Are solid state memory devices recoverable?

Post by **Massive Quasars** » Mon May 07, 2007 9:22 pm

Can their data be recovered once deleted? I'm thinking mainly USB key drives here. In principle.

tanks.

Post by **Foo** » Mon May 07, 2007 9:39 pm

Post by **FragaGeddon** » Mon May 07, 2007 9:51 pm

Buy why not?

Post by **SoM** » Tue May 08, 2007 5:09 am

got this from google

Post by **dzjepp** » Tue May 08, 2007 5:17 am

Any file-restore app should do no? That is if you don't start writing to the usb too much, otherwise it's less likely that you can recover

Post by **Foo** » Tue May 08, 2007 5:16 pm

FragaGeddon wrote:Buy why not?

I should have put more thought into that reply really. My take on hard drive data security is that it's not possible to recover data from the drive after a single write, either. The reason I hold that position is because it's never been demonstrated, the most that's ever been said about recovering data after an overwrite lies firmly in the realm of theoretical scientific reports based on very specific electron microscope observations where it was possible to determine the history of a single bit. Being concerned about that kind of potential 'recovery' of data is something I think we can safely minimise for the time being.

The reason we currently implement 3/7/32-pass wipes is partly based on this theoretical science (and the possible problems it may cause if such observations become feasible on an entire data chunk in the future) but also partly because of some elements of hard drive architecture. For example some wiping patterns are designed to force the drive's write controller to overwrite data on a sector where normally it may decide of its own volition to disregard the command being sent to it and leave the data in place (this is getting into drive controller operation and the limit of my knowledge, but I can prolly dig up some docs if you want to read more)

Also another problem for data sanitation is that HDs have more capacity than they're marketed as having, as it's a given that over time areas of the disk will become unreadable and marked as bad. When this happens, the HDs own firmware allocates the 'block' as unusable, and makes use of some of its spare space to redirect the data that would otherwise be written into the bad block. Hence, if you wrote some data into a block and it then happened to be marked bad, your data may sit in that block and never be touched again. Some data sanitation software addresses this issue, but most don't. Partly because it's a technical nightmare, but partly because the odds of a significant chunk of data being allocated into a bad block and being recoverable is extremely slim.

You should still overwrite data with a single pass on any form of 'permanent' data storage, because most OS delete functions merely clear the reference to the data, and not the data itself. Sorry, I really should have clarified earlier.

Post by **dzjepp** » Tue May 08, 2007 7:55 pm

Post by **Massive Quasars** » Wed May 09, 2007 7:44 pm

Good to know Foo, thanks.

However, my question regarding solid state media (usb key drives mainly) is whether data recovery is within the realm of physical possibility? HDD data recovery aside, though that was a solid read.

Post by **SoM** » Wed May 09, 2007 7:45 pm

have u tried the proggy from my linkage ?

Post by **Massive Quasars** » Wed May 09, 2007 7:50 pm

It's a theoretical question, SoM. I don't need to recover data from a usb key at the moment.

Though I do have uses for solid data recovery software so I'll look into it.

Post by **Scourge** » Wed May 09, 2007 7:55 pm

Apparently so.

http://www.dtidata.com/resourcecenter/2 ... -recovery/

Post by **dzjepp** » Wed May 09, 2007 9:03 pm

So the 2 dozen or so apps that are out in the field are all scams?

Post by **Scourge** » Wed May 09, 2007 9:13 pm

dzjepp wrote:So the 2 dozen or so apps that are out in the field are all scams?

Who is this directed at?

Post by **Foo** » Wed May 09, 2007 9:33 pm

A lot of data recovery information is snake oil BTW. Lots of companies out there want to charge consultancy and recovery fees but they can only recover data that's not been overwritten. Again, it's a case of trying to find a (genuine) case study where data has been recovered after being overwritten, but they don't exist.

Its as much a myth as 'RAM Tuners'.

Post by **Scourge** » Wed May 09, 2007 10:17 pm

I think he just wants to know if it's possible to recover deleted files from a flash or similar type device. I just checked one of my flash drives and was able to locate several deleted files. So yes it is possible, at least if not overwritten.

Post by **Massive Quasars** » Thu May 10, 2007 3:33 am

Yes scourge, that's what I mean. If overwritten though, would anything theoretically salvageable remain?

Post by **Massive Quasars** » Sun Jun 17, 2007 3:54 pm

Is that Eraser program equally effective on this type of media?

Post by **Foo** » Sun Jun 17, 2007 4:19 pm

It appears to be. Anything that can be formatted with a recognisable file system (NTFS or FAT) can have its data area overwritten.

There are a few caveats as I outlined above but nothing's 100% guaranteed to work.

Post by **Foo** » Sun Jun 17, 2007 4:21 pm

Well, I tell a lie. There's still no evidence that anyone, anywhere has ever been able to read data off a drive which has been erased, then physically burned and smashed.

The most effective data removal tool is still a hammer.

Post by **Massive Quasars** » Sun Jun 17, 2007 5:23 pm

To that end, I'd imagine usb keys would be much easier to incinerate or destroy beyond the threshold of theoretical data recoverability.

Post by **Foo** » Sun Jun 17, 2007 5:40 pm

Disconnect it, slap it in a vice, job done.

Then all you have to worry about is the page/temp files.

Post by **Massive Quasars** » Sun Jun 17, 2007 7:09 pm

Right, and if you're set up with Virtual PC I'm guessing that can be all self-contained there. Correct?

Post by **Foo** » Sun Jun 17, 2007 7:21 pm

Almost completely. VPC will still use your PCs RAM and swap file which is a potential, albeit very minor, hazard....

Best option there is to set the swap file (on your 'real' PC) to 0, reboot, then use VPC.

Post by **Massive Quasars** » Mon Jun 18, 2007 8:48 pm

This has proved fruitful, thank you.