Hacker News new | ask | show | jobs
by meroliph 5582 days ago
So I get huge speeds, virtually no i/o wait and when I delete something I can be sure it's gone forever? The only problem left to solve is huge capacities for these devices at relatively affordable prices.
3 comments

My read is that the devices are still unfamiliar to investigators. I bet it's just a matter of time before someone starts figuring out how to read blocks that are waiting to be actually erased (which is a time consuming and energy-intensive operation for SLC flash, and sometimes deferred) on particular popular devices. Of course, it's going to be unfamiliar to those who have been working closely with HDDs at a low level for years.

EDIT: Speaking of which: http://sec.pn.to/pw/?plugin=attach&pcmd=open&file=ta...

tl;dr - That's just security by obscurity. Someone will figure out how to read unerased data. (That said, those blocks eventually will be erased and recycled, it's just a matter of when.)

The whole (rather breathless) point of the article is that SSDs erases the blocks quite rapidly. It isn't that the old blocks are still laying around but the researchers did not know how to access them, it is that (a) they are erased rapidly under normal conditions and (b) they are erased even when they researchers used a "write blocker" mechanism[1]. IOW, they (the article's author, anyway) were apparently surprised to find that the SDD garbage collected autonomously and regardless of the "write blocker" mechanism).

The (a) case is likely OSes using the "trim" command and the (b) cases are inherent in how SSD firmware works (by necessity). WRT the (b) case, SSDs have to garbage collect. Their write speed, and thus user satisfaction, is dependent on it keeping a large number of erased blocks ready to be written to.

[1] http://www.forensicswiki.org/wiki/Write_Blockers - apparently simply a "man in the middle" hardware that filters out write commands, lets through read commands.

Obviously, there is no reasonable way for a SDD to even know that a "write blocker" is attached, so it is not surprising (to me) that the SDD garbage collects with it attached.

The whole (rather breathless) point of the article is that SSDs erases the blocks quite rapidly.

Yes, so the proper way to analyse an SSD is to just access what's in the flash chips directly. Such methods and equipment will probably need to be developed specifically for each SSD controller chipset. Also, investigators will need to get to an SSD sooner.

Per the end of the article, you can't be sure it's gone forever: http://news.techworld.com/storage/3262210/ssd-drives-difficu...

If you're wiping the entire drive and the firmware isn't buggy, you should be ok - but being sure that single file(s) are actually deleted is not likely.

I had exactly the same article in mind when reading the OP one.

Exactly the opposite message. Who to believe?

They are not incompatible messages at all. This article says that SSDs delete stuff fast; the other says you can't reliably delete particular things. Basically, they're unpredictable. You can't reliably expect a particular file to be purged, and investigators can't expect data to stick around. So it might stick around, it might not, and no one has direct control.
I'm not so sure about this being a good thing from the user's perspective. The fact that it's possible to recover deleted data from HDDs has saved people from grief over years of lost work. Not everyone is smart about backups.
If being able to recover files you accidentally delete and not doing backups is more important to you than speed, then you are still free to use a hard drive. I bet the vast majority of people would not make that choice.
Forensic analysis of your hard drive for forgotten but not erased data is not an acceptable backup policy.

Many people (both criminals and victims of criminals) have also been burned by thinking that data they thought they deleted was recoverable in this way.