Why SSD Drives Destroy Court Evidence, and What Can Be Done About It (2012)

Re:Why SSD Drives Destroy Court Evidence, and What Can Be Do... by DanBC on Thursday June 19, 2014 @09:44PM (#7919164)

But you don't know whether the blocks are actually being over written or if they've been marked as bad or if the information is in slack space or etc.

"Pointless" was too strong. "Not secure" would have been better.

EDIT--

More specifically, most utils don't tell you that they don't touch slack space unless you search the forums. See, for example, CCleaner which lists a few limitations of CCleaner's free space wipe, but which makes no mention of slack space.

[ Parent | on HN ]

Re:Why SSD Drives Destroy Court Evidence, and What Can Be Do... by Karunamon on Thursday June 19, 2014 @09:54PM (#7919190)

Ah, gotcha.

Thing is, that depends on the filesystem. I know that the usual shred commands don't work all that great on Ext4 due to journalling and such, but Microsoft actually provides[1] a first party tool to do it on NTFS (at the file level) to handle those edge cases.

Apple provides[2] a built-in free space nuking tool as well.

That leaves sector reallocation by the disk controller, but doesn't that only happen if data can't be properly written in the first place anyways?

[1]: http://technet.microsoft.com/en-us/sysinternals/bb897443.asp...

[2]: http://support.apple.com/kb/ht3680

[ Parent | on HN ]