't be a headline? + The text starts with: "Over a year ago, an SSD w
by jve 5y ago
So, did the YouTuber extract any data from that drive or not? If not, I suspect there wouldn't be a headline? + The text starts with: "Over a year ago, an SSD was stolen...".
I may be wrong of course. But would gladly know more info, if anyone has it.
- malka 5y agoYou can find the first of 3 videos from this youtuber about this subject here: https://youtu.be/vt8PyQ2PGxI https://youtu.be/vt8PyQ2PGxI It's in French though
- deleted 5y ago[deleted]
- mot2ba 5y agoYep, the French vlogger Micode [0] asked their Twitter followers to identify the data on an SSD they purchased on the local classified ads website leboncoin. [0]: https://web.archive.org/web/20210531091659/https://twitter.com/Micode/status/1395640486715662336 https://web.archive.org/web/20210531091659/https://twitter.c... [1]: https://www.youtube.com/watch?v=vt8PyQ2PGxI https://www.youtube.com/watch?v=vt8PyQ2PGxI [2]: https://www.youtube.com/watch?v=aOBVZUL1iBA https://www.youtube.com/watch?v=aOBVZUL1iBA [3]: https://www.youtube.com/watch?v=xf_cKTlOYLo https://www.youtube.com/watch?v=xf_cKTlOYLo
- drouar_b 5y agoFor those who don't speak french, this Youtuber bought a second-handed SSD to do some forensics and raise awareness. He managed to recover the partition, inside he found qcow2 image of a company, he managed to mount it and recover the full data, including source code of their app, a ssh key and S3 credentials of the company
- jve 5y agoThanks. Is there any info whether drive was formatted or not?
- drouar_b 5y agoThe drive had a quick format, so he managed to recover the partition with testdisk
- foxpurple 5y agoThese days every single drive should have full disk encryption. And then you can format by simply securely wiping the key part.
- quietbritishjim 5y agoSSDs work in an odd way: they have more capacity than they claim, and when you overwrite some data you're really just writing to some of that spare space while the old version is just marked as free [1, 2]. Admittedly, at that point it's going to be very hard to retrieve the old data (you'd need to bypass the remapping logic presented by the controller circuitry), but it's theoretically possible. If you're paranoid, it's best to rewrite the whole thing even if it's encrypted, ideally several times (at that point a little original data could technically be left over but it's unlikely and it's not going to be feasible to get any of it if it was encrypted). [1] https://databasearchitects.blogspot.com/2021/06/what-every-programmer-should-know-about.html https://databasearchitects.blogspot.com/2021/06/what-every-p... [2] https://news.ycombinator.com/item?id=27572218 https://news.ycombinator.com/item?id=27572218
- tpetry 5y agoIf you only ever write encrypted data to the disk you don‘t care about spare ssd cells. The data was always encrypted you wouldn‘t even need to format before giving away.
- quietbritishjim 5y agoIn general I'd agree, but the parent comment mentioned "wiping the key part" so I guess they had the assumption that the password is weak enough that its vulnerable while that data is accessible, so I was assuming the same thing. (As you're no doubt aware, the encryption key for full-disk encrypted disks are encrypted by the decryption password and stored on the disk itself, at least when not using a TPM.)
- sirk390 5y agoYes a running VM from an a corporate customer containing all source code, SSH keys, access keys to github repos, AWS keys and much more.