this post was submitted on 15 May 2024
514 points (97.4% liked)

Technology

59577 readers
5913 users here now

This is a most excellent place for technology news and articles.


Our Rules


  1. Follow the lemmy.world rules.
  2. Only tech related content.
  3. Be excellent to each another!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, to ask if your bot can be added please contact us.
  9. Check for duplicates before posting, duplicates may be removed

Approved Bots


founded 1 year ago
MODERATORS
 

cross-posted from: https://sopuli.xyz/post/12670977

iPhone owners say the latest iOS update is resurfacing deleted nudes

you are viewing a single comment's thread
view the rest of the comments
[–] 5too 64 points 6 months ago* (last edited 6 months ago) (1 children)

Step away from hardware constraints for a moment, and consider the OS:

If the OS says a file is deleted, under no circumstances should the OS be able to recover it. Sure, certain tools may exist to pull it back; but it should be unavailable to the OS after that. And yet, apparently a software update was enough to recover these files. Thus, the concerns about data safety in an environment where the OS cannot be trusted to remove data when it says it has been removed.

[–] [email protected] 22 points 6 months ago (2 children)

So let's stop calling it "deleted" then, and call it what it is. "Forgetting".

I'm not sure what you actually want the OS to do about it other than as I said, fill it with random data.

[–] [email protected] 10 points 6 months ago* (last edited 6 months ago) (1 children)

I think this is just semantics at this point, but to me there is a difference between “deleted” and “erased”. I see deleted as the typical “moved to trash” or rm action, with erased being overwritten bits, or like microwaving a drive.

Edit - If i remember correctly deleting something in most OS’s/File Systems just deletes the pointer to that file on disk. The data just hangs out until new data is written to that sector. The solution, other than the one you mentioned about encrypting stored data and destroying the key when you want the data “deleted”, would be to only ever store data in volatile memory. That would make for a horrendous user experience though.

[–] Hildegarde 6 points 6 months ago (1 children)

You can delete files by overwriting the data. On Linux its shred -zu [file]. Its slow but good to do if you are deleting sensitive data.

Its good its not the standard delete function.

[–] [email protected] 2 points 6 months ago (3 children)

Question: what fraction of bits do you need to randomly flip to ensure the data is unrecoverable?

[–] [email protected] 5 points 6 months ago* (last edited 6 months ago)

Information theory aside: In practice all because you can't write bit-by-bit and if you leave full bytes untouched there still might be enough information for an attacker to get information, especially if it's of the "did this computer once store this file" kind of information, not the actual file contents.

If I'm not completely mistaken overwriting the file once will be enough to prevent recovering with logical means, that is, reading the bits the way the manufacturer intended you to, physical forensics can go further by being able to discern "this bit, before it got overwritten, was a 1 or 0" by looking very closely at the physical medium, details on how much flipping you need to defeat that will depend on the physical details.

And I wouldn't be too terribly sure about that electro magnet you built into your case to erase your HDD with a panic button: It's in a fixed place, will have a fixed magnetic field, it's going to scramble everything sure but the way it scrambles is highly uniform so the bits can probably be recovered. If you want to be really sure buy a crucible and melt the thing.

Also, may I interest you in this stylish tin-foil hat, special offer.

[–] Hildegarde 3 points 6 months ago

If you delete normally, only the index of the files are removed, so the data can be recovered by a recovery program reading the "empty" space on the disk and looking for readable data.

If you do a single pass erase, the bits will overwritten one time. About half the bits will be unchanged, but that makes little difference. Any recovery software trying to read it will read the newly written bits instead of the old ones and will not be able to recover anything.

However, forensic investigation can probably recover data after a single pass erase. The shred command defaults to 3 passes, but you can do many more if you need to be even more sure.

Unless you have data that someone would spend large sums on forensics to recover, 1 to 3 passes is probably enough.

[–] [email protected] 0 points 6 months ago

If it's completely random then 50%, that's how stream ciphers works.

[–] [email protected] 9 points 6 months ago

Well, iOS could just do it like every other OS that don't restore deleted data by installing an update.