I heard on another post something about 0-ing out computer memory not being enough to stop a digital forensics expert with enough time and dedication from recovering the data. They said you needed to overwrite the data randomly at least 7 times to render it completely irretrievable. This seems completely unnecessary to me, unless computer memory has some sort of physical “residual memory” where you could identify the last change made to that bit. And even if that is the case, why wouldn’t overwriting every bit to 0, then 1, then back to 0 work just as well?
In: Technology
Computer forensics is not unlike physical forensics in this regard.
Imagine you had a keypad that was worn down from constant use, and you could see the 4 numbers that had been pressed the most by simply observing the damage. You can press all the other buttons, but you’d have to press them a lot to make them equally worn down. And even then, someone with advanced equipment could tell the difference between the ones that you intentionally wore down if they were dedicated enough, since a button worn down over an extended period of time will be damaged differently and contain trace amounts of substances that can make it possible to differentiate.
This is the same concept here. Sectors of the hard drive are physically altered over time, and synthetic overwriting can be detected and accounted for in advanced recovery techniques.
But, for SSDs, this is largely irrelevant.
Latest Answers