The solution to all of this is full disc encryption. Without the password
the disc is full of random noise.

Yes, Windows comes with Bitlocker. I am curious to know what the CPU
overhead is for decrypting on the fly the encrypted data on said drive?


If you are concerned about the disc
falling into the wrong hands (on a laptop, or at disposal time) then FDE
will protect against that.

Is Bitlocker considered to be a FDE?


SSDs typically do FDE 'for free' - the raw flash
is encrypted, and a 'secure erase' is simply deleting the key from inside
the controller.

Thats interesting to know, why is FDE used on SSDs? I don't see it
advertised as a feature on the advertising blurb so it gives one the
impression that one needs to deploy FDE....

Deleting the key is not the same thing as securely erasing the key with
an overwrite so my question is can the "deleted" key be recovered?

Also SSD's use wear levelling so an overwrite may end up on a physically
different location on the flash NAND chips?


No angle grinders needed.

Theo

On 16/04/2021 12:33, Tim Streater wrote:
On 16 Apr 2021 at 09:26:50 BST, polygonum_on_google
wrote:

On Friday, 16 April 2021 at 08:50:03 UTC+1, SH wrote:

2. Your email client will have a PST file containing *all* your emails,
email addresses, email contents etc.

Many of us have not one single .pst file. (I have one - which is an file last written in 2012! I think I might have used it to recover something or other.)

What is a .pst file?



whenever you create/send or recieve an email and all your email folders
all get backed up to a *.pst file.

The idea being that you can export the *.pst file from older/to be
scrapped or to be formatted & reinstalled machine.

Then you import the *.pst file a new/reformatted & reinstalled machine
so your new set up then has all teh emails and folders etc

SH wrote:

Tim Streater wrote:

What is a .pst file?

whenever you create/send or recieve an email and all your email folders
all get backed up to a *.pst file.

Only by Microsoft Outlook (the full-fat Office version, not the Express
version)

And nowadays more people probably use a .ost file instead

for Thunderbird the equivalent is a .msf file

Tim Streater wrote:
On 16 Apr 2021 at 09:26:50 BST, polygonum_on_google
wrote:

On Friday, 16 April 2021 at 08:50:03 UTC+1, SH wrote:

2. Your email client will have a PST file containing *all* your emails,
email addresses, email contents etc.
Many of us have not one single .pst file. (I have one - which is an file last written in 2012! I think I might have used it to recover something or other.)

What is a .pst file?


https://en.wikipedia.org/wiki/Personal_Storage_Table

"The .pst file format is supported by several
Microsoft client applications, including... Microsoft Outlook"

"Outlook 2002 and earlier use ANSI (extended ASCII with a codepage)
encoding. This format has a maximum size of 2 GB (2^31 bytes) and
does not support unicode.

From Outlook 2003 and onward, the new standard format for .pst
is Unicode (UTF-16 little-endian), with 64-bit pointers. The
limit became 20 GB for Outlook 2003-2007, and increased to
50 GB from Outlook 2010.
"

It's an awful kind of storage container. It's possible it
holds multiple mailboxes.

libpst - a little too low level maybe

https://www.five-ten-sg.com/libpst/rn01re06.html

Example of contents:

"The default folders within a pst-file for a POP3 account are;

Inbox
Drafts
Outbox
Sent Items
Deleted Items
Junk Email
Search Folders
RSS Feeds
Calendar
Contacts
Suggested Contacts (Outlook 2010 only)
Tasks
Notes
Journal
"

Paul

On Friday, 16 April 2021 at 13:12:40 UTC+1, Andy Burns wrote:
SH wrote:
Tim Streater wrote:

What is a .pst file?

whenever you create/send or recieve an email and all your email folders
all get backed up to a *.pst file.
Only by Microsoft Outlook (the full-fat Office version, not the Express
version)

And nowadays more people probably use a .ost file instead

for Thunderbird the equivalent is a .msf file

The change to .ost was, really, my point. There might well be functional equivalents - or similar - but .pst is somewhat out of date.

I also agree with those who suggest full disk encryption - such as BitLocker (in Windows).

Adrian Caspersz wrote:
On 16/04/2021 09:01, SH wrote:

Plus once an attacker has your details, they can make themselves *far*
more convincing when they phone you and say Hello Mr/Mrs/Miss XXXXX,
I'm from (high Street bank), we've detected suspiscious acitivity on
your bank account number XXYYZZ, we see its a joint account with youe
spouse, Mr/mrs XXXX and we see you have a pension plan with Pension
provider from the direct debits etc etc......

I see you use Windows*. "They" probably already have your data.

Just joking....

