* Posts by RogW

1 publicly visible post • joined 3 Mar 2011

Self-erasing flash drives destroy court evidence

RogW

It's only a particular Samsung controller and only for NTFS

Flash drives take time to erase data. Some Samsung SSD controllers, understand the basics of the NTFS filesystem, and will pre-delete unused sectors, so that the performance for writing new data is improved.

So if you want your data really deleted, you need an SSD with one of these Samsung controllers, and you need to use NTFS.

If you want to investigate the deleted files like you would on a HDD (at the interface level) you change the file system ID byte in the partition table (or whatever the Samsung controller triggers off of). You can document exactly what you've done and why. From that point on it's the same.

As mentioned by someone else, the controller chip (not the RAMs) will probably have a JTAG port, so powering up the device with a JTAG debugger connected to the JTAG port, would allow you to stop the garbage collection at startup. As it's only a range of Samsung devices at the moment, this would be quite simple. As would writing a JTAG debug script to read the entire flash array, including the remapping tables.