LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 09-30-2007, 08:38 PM   #1
entz
Member
 
Registered: Mar 2007
Location: Milky Way , Planet Earth!
Distribution: Opensuse
Posts: 453
Blog Entries: 3

Rep: Reputation: 40
safe deletion of files


hello all.

this thread serves to address a simple question.

Do flash drives hold traces of deleted stuff on them which can lead to
deletion reversion like it can happen on magnetic media like HDD's ?

my personal answer is no , but I have a small doubt of %1 and since this is a security issue so I thought i'd better get the facts assured.

P.S with the word "deleted" I'm NOT referring to the process of removing files by only hitting the "delete" key , but I'm pointing to files/data which have been completely overwritten with new data basically zeros.(via drive formatting for example)
 
Old 09-30-2007, 08:41 PM   #2
2damncommon
Senior Member
 
Registered: Feb 2003
Location: Calif, USA
Distribution: PCLINUXOS
Posts: 2,918

Rep: Reputation: 103Reputation: 103
Quote:
Originally Posted by entz View Post
P.S with the word "deleted" I'm NOT referring to the process of removing files by only hitting the "delete" key , but I'm pointing to files/data which have been completely overwritten with new data basically zeros.(via drive formatting for example)
Formatting a drive does not overwrite it with anything.
 
Old 09-30-2007, 08:47 PM   #3
AceofSpades19
Senior Member
 
Registered: Feb 2007
Location: Chilliwack,BC.Canada
Distribution: Slackware64 -current
Posts: 2,079

Rep: Reputation: 58
If you "shred" the drive the data will be completely overwritten with zeros
 
Old 09-30-2007, 09:09 PM   #4
AAnarchYY
Member
 
Registered: Sep 2004
Location: Carlisle, MA
Distribution: Debian 8
Posts: 419

Rep: Reputation: 30
usually if i want to delete stuff to unrecoverable you can use shred
but to wipe a whole defice i usualy just use dd if=/dev/urandom of=/dev/sda a few times and throw in a few dd if=/dev/zero of=/dev/sda but seeing as that is a solid state device i dont believe there is any slop in how it is written that would facilitate file recovery in magnetic media.

drive formating does very little. I personally have recovered entire drives that were formated.
 
Old 10-01-2007, 09:08 AM   #5
entz
Member
 
Registered: Mar 2007
Location: Milky Way , Planet Earth!
Distribution: Opensuse
Posts: 453

Original Poster
Blog Entries: 3

Rep: Reputation: 40
Quote:
Formatting a drive does not overwrite it with anything
Oh really , probably it depends on the type of formatting doesn't it ?
anyways , I see that formatting isn't the best way to destroy data irreversibly .

Quote:
usually if i want to delete stuff to unrecoverable you can use shred
but to wipe a whole defice i usualy just use dd if=/dev/urandom of=/dev/sda a few times and throw in a few dd if=/dev/zero of=/dev/sda
alright I know about shred but let me have a look at the commands you gave ,from what I can speculate
those commands do copy something random into sda then a bunch of zero into it (probably to hide the fact that is has been "Shredded")
nonetheless , I'd appreciate if you would explain in more detail how this command dd works and why it's better to use than shred on wiping out devices beyond recognition.
 
Old 10-01-2007, 09:58 AM   #6
michaelk
Moderator
 
Registered: Aug 2002
Posts: 25,592

Rep: Reputation: 5880Reputation: 5880Reputation: 5880Reputation: 5880Reputation: 5880Reputation: 5880Reputation: 5880Reputation: 5880Reputation: 5880Reputation: 5880Reputation: 5880
As already stated formating does nothing with the data part of the filesystem. It really only zeros out the meta data i.e. FAT, inodes etc. etc. to save time.

It depends on the filesystem. shred will not erase any data in the journal. Journalized filesystems are like ext3, reiserfs, jfs and xfs. dd operates on the byte level so basically you are wiping out the entire partition with ones and zeros.

Your other question about the differences between flash memory vs magnetic media. IMHO flash or any other solid state memory can not have a residual state. Once a cell has been changed to a one you can not tell if it ever was a zero.
 
Old 10-01-2007, 08:00 PM   #7
entz
Member
 
Registered: Mar 2007
Location: Milky Way , Planet Earth!
Distribution: Opensuse
Posts: 453

Original Poster
Blog Entries: 3

Rep: Reputation: 40
Quote:
Originally Posted by michaelk View Post
Your other question about the differences between flash memory vs magnetic media. IMHO flash or any other solid state memory can not have a residual state. Once a cell has been changed to a one you can not tell if it ever was a zero.
Thanks , that was exactly the answer I was looking for
i also appreciate the other infos , yes I've gained indeed some new intel

cheers
 
Old 10-01-2007, 08:46 PM   #8
michaelk
Moderator
 
Registered: Aug 2002
Posts: 25,592

Rep: Reputation: 5880Reputation: 5880Reputation: 5880Reputation: 5880Reputation: 5880Reputation: 5880Reputation: 5880Reputation: 5880Reputation: 5880Reputation: 5880Reputation: 5880
I did some googling and discovered that I was wrong. I did find that flash memory does have a residual properties. Unless your storing classified material I would not worry about it to much. And stupid me, you should write zeros instead of ones....

http://islab.oregonstate.edu/ches/ch...orobogatov.pdf
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
retrieve files for deletion props666999 Slackware 5 06-14-2006 10:03 PM
help recovering from chkdsk.exe deletion of files? Lleb_KCir General 11 07-15-2005 12:30 PM
Accidental Deletion of some /usr/lib files Huddlebum Linux - General 17 03-08-2004 02:05 PM
Deletion of massive number of files KendersPlace Linux - General 4 04-01-2003 01:27 PM
Foolish deletion of /etc/fonts/ files & Gimp diversityx Linux - General 0 01-28-2003 03:45 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 06:25 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration