Investigators pulled video from ‘residual data’ in Google’s systems — here’s how that was possible and what it means for your privacy.
Investigators pulled video from ‘residual data’ in Google’s systems — here’s how that was possible and what it means for your privacy.
I’ve never understood the overwrite more than once instruction. If the entire drive is overwritten how in the world do you pull back data out from an overwrite?
Flipping the bits on a magnetic medium back and forth doesn’t always flip them entirely. Using more sensitive equipment to read back the bits can see the faint hints of what the bits used to be, which is why multiple overwrites with random information is the only way to be sure (and even then, there are advanced techniques that try to see past all that noise. The more you overwrite, the less sure any of these techniques are to work.
Wild. If anyone knows of a video or demonstration of someone actually looking past the overwritten data on a platter, I’d love to see that - that’s really next level csi stuff.
Magnetic platter drives still have the highest storage density per dollar and so they are still heavily in use. Theoretically, overwritten data can be recovered from them by analyzing the magnetic fields directly from the platter. However, this is extremely time and money intensive and requires specialized equipment and expertise. Overwriting a partition multiple times severely complicates this process just by performing multiple overwrites.
Realistically, overwriting once with random data is enough, especially if the drive is to be physically destroyed. You can also use a powerful magnet (top end neodymium in direct contact) to scramble the delicate magnetic fields that encode the data on the platter, but at that point you may as well shred the drive anyways.
SSDs are a fundamentally different storage paradigm that make this kind of recovery essentially impossible. Due to the limitations of NAND memory, data can be written to blocks inaccessible except at the hardware level. To make SSDs secure, modern drives usually implement processes (TRIM) that erase blocks marked for deletion. Or, all data written to the drive is encrypted by onboard hardware (SED), and “erasing” the drive simply deletes the encryption keys.