4 ms·

By the way, I hear you can't really "wipe" data on SSD drives. I don't remember why exactly though. Probably some fault-tolerant mechanism. Or maybe it's what

by salient 13y ago

By the way, I hear you can't really "wipe" data on SSD drives. I don't remember why exactly though. Probably some fault-tolerant mechanism. Or maybe it's what NSA has been asking HDD OEMs to make from the beginning.

thirsteh 13y ago
Most new SSD drives, e.g. Samsung's or Intel's, have transparent encryption (no matter if you set it up or not,) and you are able to "format" your drive by wiping the container with the encryption key, effectively making all data on the drive appear as random noise as long as the encryption algorithm, e.g. AES-256, isn't broken.
raverbashing 13y ago
Hummm not really Just write data up to its size. Multiple times, just to be sure Read it from /dev/urandom
- rdl 13y ago
  Unfortunately this isn't adequate. Drives contain "extra" storage space above rated capacity, as well as reduce delivered capacity, which gets periodically unmapped by wear leveling, or due to errors, etc. This is a bigger deal on SSD than on spinning-rust, but even with rust, it was an issue (esp with 4K sectors, or when worried about things like keys). It's certainly better than nothing, but not sufficient practice in a business or high-security-professional environment. An attacker is willing to load custom firmware onto the drive, or to move the chips into a new device, or otherwise read it out raw, and will have access to more material than your dd can write. The standard should be "can I prove this will work reliably, given all the layers beneath me", and for that, the only adequate answer is physical destruction. You could possibly design a drive where you're guaranteed to know if everything is fully deleted, and as long as you trusted the design/implementation/current-status, you could rely on it, but then you'd have a $100k 100GB SSD. So much easier just to replace old drives, or to guarantee that nothing interesting every touched the disk unencrypted, or ideally both.
  - raverbashing 13y ago
    "Drives contain "extra" storage space above rated capacity, as well as reduce delivered capacity, which gets periodically unmapped by wear leveling, or due to errors, etc." Yes, that's why you fill it multiple times. But yes, you can have information leaking in a sector that went bad and was remapped But the good thing about SSDs as well is that they're much easier to destroy, just microwave it, or provide an excess voltage to it (may need more work than simply connect the power input to wires coming from the wall)
    - rdl 13y ago
      I believe (but can't find offhand) there are drives which have physical-destroy as a normal interface-accessible command. i.e. "set off the thermite". A lot of SIGINT/COMINT gear designed for field use had magic destructo-capability designed in, too. I think after the USS Pueblo, especially.
hornetblack 13y ago
The issue with a traditional erase: ie write random bytes to the disk 7 times. Is writes to SSDs wear them out a bit. If you erase disks a lot its going to wear out sooner. There are tools called "Secure Erase" that use special functions on the disk to wipe it without wearing it out.
jodrellblank 13y ago
The mechanism of SSD storage has limited writes before it breaks, to make the disk workable the controller takes the write instruction and behind the scenes, puts it somewhere on storage which isn't wearing out. This means your attempt to write the same address 7 times actually goes to 7 different storage locations and the original data might still be stored wherever it first landed.
Zigurd 13y ago
You can fill as drive with random numbers. That would be immune to any file system's and/or device's optimizations.
rdl 13y ago
In reality there is no sufficiently-safe way to wipe drives today. If you really care, you destroy the drive. With AES-NI, there's little excuse for not doing disk-crypto-by-default, so if the drive never saw unencrypted data, and your data is only slightly to moderately sensitive, you could probably get away with logical deletion and then a precautionary drive-level or multi-pass overwrite, but if it's something genuinely high security, no sane policy allows drives to leave in any form but dust. (Within an organization at the same security level, deletion and then wipe is enough to re-issue a laptop, but not going from top researcher to intern, and certainly not from inside to outside.)

by salient 13y ago

thirsteh 13y ago

Most new SSD drives, e.g. Samsung's or Intel's, have transparent encryption (no matter if you set it up or not,) and you are able to "format" your drive by wiping the container with the encryption key, effectively making all data on the drive appear as random noise as long as the encryption algorithm, e.g. AES-256, isn't broken.

raverbashing 13y ago

Hummm not really Just write data up to its size. Multiple times, just to be sure Read it from /dev/urandom

rdl 13y ago
Unfortunately this isn't adequate. Drives contain "extra" storage space above rated capacity, as well as reduce delivered capacity, which gets periodically unmapped by wear leveling, or due to errors, etc. This is a bigger deal on SSD than on spinning-rust, but even with rust, it was an issue (esp with 4K sectors, or when worried about things like keys). It's certainly better than nothing, but not sufficient practice in a business or high-security-professional environment. An attacker is willing to load custom firmware onto the drive, or to move the chips into a new device, or otherwise read it out raw, and will have access to more material than your dd can write. The standard should be "can I prove this will work reliably, given all the layers beneath me", and for that, the only adequate answer is physical destruction. You could possibly design a drive where you're guaranteed to know if everything is fully deleted, and as long as you trusted the design/implementation/current-status, you could rely on it, but then you'd have a $100k 100GB SSD. So much easier just to replace old drives, or to guarantee that nothing interesting every touched the disk unencrypted, or ideally both.
- raverbashing 13y ago
  "Drives contain "extra" storage space above rated capacity, as well as reduce delivered capacity, which gets periodically unmapped by wear leveling, or due to errors, etc." Yes, that's why you fill it multiple times. But yes, you can have information leaking in a sector that went bad and was remapped But the good thing about SSDs as well is that they're much easier to destroy, just microwave it, or provide an excess voltage to it (may need more work than simply connect the power input to wires coming from the wall)
  - rdl 13y ago
    I believe (but can't find offhand) there are drives which have physical-destroy as a normal interface-accessible command. i.e. "set off the thermite". A lot of SIGINT/COMINT gear designed for field use had magic destructo-capability designed in, too. I think after the USS Pueblo, especially.

hornetblack 13y ago

The issue with a traditional erase: ie write random bytes to the disk 7 times. Is writes to SSDs wear them out a bit. If you erase disks a lot its going to wear out sooner. There are tools called "Secure Erase" that use special functions on the disk to wipe it without wearing it out.

jodrellblank 13y ago

The mechanism of SSD storage has limited writes before it breaks, to make the disk workable the controller takes the write instruction and behind the scenes, puts it somewhere on storage which isn't wearing out. This means your attempt to write the same address 7 times actually goes to 7 different storage locations and the original data might still be stored wherever it first landed.

Zigurd 13y ago

You can fill as drive with random numbers. That would be immune to any file system's and/or device's optimizations.

rdl 13y ago

In reality there is no sufficiently-safe way to wipe drives today. If you really care, you destroy the drive. With AES-NI, there's little excuse for not doing disk-crypto-by-default, so if the drive never saw unencrypted data, and your data is only slightly to moderately sensitive, you could probably get away with logical deletion and then a precautionary drive-level or multi-pass overwrite, but if it's something genuinely high security, no sane policy allows drives to leave in any form but dust. (Within an organization at the same security level, deletion and then wipe is enough to re-issue a laptop, but not going from top researcher to intern, and certainly not from inside to outside.)