What is the theory behind securely delete files on a SSD?

Question

Assume that I have a file which I want to securely delete in a ssd. If I do a regular detele and then fill all unused space with a random data file, would this works?

Answer 1

Because of wear leveling in flash storage devices (like SSD), in order to be certain of overwriting a deallocated block you'd need to write all unallocated flash storage blocks. Unfortunately, even doing the overwrite before deleting the file would require overwriting every single block not part of other files, because each write may land anywhere on the entire storage device as part of the wear leveling process. That means that in order to securely erase by overwriting, you effectively need to overwrite all space on the device not already part of other files outside the flash storage block(s) occupied by the file to be deleted, and even then you can't be certain you've overwritten the block that originally held the file in question, if there are other files (or fragments of them) in the same flash storage block.

Because of this, SSD (or flash storage in any form) is a bad choice for storing data that may need to be securely erased short of physical destruction of the device; stick with optical media which can be shredded, or magnetic storage that's amenable to mil-spec erasure with multiple pattern and random overwrites (and where data stays where it was so you can be sure it's been overwritten). If you must use flash media, I'd suggest the smallest capacity SD or thumb drive that will hold what you need, along with a reliable method to avoid physical loss of the storage device. That will both simplify the "overwrite the whole device" requirement for secure deletion, and reduce the cost of physical destruction of the device for absolutely certain deletion security.

Answer 2

AFAIK there is no truly secure way to delete files from an SSD, as the comments point out the SSD's controller can decide to "move" it's internal storage blocks from one accessible sector to another at whim (for wear leveling), and most keep an "extra" unused amount of blocks to swap out for bad ones in the future, or randomly.

So even if you overwrote every accessible block on an SSD there could still be blocks holding data that are unaccessible using normal tools.

There's sometimes a secure_erase ATA command available, but that should securely overwrite the entire drive, so couldn't be used for just wiping out a few files. (It's been commented that not all drives may secure_erase correctly too.)

If you want to keep sensitive data on an SSD and you're concerned about someone seeing the data later there's two recommendations:

1. Don't

2. Encryption - Then you don't worry about erasing your mistakes later, since they're already effectively "gone" without the key.

   • Encrypt only the sensitive data, and never write any sensitive non-encrypted data - watch out for non-encrypted memory cache / swap / system hibernation files).

   • Encrypt the entire SSD from the start, before writing any sensitive data to it, and keep all data on it encrypted - memory to disk files included.

Answer 3

Annoyingly academic papers disagree on how you can usually destroy data.

There's a few things worth considering. Traditional disk sanitisation techniques are designed for hard drives - these write data more or less sequencially and are 'simpler' than the modern SSD. Generally treating a SSD like a HDD tends to destroy both performance and the SSD and things like garbage collection are generally triggered by specific ata commands like TRIM and Secure Delete.

Now, there's two viewpoints - One espoused by Boddington et al (whose paper seems inaccessible), and an older paper by Gubanov et al is that the garbage collection algorithms used by SSDs destroy data on their own.

On the other hand Wei et al and a newer paper by Gubanov et al indicates uou can never actually delete all the data and sometimes conventional data sanitasation tools fail with SSDs.

In theory the right way to delete files permanantly from a SSD is to use the secure deletion ATA command. In practice, if you want to be sure, you may want to consider full disk encryption with a password, or a keyfile in a traditional harddrive or destructable
storage of some sort.