|
Introduction |
Unlike a hard disk, an SSD is unable to overwrite data. Instead the storage cells first have to be cleared to zero. As a result, when a file is deleted from an SSD it simply marks the storage area as stale data. Then, as a background process or when the memory cells are needed again, the SSD will zeroise a whole block, and fill it with new (probably unrelated) data as required. | | Data destruction on hard drives is comparatively easy, either by overwriting (though this may take a long time) or more securely by physical destruction. However, with solid state disks (SSDs) and memory sticks, physical destruction is the only safe method. | | In fact, an SSD generally contains more storage than its declared capacity. This allows it to retire old and worn out data blocks and substitute fresh ones from a pool of spares. This means that even if you were to write 500GB of data to a 500GB SSD, some data may remain in retired blocks. This could still be accessed by unsoldering the memory chips and reading them in a forensic rig. | | Unlike a hard disk, an SSD cannot overwrite data without first erasing any previously written data - a comparitively slow process which can only be applied to quite large blocks of memmory at a time. So to achieve an acceptable speed, new data is written to a fresh data block, the SSD controller keeping an index of where it has stored what data. The old data remains until the SSD has determined that none of the data in the data block (perhaps parts of several different files) is still required. Only then is the entire block erased and released for reuse. | | To securely erase data on an SSD, you can use the ATA Secure Erase command. This tells the SSD to erase all the data on the drive, including any data that may be hidden or inaccessible, such as in retired blocks. However, there have been suggestions from government security agencies that ATA Secure Erase is not properly implemeted on all hard disks and SSDs. | | As a result, old copies of data are likely to persist in memory cells that you can’t directly access, except with forensic tools. At some time this old data will be cleared and the memory cells made available for reuse, though heavily used and no longer reliable data blocks will eventually be permanently retired and never cleared. | | The only surefire way to ensure that data is irretrievable from an SSD is to physically destroy it as descibed in this guide. | | You can use the ATA Secure Erase command (implemented by the freeware [link|https://cmrr.ucsd.edu/resources/secure-erase.html|Secure Erase|new_window=true] utility) to securely erase data on an SSD. This tells the SSD to erase all the data on the drive, including any data that may be hidden or inaccessible, such as in retired blocks. However, there have been suggestions from government security agencies that ATA Secure Erase is not properly implemeted on all hard disks and SSDs, and there's no easy way to tell. | | Encrypting your drives from the start is an excellent way to protect your data and and also to make the erasure process much simpler. To securely erase the data on the drive, you only need to delete or destroy the encryption key, making the data copletely unrecoverable. | | The smart thing to do is to enable encryption before you write any sensitive data, then all you have to do is change the key to something totally random and destroy any record of it, and no one will be able to recover your data. On Windows, you can use Bitlocker, or FileVault on Macs. You can use either of those on memory sticks, or Veracrypt, which also works on Linux. You should always encrypt your memory sticks as they are so easily lost. | | | If you were looking to destroy data on a HDD, take a look at my companion guide here [guide|140673] |
|