Hybrid HDD Security

[pedrolastiko]

Hi all
After a "secure data deletion" procedure i'm looking for a way to check if any data is still stored in the SSD part of my hybrid hard drive. Do you know if there is a way to check this part of the memory ? maybe JTAG or something else ?

Many thanks for your help!
Pedro

[Doomer]

unsolder the chip and read it

[HaQue]

JTAG should be able to do it as well, but you may run into issues such as JTAG disabled until you change something on the physical PCB, or disabled in software, missing components etc etc. This can and lead to a frustrating time that would better be served in other ways such as Doomer's suggestion, or other forensic analysis.

You might be able to access sectors through a serial port as well.

I doubt there is enough documentation in the public domain to help this, but if you do find any, please share
It depens on what methods the people you are attempting to sheild your data from are using.

For example, if no-one is ever going to open a book and read the contents, you only need to change the cover.

If you do a dd of the drive, check it with recovery tools, and come up blank, this could be good enough.

PS, not directed at the OP, but for all you criminals out there that want to get rid of data... If you criminal exploits do not gain you enough money to smash the hard disk to bits and buy another... it baffles me why you would be risking your freedom and reputation doing the crimes?

[dmarques]

First of all, according to your hdd manual, what does "secure data deletion" is supposed to do?

[pedrolastiko]

I apply the "wipe secure process" of my company, according the navso p-5239-26 (3 passes) of East-Tec DisposeSecure 2006.

But now that we have this new kind of hybrid hdd, i'm asking me how to check if all flash memory is correctly erase or not ...

Pedro

[deftrue]

You might still be able to read marked-as-defective sectors with specialized tools, or maybe through terminal. They are not securely erased in most or all cases, although (and because) reading and writing to them might be a pain. Sometimes, you can't even get the correct checksum and content is of dubious value.

Flash sectors might be truly erased if the erasing function is built-in in the drive.

[HaQue]

Is it your job to accredit certain recovery methods? Are you the guy that must say if this software still lives up to the standard?

If so, then you need to stop talking here, and go to the lab and do the tests. You must have written and verifiable test results to certify this type of thing.

Otherwise if you are not, then contact the software vendor and get a written statement from them that the software will or will not do the job.

Don't make more work for yourself

Judging by the software title including the year "2006" It doesn't look good...

BTW, some hybrid disks use flash for storage and some use it for cache. So not strictly 3 types of disks, SSD, Hybrid and Conventional..