Memories of a Media Card 266
twistedmoney99 writes "Anyone who has upgraded their digital camera probably has a few older, incompatible media cards lying around — so why not post them on Ebay? Well, if you do, be sure to properly wipe them because the digital voyeurs are watching. Seth Fogie at InformIT.com purchased a bunch of used cards from Ebay and found recoverable data on most of them. Using the freely available PhotoRec application, he was able to extract pictures, movies, and more from apparently formatted cards. The picture is clear — wipe anything that can store digital data before getting rid of it."
I don't even bother to erase mine. (Score:5, Funny)
Re:I don't even bother to erase mine. (Score:5, Funny)
(Just kidding!)
Re:I don't even bother to erase mine. (Score:5, Informative)
(Just kidding!)
He'd need a zoom lens if he were very tall - or if otherwise his dick or parts of it were very distant from the camera.
If it were small, he'd want a macro lens.
Re:I don't even bother to erase mine. (Score:5, Funny)
You seem to speak from experience...
Re: (Score:2)
or a magnifying glass.
Re: (Score:3, Funny)
Do they fight over the microscope as well, or is it usually pretty orderly?
Re: (Score:2)
The joke's on them. AC's camera was only 2 megapixels!
Re: (Score:2)
Re: (Score:3, Funny)
Re: (Score:3, Funny)
same old story (Score:2, Insightful)
Re: (Score:2)
Re: (Score:3, Funny)
Re: (Score:3, Funny)
Re: (Score:3, Funny)
speaking of wiping data (Score:2)
Re: (Score:2, Informative)
Re:speaking of wiping data (Score:5, Informative)
Better (and more convenient) than dd'ing from /dev/urandom is wipe(1). It will, at your option, overwrite the disk using 34 different byte patterns, 8 of which are random.
Its man page is also the only one I know of that uses the phrases "rising totalitarianism", "Department of Homeland Security", and "THIS IS AN EXTREMELY DANGEROUS THING TO DO".
Where have I seen those before? (Score:2, Funny)
Doesn't "man woman" also use those phrases? And for good reason, too...
unnecessary (Score:3, Informative)
Re: (Score:3, Informative)
http://en.wikipedia.org/wiki/Gutmann_method [wikipedia.org]
Re: (Score:2)
Re: (Score:2)
Re:speaking of wiping data (Score:5, Insightful)
As for erasing solid state media, I'd feel perfectly safe simply overwriting it with zeroes, one time over.
I realize years ago magnetic media were written sparsely (inefficiently) with sloppy positioning mechanisms, but those days are long gone. I'd be really impressed to see somebody recover overwritten data on a hard drive instead of just talking about it.
As for flash memory, I'll believe it when I see it.
As for leaking information through discarded camera memory cards in the first, place, it's about the 1000th thing down my list of privacy concerns, way down below "binoculars." If you want to see pictures of random people's snapshots of each other, they're all over the web. How many of us really use our digicams to capture super-secret info? I just can't bring myself to care when I know databases of thousands of credit card numbers and SSNs are being bought and sold on the black market.
Re: (Score:2)
I don't think any magic whizbang stuff is needed, the vast majority of these devices are FAT filesystems where undelete.exe can recover deleted files. Or they do "fast formats" which just write out a new file allocation table without actually erasing any of the data (Not sure if the "full format" actually writes over data either, Microsoft's KB says the difference is that the full format scans for bad sectors).
Re: (Score:2)
Re:speaking of wiping data (Score:4, Informative)
In a nutshell, for hard drives, "If commercially-available SPM's are considered too expensive, it is possible to build a reasonably capable SPM for about US$1400, using a PC as a controller". So it is in the reach of the hobbyist to recover up to around the last 20 items recorded on any magnetic media (easier for floppies, harder as drives become denser). On solid state memory, I believe an electron microscope is needed for analysis. Still, data that has been in one location in RAM for more than five minutes is in theory recoverable.
Re: (Score:2)
Re: (Score:3, Interesting)
> simply overwriting it with zeroes, one time over.
