Schneier on Security

Clive Robinson • January 3, 2025 4:05 PM

@ ALL,

A couple of points to consider,

1, Is possession circumstantial evidence.
2, How far down the stack does the erase process happen.

Prosecutors use anything and everything they can to try to get a conviction of some form (it’s why they tack those conspiracy charges on just about everything).

They will use the fact you have this OS/Program as evidence against you if you have it in your possession or even looked it up on the Internet, irrespective of if you have ever used it.

The way around this is by a “policy” in a binder for the reuse and disposal of drives with the stated aim of protecting against financial and other crimes such as Identity Theft and protection of IP etc.

There are all to many examples of Hard Drives turning up with confidential information on them at the equivalent of “car boot sales” etc. This happens all to often where people or businesses have “upgraded” computers. And other have purchased the PCs, “dumpster dive” them or receive them for charity. With the acquired PCs being “re-conditioned” or “stripped for parts” before “selling on” or “donating through charity” etc (I help a Charity from time to time and what I see on PCs quite often would shock you and I don’t just mean NSFW files).

Thus it is “Good PC Hygiene” to plan in advance, and make a folder up detailing the Who, Why, Where, and How of the “cleaning” and “restoration” process where you re-install the OS, Drivers, Apps, and Data.

Thus possession of such a tool can be shown to be a “prudent behaviour” and part of a well instituted business or personal “Protection against crime” process. Just like putting bolts and locks on doors and windows, and most certainly not an indicator of “criminal intent” etc a prosecutor might try to leverage.

So my other concern is just how far down the storage stack this software goes. The documentation does not say, however the use of Linux suggests not as far down as might be needed.

The thing is semi-mutable memory like magnetic media and Flash memory used in modern consumer and commercial storage devices is not “top notch” in fact a lot of it could be viewed as “scrapings from under the barrel” and it’s reliability not what you might hope (there’s also environmental factors where the very high density very small device sizes can get zapped by particles from radioisotope decay).

The storage device manufacturers thus add extra storage that can be swapped in as a replacement when errors are detected from a storage block. This swap is done automatically by a microcontroller on the storage device it’s self, often in a very proprietary way. That is well behind and below where the storage device appears in the stack to the PC interface the PC Thus is effectively invisible to the PC it’s device drivers and OS, but not to a forensic investigator with the right tool set.

So data that does not get wiped by this tool may remain on the storage device.

Is there a way around this problem?

Well sort of…

If you encrypt your hard drives from first use, then any apps or data “You Add” will be encrypted.

Does this keep it secure?

Yes and No it depends on where the encryption keys are and if you can access them or not.

For a computer to boot from an encrypted drive it obviously needs the “Key Material”(KeyMat) which means one of three things,

1, The KeyMat on the drive.
2, The user has to type it in in some way.
3, The KeyMat is in a “Hardware Security Module”(HSM) or similar on the PC or Network.

The first suffers from the issue, it might end up in one of those “bad sectors/clusters” that have been swapped thus much or all of it might turn up in forensic examination. A way to reduce this is a form of key splitting where you break the key down into N parts, distributed around the drive where M of them are required to build the key. Oddly if done right this improves not just your security, but reliability as well.

The second suffers from “Human Issues” and even long pass phrases rarely provide sufficient entropy. And the ability of “jo(e) Average” to be able to remember more than 16bits of entropy being quite questionable as so many Password Cracking competitions have shown.

The third has the advantage that an HSM can be put on a Smart Card or similar that plugs into the PC this can usually store multiple keys with full entropy with relative ease. However remember you are just “shifting the problem” when it comes to Law Enforcement Organisations, they can compel in various ways to have you access any HSM, and mostly the legislation is written so the “burden of proof” is on you to show beyond all doubt that you can not provide the encryption key or access to it.

Whilst there are ways this can be done, and I’ve mentioned them in the past few will be able to do such things in practice both mentally and materially.

There are times when a very old 8088/6 PC with a floppy disk drive and a Centronics interface dot matrix printer can be your friend. That is the floppies are fairly easy to erase permanently across the entire surface and neither the PC or Printer has storage that survives beyond a few moments of power off. You can build similar with equipment that is pre 1995 but the following decade saw changes and no PC after 2005 can be considered as being able to be made secure by the average person or even Techie.

Worse the likes of Microsoft and Apple are going down two paths,

1, Client side scanning.
2, Pulling all user data into the cloud.

This leaves few options for those that actually want some modicum of privacy against attackers out for any kind of gain they can make.

Remember even “End to End Encryption”(E2EE) on communications is fairly useless protection with what Apple and Microsoft are in effect forcing on users.