The biggest exposure with Windows users, is them not
knowing that the "format" command, does not overwrite
the data clusters on the disk. After a "format",
the buyer of your disk can use Photorec to dig up
the data. And that's precisely what some connoisseurs
of used disks have reported doing for fun - they're not
interested in your data, they check this so they can make
fun of how stoopid you are. "I found his email files"

To erase a Windows disk, you can (administrator command prompt)

diskpart
list disks
select disk 2
clean all # writes 0x00 over entire disk drive
exit

On a large drive, that could take three hours.
When the buyer runs Photorec, they won't find anything.

*******

You can verify drive contents with a hex editor like this one.
On a zeroed drive, you can quickly scroll through and check.

https://mh-nexus.de/en/hxd/

None of this helps with broken drives of course.

Paul

SH wrote:
The solution to all of this is full disc encryption. Without the password
the disc is full of random noise.

Yes, Windows comes with Bitlocker. I am curious to know what the CPU
overhead is for decrypting on the fly the encrypted data on said drive?

That will depend on your hardware (does it have AES instructions, does the
drive handle encryption).

Is Bitlocker considered to be a FDE?

Yes.

Thats interesting to know, why is FDE used on SSDs? I don't see it
advertised as a feature on the advertising blurb so it gives one the
impression that one needs to deploy FDE....

It's an 'enterprisey' feature but I don't know whether it's standard on
every SSD. It's pretty minimal overhead to do in the controller so I don't
see why not.

However it's a slightly different use case to Bitlocker et al. Bitlocker
protects user data, while drive encryption protects the drive. For example
you might want to keep an unencrypted recovery partition so you can restore
the machine if you forget the password - with drive encryption you can't do
that unless it allows you to mark off that partition as unencrypted.

Deleting the key is not the same thing as securely erasing the key with
an overwrite so my question is can the "deleted" key be recovered?

No, in the firmware a delete is a delete. It will be overwritten with
zeroes, end of story. You might be able to dig out some faint traces with
an electron microscope, but that's serious paranoia (and million dollar)
time.

Also SSD's use wear levelling so an overwrite may end up on a physically
different location on the flash NAND chips?

Drive encryption/Secure Erase is handled in the drive firmware, and I would
be very surprised if the firmware was dumb enough not to take account of the
wear levelling the firmware itself is doing.

Theo

SH wrote:
On 16/04/2021 12:33, Tim Streater wrote:
On 16 Apr 2021 at 09:26:50 BST, polygonum_on_google
wrote:

On Friday, 16 April 2021 at 08:50:03 UTC+1, SH wrote:

2. Your email client will have a PST file containing *all* your emails,
email addresses, email contents etc.

Many of us have not one single .pst file. (I have one - which is an
file last written in 2012! I think I might have used it to recover something
or other.)

What is a .pst file?



whenever you create/send or recieve an email and all your email folders
all get backed up to a *.pst file.

Well, depends on your mail program, mine certainly doesn't create
*.pst files! :-)

--
Chris Green
·

SH wrote

The solution to all of this is full disc encryption. Without the
password the disc is full of random noise.

Yes, Windows comes with Bitlocker. I am curious to know what the CPU
overhead is for decrypting on the fly the encrypted data on said drive?

Not enough to matter with the stuff you
dont want anyone else to be able to see.

If you are concerned about the disc falling into the wrong hands (on a
laptop, or at disposal time) then FDE will protect against that.

Is Bitlocker considered to be a FDE?

SSDs typically do FDE 'for free' - the raw flash
is encrypted, and a 'secure erase' is simply deleting the key from inside
the controller.

Thats interesting to know, why is FDE used on SSDs? I don't see it
advertised as a feature on the advertising blurb so it gives one the
impression that one needs to deploy FDE....

You dont see it advertised with laptops either but very few dont have it.

Deleting the key is not the same thing as securely erasing the key with an
overwrite so my question is can the "deleted" key be recovered?

It isnt anything stored anywhere.

Also SSD's use wear levelling so an overwrite may end up on a physically
different location on the flash NAND chips?

Not if you overwrite everything.

No angle grinders needed.

"Tim Streater" wrote in message
...
On 16 Apr 2021 at 09:08:55 BST, Adrian Caspersz
wrote:

On 16/04/2021 09:01, SH wrote:
Plus once an attacker has your details, they can make themselves *far*
more convincing when they phone you and say Hello Mr/Mrs/Miss XXXXX, I'm
from (high Street bank), we've detected suspiscious acitivity on your
bank account number XXYYZZ, we see its a joint account with youe spouse,
Mr/mrs XXXX and we see you have a pension plan with Pension provider
from the direct debits etc etc......

I see you use Windows*. "They" probably already have your data.

Just joking....

If they're using Windows its essentially a certainty.

Bull**** it is, no one has mine.

