• Re: How The FBI Finds Your DELETED Files

    From Alan@3:633/10 to All on Sunday, August 30, 2026 09:13:39
    On 2026-08-29 10:39, Yamn Remailer wrote:
    My high school computer teacher told us the only way to truly delete or erase files
    is to smash your computer's hard drive with a sledgehammer!

    https://www.youtube.com/watch?v=jdui7v2B9DI


    Your high school computer teacher should take up a new subject.

    You most definitely can "truly delete or erase files" on both magnetic
    hard drives and most certainly on SSDs.

    And your video actually explains how data can truly be erased.

    --- PyGate Linux v1.5.19
    * Origin: Dragon's Lair, PyGate NNTP<>Fido Gate (3:633/10)
  • From Paul@3:633/10 to All on Sunday, August 30, 2026 16:10:16
    On Sun, 8/30/2026 12:13 PM, Alan wrote:
    On 2026-08-29 10:39, Yamn Remailer wrote:
    My high school computer teacher told us the only way to truly delete or erase files
    is to smash your computer's hard drive with a sledgehammer!

    https://www.youtube


    Your high school computer teacher should take up a new subject.

    You most definitely can "truly delete or erase files" on both magnetic hard drives and most certainly on SSDs.

    And your video actually explains how data can truly be erased.

    That would be Enhanced Secure Erase. Which wipes current
    active sectors, plus the spare sectors as well.

    Paul

    --- PyGate Linux v1.5.19
    * Origin: Dragon's Lair, PyGate NNTP<>Fido Gate (3:633/10)
  • From Alan@3:633/10 to All on Sunday, August 30, 2026 15:43:13
    On 2026-08-30 13:10, Paul wrote:
    On Sun, 8/30/2026 12:13 PM, Alan wrote:
    On 2026-08-29 10:39, Yamn Remailer wrote:
    My high school computer teacher told us the only way to truly delete or erase files
    is to smash your computer's hard drive with a sledgehammer!

    https://www.youtube


    Your high school computer teacher should take up a new subject.

    You most definitely can "truly delete or erase files" on both magnetic hard drives and most certainly on SSDs.

    And your video actually explains how data can truly be erased.

    That would be Enhanced Secure Erase. Which wipes current
    active sectors, plus the spare sectors as well.

    Paul

    Yup, and while for magnetic media it can take multiple passes to ensure
    there isn't any residual "charge" that can be read, it can be done.


    --- PyGate Linux v1.5.19
    * Origin: Dragon's Lair, PyGate NNTP<>Fido Gate (3:633/10)
  • From Paul@3:633/10 to All on Monday, August 31, 2026 00:41:19
    On Sun, 8/30/2026 6:43 PM, Alan wrote:
    On 2026-08-30 13:10, Paul wrote:
    On Sun, 8/30/2026 12:13 PM, Alan wrote:
    On 2026-08-29 10:39, Yamn Remailer wrote:
    My high school computer teacher told us the only way to truly delete or erase files
    is to smash your computer's hard drive with a sledgehammer!

    https://www.youtube


    Your high school computer teacher should take up a new subject.

    You most definitely can "truly delete or erase files" on both magnetic hard drives and most certainly on SSDs.

    And your video actually explains how data can truly be erased.

    That would be Enhanced Secure Erase. Which wipes current
    active sectors, plus the spare sectors as well.

    ˙˙˙ Paul

    Yup, and while for magnetic media it can take multiple passes to ensure there isn't any residual "charge" that can be read, it can be done.


    The 35-pass Guttmann thing only applies to old disks,
    like FM and MFM. Guttmann issued a statement about this,
    giving the OK for single-pass erasure of newer HDD. His previous
    position on the matter, was for longitudinal recording
    with large fringing fields. PMR is vertical recording.
    Guttmann did not want erasing hard drives to be "turned
    into a religion", which is why he released that statement.
    A lot of people still think the 35-pass method is "best practice".

    If you look at a Magnetic Force Microscopy picture of a
    PMR platter (vertical recording), there is no real fringing
    field (one significant enough to be seen in the plot), This is
    why if you tighten the tracks up and put them in seven track groups,
    with *zero* clearance between tracks as you write a set, the
    data survives. And that's an SMR disk (PMR via materials,
    SMR via formatting pattern and servo wedge pattern, seven track sets, read-modify-write).

