Investigators pulled video from ‘residual data’ in Google’s systems — here’s how that was possible and what it means for your privacy.
Investigators pulled video from ‘residual data’ in Google’s systems — here’s how that was possible and what it means for your privacy.
From the article:
This is more or less how local storage works as well. The creator of BleachBit, a file cleaning tool made famous for being present on Hillary Clinton’s email servers, has some great insights in their documentation about the methods for destroying data on hard drives. As it turns out, data “deletion” is just a series of operations on your hard disk like any other, and retrieval depends on the methods used - de-indexing, metadata and file structure removal, and overwriting to name a few.
Once, I accidentally formatted the wrong drive in Windows and it ended up being my 20TB platter (oops). I was able to recover 99% of the files on the drive with some free recovery software just because I disconnected and stopped using the drive immediately. The only files lost were large ones partially overwritten by the new blank file system created when I formatted the drive. Windows had only deleted the file system indexing the drive, and all of the file data and metadata was intact, waiting to be randomly overwritten. I had to string together four cheap failing 4TB SATA drives I bought used on Amazon, but it worked.
The point is, if I could do this as an amateur, and storage technology operating on the same principals is in use at enterprise scale, what are the lengths that the likes of the FBI and Google are willing to go to recover old data that has been “deleted”? I’m frankly surprised that Google does not overwrite their discarded data, and it’s probably for reasons like this, beyond the additional processing time it would take. Given their vast resources and storage capacity, it could be some time before “deleted” data is at least partially overwritten, if ever.
If you ever have data that you absolutely need destroyed, overwrite the entire drive with random data more than once, then physically shred the drive completely. And never connect your devices to a cloud storage service. It’s the only way to be sure.
I was under the impression that Google just didn’t delete data — ever. Like, it’s way more valuable compared to the cost of the disk.
I wouldn’t be surprised if this is actually what happened here… tech companies in general don’t delete data if they can avoid it. I worked for companies that would just set
deleted = 1in the DB on delete calls. Google has more ability than anyone else to put that data to useI’ve never understood the overwrite more than once instruction. If the entire drive is overwritten how in the world do you pull back data out from an overwrite?
Flipping the bits on a magnetic medium back and forth doesn’t always flip them entirely. Using more sensitive equipment to read back the bits can see the faint hints of what the bits used to be, which is why multiple overwrites with random information is the only way to be sure (and even then, there are advanced techniques that try to see past all that noise. The more you overwrite, the less sure any of these techniques are to work.
Wild. If anyone knows of a video or demonstration of someone actually looking past the overwritten data on a platter, I’d love to see that - that’s really next level csi stuff.
Magnetic platter drives still have the highest storage density per dollar and so they are still heavily in use. Theoretically, overwritten data can be recovered from them by analyzing the magnetic fields directly from the platter. However, this is extremely time and money intensive and requires specialized equipment and expertise. Overwriting a partition multiple times severely complicates this process just by performing multiple overwrites.
Realistically, overwriting once with random data is enough, especially if the drive is to be physically destroyed. You can also use a powerful magnet (top end neodymium in direct contact) to scramble the delicate magnetic fields that encode the data on the platter, but at that point you may as well shred the drive anyways.
SSDs are a fundamentally different storage paradigm that make this kind of recovery essentially impossible. Due to the limitations of NAND memory, data can be written to blocks inaccessible except at the hardware level. To make SSDs secure, modern drives usually implement processes (TRIM) that erase blocks marked for deletion. Or, all data written to the drive is encrypted by onboard hardware (SED), and “erasing” the drive simply deletes the encryption keys.
One thing to keep in mind though, is even on ssds you need to encrypt your data to be absolutely sure it isn’t recoverable. Nothing more permanently unrecoverable than deleting your encryption key short of physically destroying the media.
One nifty fact about ssds is they usually have a good amount of extra space (over provisioning, with newer drives having less so than older ones) to allow the controller to swap out bad blocks without losing available space or use it as cache. Because of this, you may have normally inaccessible blocks that still contain data but have been taken out of the normal usage pool.