For most purposes, this might be perfectly enough.
Certainly an "all-zero" overwrite is far better than a "all-one" overwrite (flash erase operation). But then again it also depends on the controller, because what ends up in the floating gates is what really counts.
See link (below) for some techniques to recover erased or overwritten flash memory. The basic idea is to measure the trapped charg
Re: (Score:2)
Re: (Score:2)
Should the memory not have single bit writability, then an erase to FFFF followed by a write to 0000 and an erase back to FFFF is sufficent. This is because the data is not stored in magnetic domains, so simply ensuring all cells are written makes the charges on the cells fairly equal, the following erase operation and post erase repair that happens will obfscuate any remaining
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Unfortunately, the Patent Office is not exactly the gateway of quality you seem to think it is. Here's a link to Patents for Unworkable Devices [lhup.edu], featuring a dozen perpetual motion machines that have slipped through the Patent Office's "no perpetual motion machines" rule. Lest you think this is ancient stuff, one of the most recent patents was granted in 2002.
Just because the NSA has patented a recovery devic
Re: (Score:2)
It's slow, but probably not much slower than using dd manually.
Re:speaking of wiping data (Score:5, Funny)
Re:speaking of wiping data (Score:5, Funny)
Have Chuck Norris give it a roundhouse kick.
Strong encryption with a 1-time key (Score:2)
Re: (Score:3, Informative)
{sigh} This has been discussed before. The DoD's standards for highly classified computers amounts to a very large hole-punch and an incinerator. The "standards" you refer to amount to the wiping they do on receptionist and non-classified computers.
Re: (Score:2, Funny)
Re: (Score:3, Informative)
Time to use Eraser! (Score:3, Insightful)
Re: (Score:2)
Memory effect (Score:5, Informative)
1. Delete everything on the card.
2. Fill the card with something not private (maybe a text file that just repeats the same character).
3. Delete everything on the card.
4. If you're paranoid do 2 and 3 again.
If you don't have a computer handy, you can accomplish step 2 by taking photos of a blank sheet of paper or a lenscap or something of that sort.
Re: (Score:2)
1. Delete everything on the card.
2. Fill the card with images from certain sites every slashdotter knows about.
I highly doubt anyone will have the desire to recover anything after that.
shred for Linux users (Score:2)
Re: (Score:2)
BULLSHIT! If you write all zeros, then ones, and back to zeros again accross the entire drive (technically a mid-level format, a true low-level erases the servo tracks and renders the drive useless), you can NEVER, NEVER, EVER recover the data.
Please, stop spreading this myth. It's BS!
Sure. Write something incriminating to a hard drive, perform your procedure of choice then hand the drive off to your local neighborhood police data recovery lab. If you're in the neighborhood, hand one off to your local federal branch of investigators and have them give it a whirl.
Make sure your first phone call has access to a computer so they can let us know how it went.
Re:Memory effect (Score:5, Interesting)
The fact that I know people who work in criminal forensics labs and recover data for a living aside, you're obviously set in your opinion. I know however that they can recover data from drives that are more seriously mangled than a simple three pass overwrite. If you want to bet your money or your freedom on your opinion that's one thing, but is it too much to ask that you stop posing yourself as some kind of expert on the subject until you become further educated on the subject?
An aside, BTW; I'm tired of reading of the so-called "DoD specifications" for wiping a hard drive. Yes, they exist in the form of software tools etc. but they're for NON CLASSIFIED DATA ONLY. For top-level classification their specification to ensure data destruction remains to this day in the belly of an incinerator. If you don't want a casual user to recover your data with freely available tools and a few hours of spare time the utilities and methods posed will work just fine. If, however, you don't want your {insert law-voilating material here} to be found by actual law enforcement agents, you'd be best served to turn your hard drive and all memory devices into a molten pile of materials and let them have at it.
Re: (Score:3, Funny)
For top-level classification their specification to ensure data destruction remains to this day in the belly of an incinerator.
