• CubitOom@infosec.pub
    link
    fedilink
    English
    arrow-up
    3
    ·
    2 days ago

    I’m not sure how that works, does it actually do a ‘dd’ with an overwrite (which takes a while) or does it just delete data which can be easily recovered with forensic tools?

      • CubitOom@infosec.pub
        link
        fedilink
        English
        arrow-up
        1
        ·
        2 days ago

        I’d have to read their wiki but going off that description, it sounds like a permanent delete of files but not an overwrite, so most of everything would be easy to recover with FOSS tools.

        It would be better than noting but if a state actor got your personal phone I don’t think that would prevent your data from getting into their hands.

        • black0ut@pawb.social
          link
          fedilink
          arrow-up
          1
          ·
          2 days ago

          I’m going off of an informed guess, so don’t quote me on this one. But it could be irrecoverably deleted.

          Usually phone storage is encrypted, and it gets decrypted with your PIN. The whole file isn’t actually encrypted with the PIN, it uses way more secure passwords, and it uses different passwords for different pieces of the data. Those passwords are basically impossible to crack, and even if you cracked one, you’d get a very small piece of all the data. Of course, you can’t memorize all those, so they get stored in a sector called the encryption header. That sector is what the PIN decrypts, and everything else is decrypted with the passwords in the header.

          Most of these “quick deletion” systems don’t even delete anything from the drive. They just delete the headers. They’re small enough that you can overwrite them multiple times in a very short time, so you can properly blank them. Without the headers, the rest of the drive is virtually impossible to decrypt, so the data is as good as gone.