1

(How) Can I secure erase a single directory (or even file) on an SSD?

I'm returning a work laptop to my former employer that I was allowed to and did use for private matters. Normally colleagues just remove their data and not even their Windows user.

All my sensitive data is in my user folder, so I'd like to just secure erase that.

The SSD is a SanDisk SD6SB1m-128G-1006. SanDisk has a tool called SanDisk SSD Toolkit or SanDisk SSD Dashboard that does supports secure erasing. (Note that SanDisk calls clearing the mapping table secure erasing and calls the actual erasing of the blocks sanitizing, while I call the latter secure erase.)

My goal is to actually erase the user folder's data.

More information:

  • My OS is Win 10 1803 and the SSD is NTFS formatted.
  • The disk is Bitlocker encrypted
  • The computer is part of a windows domain
  • The company heavily customized the Windows installation w/ logon scripts, registry hacks, group policies (which are synced however) and whatnot
  • Creating system images is disabled
  • I think I can boot from USB

I don't think it's worth the effort anyway, but could I create a disk image with a third party tool, which skips unassigned sectors/blocks?

Would restoring that image (after removing and recreating the BitLocker encryption) work if it skipped unassigned sectors/blocks?

Does Windows save critical information in unassigned blocks (and prevent drivers from overwriting it)? Or did only 90s copy protections do so?

  • You could migrate all your data to a single folder, enable EFS, generate the key then delete it from the system. This won't prevent data recovery of the unencrypted data though. Outside of encrypting the entire SSD, moving the files into the encrypted folder, then decrypting the entire drive what you want isn't possible (in the context of being worth while and secure). – Ramhound Aug 29 '18 at 15:51
  • You can't just "clean a directory" - you will have to delete the directory and clean all unused regions of the device. Files move around on disk over time and normal use (create / edit / delete / etc...) - this happens even more so with SSDs. – Attie Aug 29 '18 at 15:53
  • I added some information in my question – Michael Meier Aug 29 '18 at 18:48
  • The only way to truly do this in a secure manner is to rebuild the drive with a different key but without the data you want to get rid of. – Austin Hemmelgarn Aug 29 '18 at 19:09
1

I'm 'porting' this from standard macOS advice, but the principle is the same, whatever platform.

Apple removed secure erase because it was actually insecure.

The 'modern' way to do it is to have an encrypted drive.
Delete the unwanted data [& empty Trash/Recycle], then decrypt the drive.

There is no way it can be recovered after that, as the encryption keys are no longer present.

| improve this answer | |
1

The disk is Bitlocker encrypted

Good. This means the data you want securely erased is already encrypted. All that remains is to destroy the encryption keys which will render the data unrecoverable. Here's how to do this on your volume which is currently BitLocker-encrypted:

  1. Delete the data you want to erase. Empty the Recycle Bin.
  2. Turn off BitLocker and allow it to fully decrypt the drive.

    Note: Check this by running manage-bde -status from an elevated command prompt and observing that the fields shown here match the screen shot: enter image description here

  3. (Optionally) Turn BitLocker back on.

When you completely disable BitLocker on a volume, the Full-Volume Encryption Key (FVEK) used to encrypt the disk's sectors is deleted. So, even if there are bits remaining on the SSD from the data you deleted (and there almost certainly are), they are encrypted with a key that no longer exists.

Warning! Changing the volume's key protectors (e.g. a PIN, Recovery Key, TPM) does not change the FVEK. And only deleting the FVEK is sufficient to permanently prevent access to data encrypted with said key.

Additional Information

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.