Fun fact, files don’t just get instantly nuked when you delete them, those areas are just marked with a deleted flag and only when you start adding new files it gets overwritten.
That why some people send a bunch of 0s to their partition to completely wipe it.
Undeleting files typically requires low-level access to the drive containing the deleted files.
Do you really want to give an AI, the same one that just wiped your files, that kind of access to your data?
If there is something on your disk that a state actor is going to use magnetic microscopy to try to recover, it seems absurd to worry about still being able to use that hard drive and not just crush/melt it to be sure.
Is that still the case with SSDs? I understood it to be a property of magnetic disks, and only possible because the drives can be disassembled and then read with a more sensitive reading head. I can’t think of a way to do that with flash circuitry unless it’s already designed to do that.
Oh yeah, the bit where SSDs move sectors around for wear evening is important. Because of that, it’s possible to completely fill up an SSD after deleting files and still have those files recoverable from the flash chips themselves. Without that secure erase, as I understand it, if a sector gets marked “bad”, whatever data is there might stay there forever (or at least as long as the cells hold a charge).
So there’s no benefit to writing multiple passes over deleted data on SSDs as far as the flash is concerned, but multiple passes might make it more likely for the controler to actually direct those extra writes to a sector actually storing the data (though the odds might be low unless you’re overwriting all free space, though even that depends on how much space is free vs how many “spare” sectors there are, and even then it might be impossible to get it to write to a sector marked “bad”).
They keep saying that but those Bitcoins are still in the dump. (I’m aware it’s not comparable since having the drive in hand versus missing is a huge difference. Just a little joke.)
On some filesystems the data is still there but the filenames associated with it are gone or mangled. That makes it harder to recover things. In addition, while it’s true that the contents are only overwritten when you write data to the disk, data is constantly being written to the disk. Caches are being updated, backup files are being saved, updates are being downloaded, etc. If you only delete one file the odds are decent that that part of the disk might not be used next. But, if you nuke the entire drive, then you’re probably going to lose something.
On the upside, they specified D: drive which is typically a lesser used bulk storage drive, so less activity to potentially overwrite the files marked as deleted
It’s not necessarily a “bulk storage” drive, it’s just not the main system drive. It would probably have less activity than the “C” drive, but other than the OS, plenty of other things might be installed on that drive. If it happens to be where someone installed their web browser, there could be plenty of churn there.
Because it doesn’t have that kind of access to the file system. It can pull and push files from the system but that’s it. It has to interact with the file system via an API, it’s not got direct access.
How the fuck can it not recover the files?
Fun fact, files don’t just get instantly nuked when you delete them, those areas are just marked with a deleted flag and only when you start adding new files it gets overwritten.
That why some people send a bunch of 0s to their partition to completely wipe it.
https://unix.stackexchange.com/questions/636677/filling-my-hard-drive-with-zeros
Nobody on StackExchange told it the commands to do so.
Undeleting files typically requires low-level access to the drive containing the deleted files.
Do you really want to give an AI, the same one that just wiped your files, that kind of access to your data?
Then 1s, then a pattern of 1s and 0s, then the inverse of that pattern, then another pattern, for a number of cycles.
Data can actually be recovered beyond multiple overwrites, if enough time and money is thrown at it.
If there is something on your disk that a state actor is going to use magnetic microscopy to try to recover, it seems absurd to worry about still being able to use that hard drive and not just crush/melt it to be sure.
Is that still the case with SSDs? I understood it to be a property of magnetic disks, and only possible because the drives can be disassembled and then read with a more sensitive reading head. I can’t think of a way to do that with flash circuitry unless it’s already designed to do that.
Relevant: https://www.stellarinfo.com/blog/myths-about-disk-wiping-and-solid-state-drives/
Oh yeah, the bit where SSDs move sectors around for wear evening is important. Because of that, it’s possible to completely fill up an SSD after deleting files and still have those files recoverable from the flash chips themselves. Without that secure erase, as I understand it, if a sector gets marked “bad”, whatever data is there might stay there forever (or at least as long as the cells hold a charge).
So there’s no benefit to writing multiple passes over deleted data on SSDs as far as the flash is concerned, but multiple passes might make it more likely for the controler to actually direct those extra writes to a sector actually storing the data (though the odds might be low unless you’re overwriting all free space, though even that depends on how much space is free vs how many “spare” sectors there are, and even then it might be impossible to get it to write to a sector marked “bad”).
They keep saying that but those Bitcoins are still in the dump. (I’m aware it’s not comparable since having the drive in hand versus missing is a huge difference. Just a little joke.)
It was given permission to use rm and it rm’d an entire drive and you want to give it permissions to access hardware sectors.
On some filesystems the data is still there but the filenames associated with it are gone or mangled. That makes it harder to recover things. In addition, while it’s true that the contents are only overwritten when you write data to the disk, data is constantly being written to the disk. Caches are being updated, backup files are being saved, updates are being downloaded, etc. If you only delete one file the odds are decent that that part of the disk might not be used next. But, if you nuke the entire drive, then you’re probably going to lose something.
On the upside, they specified D: drive which is typically a lesser used bulk storage drive, so less activity to potentially overwrite the files marked as deleted
It’s not necessarily a “bulk storage” drive, it’s just not the main system drive. It would probably have less activity than the “C” drive, but other than the OS, plenty of other things might be installed on that drive. If it happens to be where someone installed their web browser, there could be plenty of churn there.
Because it doesn’t have that kind of access to the file system. It can pull and push files from the system but that’s it. It has to interact with the file system via an API, it’s not got direct access.
deleted by creator