One question, though: how do they know how to destroy data properly, if the specification's been destroyed?
Re: (Score:2)
Why do so many industry professionals seem to suggest you need 7 passes?
Utlimately the hard drive is an analog device. When you write to it, you change the magnetic charge on small areas of the platter. I find it hard to believe that there wouldn't been some residual charge left from the previous data.
Recoving it wouldn't be easy, but i would think you could turn of error correction and repeatedly read the area looking for any statistical anomoly. The other obvious solution wou
Re: (Score:2)
Re:Memory effect (Score:5, Informative)
The NSA today (and other people) can use Magentic Force Microscopy to extract enough detail to reconstruct what used to be on the drive. With only one or two overwrites, a sensitive oscilloscope could suffice.
Here's one paper from ten years ago that talks more about the recovery technique.
http://www.usenix.org/publications/library/procee
From the paper:
"In conventional terms, when a one is written to disk the media records a one, and when a zero is written the media records a zero. However the actual effect is closer to obtaining a 0.95 when a zero is overwritten with a one, and a 1.05 when a one is overwritten with a one. Normal disk circuitry is set up so that both these values are read as ones, but using specialised circuitry it is possible to work out what previous "layers" contained. The recovery of at least one or two layers of overwritten data isn't too hard to perform by reading the signal from the analog head electronics with a high-quality digital sampling oscilloscope, downloading the sampled waveform to a PC, and analysing it in software to recover the previously recorded signal. What the software does is generate an "ideal" read signal and subtract it from what was actually read, leaving as the difference the remnant of the previous signal."
THANK YOU. (Yelling deliberate, mods +1 parent) (Score:3, Insightful)
From the paper: (blah blah blah)
I don't normally waste bandwidth or other resources commenting this way ("Me too! Me too!"), but I have to tell you that was the most kick-ass summary and explanation of the problem. Thank you for knowing an intelligent and concise technical reason for seemingly (and massively) redundant re-writing, thank you for having it handy, thank you for citing the most useful passage, and thank you for posting.
Damn, I never have mod points when I need them. I'd have dumped all of
Re: (Score:2)
Would an eraser work better if it read the original contents and then adjusted what it wrote to leave misleading levels of magnetism behind?
Re: (Score:2)
No, the best bet is multiple passes of random data for several reasons. One is that a really sensitive check of the drive can actually potentially tell what all of the last several states were for each block. 1,0,0,1 will leave a slightly different field strength at a bit from 0,1,0,1 for example, so it's hard to mislead these techniques. Another is that if a certain
Re:Memory effect (Score:5, Interesting)
Modern drives now have data densities two orders of magnitude higher than those on which he did his research. Many of those stray effects have been largely eliminated by higher precision electronics.
Picture in your mind how a hard drive works: the head swings left-and-right, and feedback from a servo track tells the arm when it's centered over the desired data track. In the old days, that arm just had to be close enough. Reading overwritten data worked by checking the area around a bit to see if there was evidence of other bits written when the arm was in a different position. This shows up as higher or lower signal strength.
All that slop was robbing the drive of potential places to store data. By making the mechanics more precise, manufacturers are able to squeeze more cylinders onto a platter, and bits on a track. The slop Peter was able to discover has been largely eliminated.
Re: (Score:2)
Ummm... You've never bothered to look up the rules for a DoD wipe, nor the reasons for those rules have you? The executive summary is >5 passes of random data for anything particularly sensitive, because your plan doesn't
dd /dev/random (Score:4, Informative)
Re:dd /dev/random (Score:4, Informative)
dd if=/dev/zero of=/dev/mem_card_node bs=256k
If you want to be extra-friendly to the card's buyer, write a new partition table to the card after wiping it and format it for FAT32.
Schwab
Re:dd /dev/random (Score:5, Funny)
Here, have some of mine: ldjaofp9 bpm ]ak e]-07
Re: (Score:2)
Here, have some of mine: ldjaofp9 bpm ]ak e]-07
Huh. Somehow I *knew* you'd write that.