On Sat, 17 Apr 2021 02:26:38 +1000, %%, better known as cantankerous
trolling senile geezer Rodent Speed, wrote:

FLUSH the trolling senile pest's latest troll**** unread


--
Marland answering senile Rodent's statement, "I don't leak":
"That¢s because so much **** and ****e emanates from your gob that there is
nothing left to exit normally, your arsehole has clammed shut through disuse
and the end of prick is only clear because you are such a ******."
Message-ID:

On Sat, 17 Apr 2021 02:16:07 +1000, %%, better known as cantankerous
trolling senile geezer Rodent Speed, wrote:

FLUSH the trolling senile asshole's latest troll**** unread

--
The Natural Philosopher about senile Rodent:
"Rod speed is not a Brexiteer. He is an Australian troll and arsehole."
Message-ID:

On 15/04/2021 20:02, SH wrote:
Whenever I wish to sell on of a hard disc, I *always* do a secure
overwrite using a variety of software tools, such as DBAN (Darik's Boot
'n' Nuke)and it gets securely erased to DoD standards..... before it
leaves my hands..... So my personal and financial data does not get
exploited by ne-er do wells....

I had 2 off 40 GB and 2 off 500 GB hard discs that either had the click
of death or was not "present" in the BIOS attached drives autodetection
list.

So Using DBAN was clearly out of the question on any of these 4 drives
and I could't even sell them on for spares or repair as it still had my
digital data on it.

The last time I had to securely destroy a disk, it had glass platters
coated in a magnetic metal oxide.Â* They were *easy* to destroy, with a
lump hammer!

So today I set to work with these 4 failed drives which are 7,200 rpm
versions

Got my battery powered screwdriver and remmoved all the Torx screws
including those under the stickers.

PCBs was successfully removed from all 4 drives and tossed into WEEE bin

The metal Lids was also successfully removed after breaking the hermetic
seal from all four and tossed into WEEE bin.

The torx screws were removed for the read/write heads on swinging arms
and removed..... and tossed into WEEE bin.

Then the spindle annular rings have 6 torx screws, which are
successfully removed and tossed into WEEE bin....

I then remove the platters and I end up with 10 platters (3 form two
drives and 2 from 2 drives)

I then try and smash them with a hammer. just put a dint into the
surface so clearly not glass.

I use mine as beer mats!

This suggests they could be aluminium:
https://en.wikipedia.org/wiki/Hard_disk_drive_platter

I then get the chop saw out with a metal cutting blade... Blunted the
brand new blade.

I then get the HSS drill bit set out and the pillar drill..... The HSS
drilsl won't touch it......

Then I the favoured uk.d-i-y nuclear option... a grinder!

I take the platters to my bench grinder..... the grinding wheels are
blunted and you can see streaks of metal embedded in the discs from the
platters.....

I didn't have a professional grade degausser unit so that was not an
option open to me.....

Given these are written to by heads with relatively low currents, I
would have thought a strong magnet pulled over the disc might be effective.

So I think long and hard about what other methods are open to me to
securely destroy the platters....

My first thought was heat, and most materials have a curie point. I then
looked up cobalt alloy as used on platters and I see it has a curie
temperature of 900C.

I then fill up the garage sink with water after putting the sink plug in.

I use a pair of mole grips to hold the disc platter by the edge and
light my MAPP blowtorch...

I apply the blue flame to platter and then finally manage to melt the
platter and watch molten droplets of metal drop off into the sinkful of
water...

So likely aluminium.

Rinse and repeat 9 more times....

1 empty bottle of MAPP gas later, the metal granules are now in the WEEE
bin!

RESULT!

Well done!

On 15/04/2021 20:02, SH wrote:
I use a pair of mole grips to hold the disc platter by the edge and
light my MAPP blowtorch...

I apply the blue flame to platter and then finally manage to melt the
platter and watch molten droplets of metal drop off into the sinkful of
water...

Rinse and repeat 9 more times....

1 empty bottle of MAPP gas later, the metal granules are now in the WEEE
bin!

You didn't have to go that far.

https://en.wikipedia.org/wiki/Curie_temperature

Andy

Theo wrote:

It's an 'enterprisey' feature but I don't know whether it's standard on
every SSD. It's pretty minimal overhead to do in the controller so I don't
see why not.

Seagate and WDC made an announcement at one point, that
drive level encryption would be implemented on *all* drives.
This might account for the need to swap a certain ROM off
the old controller board, when trying to use a new controller
board. Something on the controller board, has to match the
method used to write that set of platters. It requires
soldering skills to move the component from old board
to new, and assumes the component was not burned out
during a failure.

This is a guess on my part, as to why a ROM swap is needed,
as the controller chips had their own boot code inside and
should not need external storage like that.

ROM swaps weren't always required, and this is a more recent
development (maybe last ten years or so). On older disk drives,
you could swap controllers willy-nilly.