    The Enhanced Secure Erase, does what is needed for the job,
    which is one pass for PMR/SMR. That's why if it normally takes you
    four hours to "dd" zeros over the entire surface,
    the Enhanced Secure Erase takes the same amount of time.
    It does NOT take four hours * 35, you'd notice if it did that.

    Another misconception in the room, is about "I wrote zeros and
    this or that is filled with zeros". It is not. HDD, SSD, NVMe
    have default-encryption. What is written to the media, looks
    like electrical noise. It must go through decryption on a read,
    to get back your plaintext. If you set a different key, then
    that is FDE with a non-default key. On the HDD, there can also
    be a scrambler after the encryption, and that would prevent
    the encryption from even hinting at accidentally making a
    zeros sequence. The amplifiers tend to be AC coupled, and
    a lot of this activity is aimed at making it easy to amplify
    the head signal. The amplifier design is prefaced on a HDD,
    on the data being random at head level. We used to do this
    on fiber optic systems, for a similar reason. For some
    fiber thing I worked on, the amp only needed a 100KHz bandwidth
    (passband).

    If I were to write "I wrote zeros to the NVMe and this is
    good for the flash", well no, because the encryption that
    goes on internally, ensures the 0/1 mix is random-looking.
    And that's a characteristic of a good encryption method,
    is the output looks random -- you can't see any pattern to it.
    If you inject 0's in a long string, or inject 1's in a long
    string, nothing like that shows up on the physical media.
    The SSD and NVMe don't need a scrambler, but they have the
    crypto in there.

    There was some kind of blanket statement from the storage
    industry, that by date "X" all storage devices would be
    encrypted. Then, there was silence, and the first attempts
    at making FDE easy, were a failure. It's only later, the
    idea of default-encryption was mentioned. Also, we eventually
    learned, that when replacing the controller PCB on a HDD,
    you need to keep the 8 pin DIP that has the encryption key,
    if you expect the new controller card to be able to work
    properly with the disk HDA. In the old days, you could swap
    controllers freely, no soldering and messing about. Today,
    you have to be careful. So if you buy a "dead drive" just
    for the controller card, you may still end up soldering
    a chip off the old card to it. If the old card was over-volted,
    there is a risk the chip with the key is blown.

    And you can see that this crypto-thingy has some interesting properties.

    1) Ransomware can use a method, where a different key is set in the hard
    drive, which instantly causes you to lose access to the disk data.
    This is "better" for the ransomware people, as encrypting individual
    files and putting up the red box, is too slow.

    2) If you overvolt the HDD controller card (screwed to the HDA), then
    the key is not recoverable from the 8 pin chip. To turn this into
    push-button-destruct though, further research is needed to see if
    the key could be recovered using a vat of acid and a microscope.

    Maybe these would not affect a professional, but they would
    stop most amateur efforts to snoop. No sledge needed.

    Paul

    --- PyGate Linux v1.5.19
    * Origin: Dragon's Lair, PyGate NNTP<>Fido Gate (3:633/10)
  • From Paul@3:633/10 to All on Monday, August 31, 2026 08:12:13
    On Mon, 8/31/2026 5:12 AM, Andy Burns wrote:
    T wrote:

    ˙˙˙ dd if=/dev/zero˙ of=nvme0n1

    Rots-a-Ruck trying to recover that!˙ And it sets all
    your cells to zero for longer life

    How do you know what the SSD's controller will do with all those zeroes?

    It could think it's being clever, and not actually overwrite the zeroed sectors, but simply mark them onto an "empty" list ... bypassing the controller to read back the original contents is left as an exercise for the reader!

    /dev/urandom would be better.

    I think at some point, we're going to have to get the LLM-AI to
    write a functional description for us :-)

    For this question, I chose to prime the pump, by entering statements of function.
    The danger in doing this, is the LLM-AI just repeats what you say. But I've noticed lately, it does not mind correcting you, so... here we go :-)

    ************************ Copilot Question *************************

    Consider the following series of statements about flash SSD devices.
    These statements might be part of a functional description for how
    an SSD works. Can you write a coherent functional description,
    or at least, provide a URL where we could find this level of detail ?
    In the following, there is an assumption the page size of the flash
    chips is 16KB.

