Viewing a single comment thread. View all comments

Defleurville t1_iy3k9vj wrote

Note that different types of storage handle things slightly differently.

Magnetic storage (HDD, floppies) cannot delete files, it can only overwrite them, so the space will never stand empty.

Flash storage (SSD or a memory stick) will actually delete the file (or parts of the file) at some point (but you won’t know when) and may leave space empty for a while.

Re-writable optical storage (DVD-R) will basically wipe disc contents when you erase it (but is really bad at deleting individual files).

RAM (there are some circumstances where you can delete a file from RAM, such as when using a RAM disk) will retain the file “inaccessibly” until it is either overwritten or the RAM loses power, which causes it to lose all contents.

Note that in every case, “inaccessible” just means harder to access. If the data is there, there are ways of reading it.

3

Kientha t1_iy3m2ka wrote

And this is why flash storage devices are a nightmare for forensic purposes. With magnetic storage, you can attach a write blocker and know the data on the drive won't change so you can compare hash values and verify nothing changed. Flash memory however will randomly change data so you can't rely on hash values to prove nothing has changed

2

Defleurville t1_iy3uvx0 wrote

Another precision for other readers, which I assume Kientha knows, is that when speaking of computers, “randomly” never means randomly, as computers are incapable of doing anything at random (even electronic slot machines aren’t random).

In some cases, in means “not in sequential order”: We don’t continue reading a dictionary from where we stopped last time, but we do go in looking for a specific word, not pop it open and read whatever’s on the page. In computer terms, despite not being at all random, this is called “random access”.

In other cases, it means “made to appear random to a human”. Computers can easily generate values where users can’t tell what it will pick next, but under identical circumstances (the “seed”) it will pick the same values in the same order every time. We generally “cheat” by incorporating the time (down to the millisecond) into generating the numbers, so it’s mostly unpredictable.

Changes in Flash data aren’t random, they’re 100% deterministic and predictable (knowing all the info): they’re just not readily predictable to a user, which is functionally basically the same.

4