3 ms·

> A free-space wipe on an SSD can't guarantee that reserved or remapped blocks get erased. I think most controllers implement a secure erase feature that guar

by sigterm 12y ago

> A free-space wipe on an SSD can't guarantee that reserved or remapped blocks get erased. I think most controllers implement a secure erase feature that guarantees the data have been erased from NAND. > the entire encrypted volume looks like it's in use to the SSD controller I have always wondered how encrypted volume worked on an SSD. It seems this will lead to serious performance issues due to ineffective garbage collection.

Hello71 12y ago
> > A free-space wipe on an SSD can't guarantee that reserved or remapped blocks get erased. > > I think most controllers implement a secure erase feature that guarantees the data have been erased from NAND. yes, ata secure erase, which guarantees erasure of the entire drive (excluding vendor specific areas)
computator 12y ago
> most controllers implement a secure erase Yes, a secure erase of the entire disk. That does not help with erasing the free space (a free-space wipe). Erasing the free space can't be done purely at the controller level since the controller can't tell which blocks are free and which used.
- jcromartie 12y ago
  But you can image the logical filesystem on the SSD, do the free-space wipe, and then restore the image to the wiped SSD. If you could find a way to automate on a Mac with FileVault then you'd be popular.
  - JulianMorrison 12y ago
    Don't even image it, tar it up. That way you get defragmentation too.
- deleted 12y ago
  [deleted]
- DanBC 12y ago
  But free-space wiping is pointless and not a security benefit on regular spinning platter drives.
  - Karunamon 12y ago
    Wait, what? The whole point of wiping free space is to prevent file recovery tools from doing a low level scan of the drive and retrieving deleted data, since a delete doesn't actually zero out the space, it just marks it as available for reuse.
    - DanBC 12y ago
      But you don't know whether the blocks are actually being over written or if they've been marked as bad or if the information is in slack space or etc. "Pointless" was too strong. "Not secure" would have been better. EDIT-- More specifically, most utils don't tell you that they don't touch slack space unless you search the forums. See, for example, CCleaner which lists a few limitations of CCleaner's free space wipe, but which makes no mention of slack space.
      - Karunamon 12y ago
        Ah, gotcha. Thing is, that depends on the filesystem. I know that the usual shred commands don't work all that great on Ext4 due to journalling and such, but Microsoft actually provides[1] a first party tool to do it on NTFS (at the file level) to handle those edge cases. Apple provides[2] a built-in free space nuking tool as well. That leaves sector reallocation by the disk controller, but doesn't that only happen if data can't be properly written in the first place anyways? [1]: http://technet.microsoft.com/en-us/sysinternals/bb897443.aspx http://technet.microsoft.com/en-us/sysinternals/bb897443.asp... [2]: http://support.apple.com/kb/ht3680 http://support.apple.com/kb/ht3680
zurn 12y ago
> I think most controllers implement a secure erase feature SSDs lie about this, and the only way to check is to go forensic on the raw flash. Source: Wei et al, "Reliably Erasing Data From Flash-Based Solid State Drives", Usenix FAST'11, https://www.usenix.org/legacy/event/fast11/tech/full_papers/Wei.pdf https://www.usenix.org/legacy/event/fast11/tech/full_papers/...

by sigterm 12y ago

Hello71 12y ago

> > A free-space wipe on an SSD can't guarantee that reserved or remapped blocks get erased. > > I think most controllers implement a secure erase feature that guarantees the data have been erased from NAND. yes, ata secure erase, which guarantees erasure of the entire drive (excluding vendor specific areas)

computator 12y ago

> most controllers implement a secure erase Yes, a secure erase of the entire disk. That does not help with erasing the free space (a free-space wipe). Erasing the free space can't be done purely at the controller level since the controller can't tell which blocks are free and which used.

jcromartie 12y ago
But you can image the logical filesystem on the SSD, do the free-space wipe, and then restore the image to the wiped SSD. If you could find a way to automate on a Mac with FileVault then you'd be popular.
- JulianMorrison 12y ago
  Don't even image it, tar it up. That way you get defragmentation too.
deleted 12y ago
[deleted]
DanBC 12y ago
But free-space wiping is pointless and not a security benefit on regular spinning platter drives.
- Karunamon 12y ago
  Wait, what? The whole point of wiping free space is to prevent file recovery tools from doing a low level scan of the drive and retrieving deleted data, since a delete doesn't actually zero out the space, it just marks it as available for reuse.
  - DanBC 12y ago
    But you don't know whether the blocks are actually being over written or if they've been marked as bad or if the information is in slack space or etc. "Pointless" was too strong. "Not secure" would have been better. EDIT-- More specifically, most utils don't tell you that they don't touch slack space unless you search the forums. See, for example, CCleaner which lists a few limitations of CCleaner's free space wipe, but which makes no mention of slack space.
    - Karunamon 12y ago
      Ah, gotcha. Thing is, that depends on the filesystem. I know that the usual shred commands don't work all that great on Ext4 due to journalling and such, but Microsoft actually provides[1] a first party tool to do it on NTFS (at the file level) to handle those edge cases. Apple provides[2] a built-in free space nuking tool as well. That leaves sector reallocation by the disk controller, but doesn't that only happen if data can't be properly written in the first place anyways? [1]: http://technet.microsoft.com/en-us/sysinternals/bb897443.aspx http://technet.microsoft.com/en-us/sysinternals/bb897443.asp... [2]: http://support.apple.com/kb/ht3680 http://support.apple.com/kb/ht3680

zurn 12y ago

> I think most controllers implement a secure erase feature SSDs lie about this, and the only way to check is to go forensic on the raw flash. Source: Wei et al, "Reliably Erasing Data From Flash-Based Solid State Drives", Usenix FAST'11, https://www.usenix.org/legacy/event/fast11/tech/full_papers/Wei.pdf https://www.usenix.org/legacy/event/fast11/tech/full_papers/...