    ******** Some statements about flash SSD, could be part of a functional description ********
    When you write 4KB items to an SSD, the drive later rearranges the 16KB pages which are not full, so that, say, three pages go onto the free pool, and one page with (4) 4KB blocks resides in a single page.

    Making a fractional write to a page, causes a page to be pulled from the free pool,
    the old page copied, the fractional write included, the result written to the page from the free pool. This is RMW using a fresh free pool page.

    There is a lookup table, that matches physical LBA to virtual address in the flash.

    If you TRIM a filesystem, inodes or clusters are marked as being not in need
    of representation. Then, when that particular physical LBA is used in a Read operation, the drive does not need to consult the flash surface at all, and it can substitute a quantity of zeros instead. This gives the impression the TRIMmed areas have been erased. The pages freed up, are put on the free pool, and they may actually be erased to achieve this end (they are ready to be written).

    Modern SSDs have default-encryption, such that if you write 4K of zeros,
    the 16K page receiving this information instead receives a rather
    random looking (encrypted) set of bytes instead.
    ******** End: Some statements about flash SSD, could be part of a functional description ********

    ************************ CoPilot Answer *************************

    The statements you listed *do* correspond to real SSD-internal mechanisms - page-granularity writes, block-granularity erases, copy-on-write behavior, garbage collection,
    TRIM semantics, and controller?level encryption - but they?re scattered pieces of a larger
    architecture. The most coherent, technically accurate descriptions of this level of detail
    are found in SSD-internals documents that explain NAND constraints, the
    Flash Translation Layer (FTL), garbage collection, write amplification, and TRIM.

    The **best single URL** that matches the level of detail you?re looking for is:

    **SSD Internals: NAND Flash, FTL, Wear Leveling, and Write Amplification**
    ( https://kindatechnical.com/operating-systems/lesson-81-ssd-internals.html )

    This source explicitly covers:

    - Page size (4?16 KB) and block size (hundreds of pages)
    - Read/Write/Erase asymmetry
    - Flash Translation Layer (mapping LBAs --> physical pages)
    - Copy-on-write behavior for partial-page updates
    - Garbage collection and page consolidation
    - TRIM and how it marks pages stale
    - Why SSDs reorganize partially-filled pages
    - Why SSDs return zeros for trimmed LBAs
    - Why encrypted SSDs store random-looking data even when you write zeros <==== This one is for "T"

    Below is a **coherent functional description** synthesized from the authoritative sources above, with citations.

    ---

    ## Functional Description of SSD Behavior (Synthesized)

    ### 1. NAND Flash Structure and Constraints
    NAND flash is organized hierarchically:
    - **Page**: smallest read/write unit (typically 4?16 KB)
    - **Block**: erase unit containing 128?512 pages (1?8 MB)

    Key constraint: **pages cannot be overwritten in place**. To modify a page,
    the entire block must be erased first. This erase-before-write rule is the root of SSD complexity.
    ( https://kindatechnical.com/operating-systems/lesson-81-ssd-internals.html )

    ---

    ### 2. Flash Translation Layer (FTL)
    The SSD controller maintains a **logical-to-physical mapping table** (LBA --> physical page address).
    This table is continuously updated because data is always written to fresh pages. ( https://harshith.in/blog/ssd-internals/ )

    When the host writes 4 KB to an LBA:

    1. The SSD allocates a **new physical page** in a free block.
    2. The FTL updates the mapping entry.
    3. The old page is marked **stale**.

    This is why SSDs behave like log-structured storage systems. ( https://harshith.in/blog/ssd-internals/ )

    ---

    ### 3. Fractional Page Writes (Your RMW Scenario)
    If the host writes less than a full page (e.g., 4 KB into a 16 KB page):

    - The SSD **cannot modify the existing page**.
    - It performs a **read-modify-write (RMW)**:
    - Reads the old page into controller DRAM
    - Merges the new 4 KB fragment
    - Writes the merged 16 KB page into a **fresh free page**
    - Marks the old page stale

    This behavior is explicitly described in SSD internals literature. ( https://harshith.in/blog/ssd-internals/ )