Re: (Score:2)
Only cards over 2GB should be formatted FAT32. FAT16 supports partitions up to 2048MB and most devices will not read a FAT32 filesystem - typically, though, anything that supports devices larger than 2GB can and does use FAT32.
Re: (Score:2)
RE: you then need to reformat the memory card (Score:2)
I do this all the time when I want to save an image of a partition using Ghost in sector-copy mode. I have an equivalent utility I wrote in Batch for Windows. All those zeroes compress quite well. ;)
Anyway, analysis of the remaining FAT may reveal some of your old filenames, but not the data in them.
Stolen? (Score:2, Insightful)
After reading the article, I wondered how many of these cards are actually stolen?
And I don't mean Pamela Anderson and Tommy Lee stolen either.
My dead hard drive... (Score:3, Funny)
Anyway, I didn't want to release said material to the general public at [insert HD manufacturer here], so I abandoned any warranty recovery and just physically destroyed the drive. So much for that $100.
Re: (Score:2)
Ron
Re: (Score:2)
Re: (Score:3, Funny)
For The Pervs (Score:2)
I'm wondering what a card will go for if it's advertised to *still* have pictures and data on it?
Kind of like a mystery grab bag?
Re: (Score:3, Funny)
Card not wiped because people don't care (Score:5, Insightful)
Re:Card not wiped because people don't care (Score:4, Insightful)
I can see the thought process going from "crap, I left some photos on there" to "eh, they're already on Flickr anyway." Unless there are photos that they haven't already downloaded, there's less motivation to track down something that will read (and erase) the card.
Exactly, I question the premise (Score:4, Insightful)
In addition, the fact that some of the cards contained undeleted images is a bit disconcerting. At a bare minimum media card owners should have deleted the viewable images.
Why? Why should they have, if they don't care who saw them? As they said, the images were all of clothed people and disney world and things, worth nothing to anyone but the owner.
Privacy just for the sake of privacy seems to have taken hold of too many people, who do not stop to think - is there any point to privacy in this instance?
Obviously if people did not want images being seen they should remove them; I just object to catiioning users against leaving images with the vague fear that "someone may see thier images" when that may not matter at all.
Testing the best erase method? (Score:3, Interesting)
What I would like to know is what the most effective method is. Someone should take a bunch of these cards (and harddrives etc) and do a little controlled test to see how much of a photo/file is recoverable after one round of dd, after 10 rounds of dd, etc. In short - what's the most effective (time v.s. security) method for cleaning these things?
Re: (Score:2)
That depends on whether you want the card to be usable afterward...
Re: (Score:2)
Writing a word or block in one of those devices means:
- Erase the word/line/block to 0xff if necessary (i.e. if there are bits that need to be flipped to 1)
- For each bit that is to be set to 0,
-- bang on it with a pulse until it turns 0
-- b
Re: (Score:2)
Except for that 5% slack space behind the scenes used for wear-levelling (it's done in hardware now, no need for file systems like JFFS). I guess if someone was keen enough they could decapsulate the card and scrutinize the memory chip under an electron microscope to try to image what's been previously written in that 5% but who'd actually bother?
C'mon people, this is just an alarmist article. It's not like the military is going to put something sensitive like Launch Codes on memory cards and then sell the
NASA's methodology (Score:4, Interesting)
On a side note: When I first started working at NASA we had a budget of well over a million dollars. We got rid of all of the really big mainframes, and minis, and went to micros. Our budget was reduced to somewhere around $500,000.00 a year (about a third of what we originally were given each year). What I'd like to know is - whatever happened to all of that money? We certainly never go pay raises which equaled the amount of money lost. So where did it go? The answer might be a bit more surprising than anyone really wants to know about.
Re: (Score:2)
Interesting. I would rather trust a utility like Darik's Boot & Nuke than trust UPS or FedEx to actually get the drive to the centralized location. If UPS or FedEx fails, somebody might end up with a drive with NOTHING erased.
