Hard to Purge Flash Drives of Delicate Info

Monday, February 28, 2011 @ 05:02 PM gHale

Computer files stored on solid state drives are sometimes impossible to delete using traditional disk-erasure techniques.

Even when the next-generation storage devices show deleted files, as much as 75 percent of the data contained in them may still reside on the flash-based drives, according to research presented at the Usenix FAST 11 conference in California. In some cases, the SSDs, or solid-state drives, indicate the files were “securely erased” even though duplicate files remain in secondary locations.

The difficulty of reliably wiping SSDs stems from their radically different internal design. Traditional ATA and SCSI hard drives employ magnetizing materials to write contents to a physical location known as the LBA, or logical block address. SSDs, by contrast, use computer chips to store data digitally and employ an FTL, or flash translation layer, to manage the contents. When a user modifies data, the FTL frequently writes new files to a different location and updates its map to reflect the change.

In the process left-over data from the old file, which the authors refer to as digital remnants, remain.

“These differences between hard drives and SSDs potentially lead to a dangerous disconnect between user expectations and the drive’s actual behavior,” said scientists at the University of California at San Diego in a paper. “An SSD’s owner might apply a hard drive-centric sanitization technique under the misguided belief that it will render the data essentially irrecoverable. In truth, data may remain on the drive and require only moderate sophistication to extract.”

Researchers found as much 67 percent of data stored in a file remained even after deleting it from an SSD using the secure erase feature offered by Apple’s Mac OS X. Other overwrite operations, which securely delete files by repeatedly rewriting the data stored in a particular disk location, failed by similarly large margins when used to erase a single file on an SSD. Pseudorandom Data operations, for instance, allowed as much as 75 percent of data to remain, while the British HMG IS5 technique allowed as much as 58 percent.

Singling out one or more files for erasure is the only sanitization technique that allows the disk where it stores the data to continue usage. And yet the researchers found all single-file overwrite techniques failed to remove all digital remnants, even when the procedure included disk defragmenting, which rearranges the remaining data in the file system.

“Our data shows that overwriting is ineffective and that the ‘erase procedures provided by the manufacturer’ may not work properly in all cases,” the paper warns.

Whole-disk wiping techniques faired only slightly better with SSD media. In the most extreme case, one unnamed SSD model still stored 1 percent of its 1 GB of data even after 20 sequential overwrite passes on the entire device. Other drives were able to securely purge their contents after two passes, but most of them required from 58 hours to 121 hours for a single pass, making the technique unviable in most settings.

The researchers also found serious failures when subjecting SSD media to degaussing, where the goal is to destroy a drive’s low-level formatting. Because degaussing attacks magnetism-based features of disks, it is ineffective when applied to next-generation storage devices. “In all cases, the data remained intact,” the researchers wrote.

The researchers found the most effective way to sanitize data on SSDs was to use devices that encrypted their contents. Wiping happens by deleting the encryption keys from the key store, effectively ensuring that the data will remain encrypted forever.

“The danger, however, is that it relies on the controller to properly sanitize the internal storage location that holds the encryption key and any other derive values that might be useful in cryptanalysis,” the researchers wrote. “Given the bugs we found in some implementations of secure erase commands, it is unduly optimistic to assume that SSD vendors will properly sanitize the key store. Furthermore, there is no way to verify that erasure has occurred (e.g., by dismantling the drive).”

Scientists recorded the findings by writing files with identifiable patterns to SSDs and then using a field-programmable gate array device to search for the fingerprint after using secure erasure techniques to delete the files. The researchers’ device cost about $1,000, but “a simpler, microcontroller-based version would cost as little as $200, and would require only a moderate amount of technical skill to construct,” they said.

Right now, SSDs see use in USB thumb drives, and it’s not unusual for them to hold as much as 32 GB of data. An increasing number of laptops by default ship with SSDs installed as the primary storage mechanism. Flash storage underpins that vast majority of smartphones, as well.