Drive encryption/Secure Erase is handled in the drive firmware, and I would
be very surprised if the firmware was dumb enough not to take account of the
wear levelling the firmware itself is doing.

Theo

There is Secure Erase and Enhanced Secure Erase.

The latter erases the SSD free pool as well.

On a HDD, Enhanced Secure Erase enables the write head
for every last data sector on the drive, whether spares or not.
It just wipes over the entire surface, hitting that
password that got "spared out".

The only area which cannot be written is the servo wedges,
and they only store the servo pattern, not data.

Paul

On 16/04/2021 08:54, SH wrote:

Yup all that, then repurpose the discs as coasters, having roughed up
the surface a bit / given them a wipe over with a neodymium magnet.


That won't fly with SWMBO, she will not recognise them as coasters and
would throw them in the bin.



Skip all the above dissassembly steps, place drive on concrete floor,
hit robustly with 14lb sledge several times. That is enough to bend
the entire drive, platters and all, so it can't be spun up or read by
any conventional method.Â* (Yes there is a fair chance that GCHQ or the
NSA might be able to get something back off them, but they are not the
folks I am trying to keep out!)

The Hard drive is based on arather substantial frame (most likely to be
aluminium. I'd rather direct the destructive energy onto the individual
platters otherwise, you can;t gaurantee the destructive energy *is*
getting through to the platters if you're hitting the entire drive.....

Plus some drives have multiple platters......

All you need to do is bend the thing, there is no way back from bent
platters without serious expenditure.


--
Cheers,

John.

/================================================== ===============\
| Internode Ltd - http://www.internode.co.uk |
|-----------------------------------------------------------------|
| John Rumm - john(at)internode(dot)co(dot)uk |
\================================================= ================/

"John Rumm" wrote in message
...
On 16/04/2021 08:54, SH wrote:

Yup all that, then repurpose the discs as coasters, having roughed up
the surface a bit / given them a wipe over with a neodymium magnet.


That won't fly with SWMBO, she will not recognise them as coasters and
would throw them in the bin.



Skip all the above dissassembly steps, place drive on concrete floor,
hit robustly with 14lb sledge several times. That is enough to bend the
entire drive, platters and all, so it can't be spun up or read by any
conventional method. (Yes there is a fair chance that GCHQ or the NSA
might be able to get something back off them, but they are not the folks
I am trying to keep out!)

The Hard drive is based on arather substantial frame (most likely to be
aluminium. I'd rather direct the destructive energy onto the individual
platters otherwise, you can;t gaurantee the destructive energy *is*
getting through to the platters if you're hitting the entire drive.....

Plus some drives have multiple platters......

All you need to do is bend the thing, there is no way back from bent
platters without serious expenditure.

Makes a lot more sense to use full drive encryption of the
data you care about if you are as paranoid as that fool is.

Most use laptops not desktops now and
virtually all laptops do full drive encryption.

On Sat, 17 Apr 2021 10:36:56 +1000, cantankerous trolling geezer Rodent
Speed, the auto-contradicting senile sociopath, blabbered, again:


Makes a lot more sense to

Not as much sense as you abnormal senile troll swallowing your Nembutal
finally, you useless senile pest from Oz!

--
Marland answering senile Rodent's statement, "I don't leak":
"That¢s because so much **** and ****e emanates from your gob that there is
nothing left to exit normally, your arsehole has clammed shut through disuse
and the end of prick is only clear because you are such a ******."
Message-ID:

On 17/04/2021 01:36, Rod Speed wrote:


"John Rumm" wrote in message
...
On 16/04/2021 08:54, SH wrote:

Yup all that, then repurpose the discs as coasters, having roughed
up the surface a bit / given them a wipe over with a neodymium magnet.


That won't fly with SWMBO, she will not recognise them as coasters
and would throw them in the bin.



Skip all the above dissassembly steps, place drive on concrete
floor, hit robustly with 14lb sledge several times. That is enough
to bend the entire drive, platters and all, so it can't be spun up
or read by any conventional method.Â* (Yes there is a fair chance
that GCHQ or the NSA might be able to get something back off them,
but they are not the folks I am trying to keep out!)

The Hard drive is based on arather substantial frame (most likely to
be aluminium. I'd rather direct the destructive energy onto the
individual platters otherwise, you can;t gaurantee the destructive
energy *is* getting through to the platters if you're hitting the
entire drive.....

Plus some drives have multiple platters......

All you need to do is bend the thing, there is no way back from bent
platters without serious expenditure.

Makes a lot more sense to use full drive encryption of the
data you care about if you are as paranoid as that fool is.

When the drives were first used, FDE was not aavilable at the time....
:-)

Obviously not so much an issue now with more modern OS's.....


Most use laptops not desktops now and
virtually all laptops do full drive encryption.