0

Use the app 'shredit!' and do the 35 time overwrite. Then you fill the phone with unnecessary data and then reset it to factory settings and erase. What are the chances of recovery of data that was stored one year ago?

Anders
  • 64,406
  • 24
  • 178
  • 215
  • 9
    I log into your iCloud and grab the data from there – schroeder Nov 05 '16 at 10:12
  • What data are you talking about? – schroeder Nov 05 '16 at 10:12
  • 1
    Frankly, on any modern system with support for encrypting drives, that app is worthless. The modern systems all do the actual encryption with much longer keys, then protect the key with your passcode (this also prevents reencrypting everything when you change passcodes). Set up your encryption, then throw away/force overwrite the key, and the data is unrecoverable. – Clockwork-Muse Dec 10 '16 at 08:21
  • 35 times? You using old MFM drives on that iPhone? – forest Mar 05 '18 at 03:24
  • 1
    @forest As I recall, not even Gutmann said 35 overwrites were required with MFM drives. It was only required to do the full set of pattern overwrites (not just 35 passes, but 35 *specific* passes) if you had no idea whatsoever whether you had a drive doing MFM, RLL or some other kind of encoding. – user Aug 02 '18 at 09:45
  • @MichaelKjörling Ah I think you're right. – forest Aug 03 '18 at 06:39
  • Flash memory does not need over-writing but suffers from other problems. Flash blocks are only erased (and over written) when re-used and when a block is re-used can not be determined, there are sophisticated algorithms such as wear-leveling at play. – zaph Dec 31 '18 at 14:12

2 Answers2

1

Doing this is complete nonsense.

All data on a modern iPhone (5s upward) is encrypted with a key which is derived from a key inside the CPU, another key stored in two copies in the flash memory, and usually the passcode is used as the third key.

All you need to do is erase the two copies of the second of these three keys which is stored in the flash memory, and it's game over. You cannot find the decryption keys anymore, they are 256 bit keys, and they are different for every single file - cracking 256 bit keys is considered physically impossible, and you would have to repeat this for every single file.

Apple also uses an API that can erase physical blocks on a flash drive, so you can safely assume that overwritten encryption keys are not recoverable

gnasher729
  • 1,823
  • 10
  • 14
0

I wonder why it is 35 times, lol. If it is ovewritten once then that is enough. But how do you know it overwrote everything? It probably didn't if you are running this app from the phone. Filling it with other data afterward is probably going to do the trick as well. The encryption scheme on the iPhone 5s is pretty solid. It requires the processor on the phone for decrypting so there is no offline recovery, and you have to get around the auto-reset to able to try many passcodes. That may require a signed iOS image from Apple that excludes the auto-reset, but there may be another way since the FBI was able to do it with some help after Apple refused.

Bottom line, I can't say no 100.00% on the chance of recovery, but really probably not recoverable from the phone.

mikato
  • 119
  • 5
  • but what if we never used a passcode –  Nov 11 '16 at 05:47
  • @badaboo I believe then the data is still encrypted with the rest of the encryption process (several layers), so someone trying to recover it would still need to use the phone to be able to read the data, but wouldn't have to worry about figuring out any passcode. – mikato Nov 15 '16 at 20:31
  • Note that in all those cases, the encryption itself was never broken; rather the attack was against the key. If you tell the phone to reset, it's (presumably) going to throw away the key permanently, meaning nobody could recover the data. – Clockwork-Muse Dec 10 '16 at 08:17
  • 3
    35X write is a US DoD standard for magnetic disks. It has nothing useful to do on flash memory. – user2497 Jul 07 '17 at 22:45
  • @user2479 yeah and that is way out of date nowadays as well. – mikato Jul 08 '17 at 18:13
  • 6
    35x is not an erasure standard. The DoD only overwrites unclassified data 2 or 3 times. Anything top secret cannot be disposed of using these methods at all. – Ivan Aug 07 '17 at 03:49
  • 3
    @Ivan The standard is DoD 5220.22-M (3 pass). I think the standard was deprecated anyway in favor of degaussing and physical destruction. 35x is Gutmann's old technique for MFM and RLL drives, which are obsolete. Note also that the iPhone uses solid state storage, which has completely different behavior when trying to wipe (issues with overprovisioning space, etc). – forest Mar 05 '18 at 03:26
  • [This](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r1.pdf) should be the current standard, I think. – timuzhti Oct 01 '18 at 06:28