    ---

    ### 4. Consolidation of Partially?Filled Pages
    Over time, many pages become partially valid or stale. Garbage collection:

    - Selects a block with many stale pages
    - Copies the remaining live pages into new blocks
    - Erases the old block
    - Returns its pages to the **free pool**

    This matches your description of "rearranging 16 KB pages so that three pages go to the free pool and one page with four 4 KB blocks remains."
    This is standard garbage?collection behavior.
    ( https://github.com/natenberenstein/deep-dive-storage/blob/main/docs/03-solid-state-drives/ssd-architecture-and-ftl.md )

    ---

    ### 5. TRIM Behavior
    When the OS issues TRIM:

    - The SSD marks the corresponding LBAs as **invalid/stale** in the FTL.
    - During future reads, the SSD **does not consult NAND**; it returns zeros because the logical block is known to be deleted.
    ( https://harshith.in/blog/ssd-internals/ )
    - The physical pages become eligible for garbage collection.
    - GC may erase the block immediately or later, returning pages to the free pool.
    ( https://github.com/natenberenstein/deep-dive-storage/blob/main/docs/03-solid-state-drives/ssd-architecture-and-ftl.md )

    This matches your description exactly. [Not quite, I missed the lazy evaluation of the need to erase]

    ---

    ### 6. Default Encryption and "Random?Looking" Zero Writes
    Modern SSDs often use **transparent controller-level AES encryption**.
    Because encryption is applied to the physical page:

    - Writing 4 KB of zeros results in **ciphertext**, which appears random.
    - Thus the 16 KB physical page contains random-looking bytes even though the logical content is zeros.

    This behavior is consistent with modern NVMe and SATA SSDs with built?in hardware encryption.
    (Inference based on standard controller behavior; the cited sources
    discuss controller complexity but not encryption explicitly.)

    ---

    ## Summary
    Everything you described corresponds to real SSD behavior:

    - Page-granularity writes and block-granularity erases
    - Copy-on-write for partial page updates
    - Page consolidation during garbage collection
    - FTL mapping of LBAs to physical pages
    - TRIM marking pages stale and returning zeros
    - Encrypted SSDs storing random-looking ciphertext

    The **best single reference** for this level of detail is:
    **SSD Internals: NAND Flash, FTL, Wear Leveling, and Write Amplification**
    ( https://kindatechnical.com/operating-systems/lesson-81-ssd-internals.html )

    For deeper architectural detail, this is also excellent:
    **SSD Architecture & FTL (Deep Dive)**
    ( https://github.com/natenberenstein/deep-dive-storage/blob/main/docs/03-solid-state-drives/ssd-architecture-and-ftl.md )

    ************************ End: CoPilot Answer **********************

    There are some other details that matter.
    If you do this, the default block size is 512 bytes.
    Now, imagine how ruinous this is, based on the description
    above of partially written pages. There could be write amplification.

    sudo dd if=/dev/zero of=/dev/nvme0n1

    However, this is not likely to happen on modern OSes. There was a mention
    that for Windows, Microsoft had placed a 64KB buffer on file handles. And
    what I noticed, is the Passmark Fragmenter program, could no longer
    make "small" fragments. The fragment size changed *without* any changes
    to the program I had downloaded.

    This suggests that, perhaps, for what might appear to be sequential writes,
    the OS buffer (Linux might have one too) will buffer up some of these
    requests. There is another way to do this, which is to use NCQ and disconnect/reselect behavior of AHCI, and the DRAM cache (or host bus cache) can hold multiple transactions, notice they are sequential, and concatenate them ("write combining"?). It might not be a given, that the command above, missing a bs=
    is as bad as it looks.

    If the OS was completely broken, and you selected "compatibility mode"
    for the Southbridge SATA port (a broken I/O choice), you might want to use this.
    Maybe WinXP would benefit from something like this. Dunno. I like to factor
    the device size in bytes, and work out exact bs= and count= values when I can.

    sudo dd if=/dev/zero of=/dev/nvme0n1 bs=16384

    But we should still attempt to fill pages *if* we can figure out what
    that page size is :-)

    Paul


    --- PyGate Linux v1.5.19
    * Origin: Dragon's Lair, PyGate NNTP<>Fido Gate (3:633/10)