SSDs Are Resilient to Secure Data Wipes, at Least 90% of the Information Is Still Accessible

Consumers and enterprise users who thought that wiping sensitive data of an solid state disk is as simple as erasing such information for an HDD are in for a shock as researches have show that NAND flash cells are much more resilient than their platter-based counterparts to commonly used secure erase methods.

This would mean that a large number of businesses, as well as end-users, have left important amounts of recoverable data on NAND thumb drives and NAND solid-state drives which may end up in the wrong hands.

The study was carried out by researchers at the University of California San Diego (UCSD), who discovered that by taking out of the devices the physical NAND chips, on which data is stored, they could access at least 10% of the information that has been previously stored even after a secure erase has been performed.

This is caused by the fact that the data wipe methods employed by such tools were designed for HDDs, which use a different technology than NAND storage devices.

The scientists have tried more than a dozen methods for overwriting the data present on flash drives and discovered that even the best methods, such as Gutman's 35-pass and Schneier 7-pass, only erased 90% of the information stored.

More importantly, techniques like using pseudorandom numbers or the British HMG IS5 baseline method left almost the entire file intact.

“Our results show that naively applying techniques designed for sanitizing hard drives on SSDs, such as overwriting and using built-in secure erase commands is unreliable and sometimes results in all the data remaining intact.

“Furthermore, our results also show that sanitizing single files on an SSD is much more difficult than on a traditional hard drive,” said researchers Laura Grupp and Michael Wei.

When a file is deleted form a storage device, HDD, SSD or thumb drive alike, the data isn't actually removed from the drive, but only hidden from the operating system, waiting to be overwritten.

Is this why a secure erase is required if you plan on keeping the information away from prying eyes (for regular HDDs that is).

In the case of NAND-based storage devices, such as thumb drives and SSDs, encrypting the data is the best way to avoid such problems, security experts recommending users to encrypt the entire disk right after the operating system is installed. (via DailyTech)