Why not post them on eBay? (Score:3, Insightful)
Aren't there data recovery services that recover data from supposedly wiped media (hard drives, memory cards, etc.)?
Besides, how likely are you to to make back the listing fees on used media? Given how the prices are coming down, why would you buy used when you can buy new for only a little more? Brand new 1 GB CF is going for $10, why buy used?
I would be worried that I would lose money selling used memory media on eBay; it would make more sense moneywise to just smash them with a hammer; get some exercise, and anything that was on them is now unrecoverable.
Who cares? (Score:3, Insightful)
I erase my old media with a sledgehammer. Try to recover that, bitch.
Re:Who cares? (Score:5, Insightful)
Used items that are still in demand should be reused as much as possible, to reduce the demand for manufacturing these items (with all the power and waste involved in that) and the size of landfills.
Re: (Score:2, Insightful)
Re: (Score:3, Insightful)
Throwing away or destroying manufactured items when they are working and reusable is irresponsible, because it does not attempt to minimize environmental impact.
And burning who knows how much gasoline in order to physically transport an object across the country that weighs something around 2 grams is not irresponsible?
What would be responsible is giving it to an acquaintance or selling it locally on something like Craigslist. Putting it on eBay and shipping it to somebody who may be thousands of mile
Re: (Score:2)
I mean seriously, the discussion shouldn't be about "proper erasure techniques that 99.999% of the public couldn't understand if they tried",
99.999% of the public probably can't imagine that I can still get it back after they've emptied the Recycle Bin on Windows 95-Vista.
it should be about not being such a tight-ass cheap fuck that you have to sell your old drives (flash / hard / whatever) on E-Bay. I mean, seriously, do you need to spend that much effort to net yourself an extra $5 or $10?
I sell o
Call me a packrat. (Score:5, Funny)
Why sell memory cards? (Score:2)
Debian Administration Page. (Score:3, Interesting)
Much of the information in the article about data recovery is also covered by DebianAdministration.org [debian-adm...ration.org]. TestDisk and photorec, are afterall, free software.
Hip, hip hooray!
Re: (Score:3, Interesting)
Duh (Score:2, Insightful)
Re: (Score:3, Interesting)
Aych tea tea pea colon slash slash dot dot org slash
h t t p : / / dot . org /
Unless your signature is advertising some link farming site, I think you have a missing slash.
Re: (Score:2)
Partially a Question, Partially a Comment (Score:2)
Realistically, when a new 1gb card is under $50 in the stores (and a quick froogle search showed some generics around $20), just how much is my 64mb Smartmedia card worth? How about my 16mb Compact Flash? ... For that price, it isn't worth the effort to try selling these antiquated cards.
Well, there is something else, too: what about users of devices which don't support larger cards? I don't know - I've never encountered a problem with SD (which is all I've used in portable devices - choose a platform an
Re: (Score:3, Interesting)
Re: (Score:2, Informative)
The DOD already answered this question.
Whenever there's any doubt, DOD standards are the way to go.
Re: (Score:3, Funny)
Re:Been there, done that... (Score:4, Funny)
Car Shredder (Score:2)
Yes, I'd love to see thermite destroy a hard drive.
Bah. Overkill. There's already a great video somewhere of thermite melting through a car. Likewise, one of the best things you can do is get rid of that Honda Civic in your driveway by stuffing it full of old hard drives and taking it to a serious (no car crushers, just a shredder) scrap metal place in your town and watching it go down the throat. Anyone who wants my old credit card numbers (which, BTW, are exclusively *expired*, no live ones get to any
Why you might care. (Score:2)
I take pictures, post it on my website, post it on flickr and hardly anybody sees it. What do I care :(
People who love you will one day get it, so cheer up.
Now, the reason you might worry about data deletion and privacy may have nothing to do with you personally. The best way to judge the harm done by snooping is to think of the worst thing it can be used for against someone who's fighting for your rights. See this post [slashdot.org] for information on harm done by previous domestic spying. Automated spying of tha