• 1 Post
  • 99 Comments
Joined 2 years ago
cake
Cake day: June 15th, 2023

help-circle

  • The article kind of fumbles the wording and creates confusion. There are, however, some passages that indicate to me that the actual data was recovered. All of the following are taking about the NAND flash memory.

    The engineers quickly found that all the data was there despite Tesla’s previous claims.

    Now, the plaintiffs had access to everything.

    Moore was astonished by all the data found through cloning the Autopilot ECU:

    “For an engineer like me, the data out of those computers was a treasure‑trove of how this crash happened.”

    On top of all the data being so much more helpful, Moore found unallocated space and metadata for snapshot_collision_airbag‑deployment.tar’, including its SHA‑1 checksum and the exact server path.

    It seems that maybe the .tar file itself was not recovered, but all the data about the crash was still there.
















  • So the SSD is hiding extra, inaccessible, cells. How does blkdiscard help? Either the blocks are accessible, or they aren’t. How are you getting a the hidden cells with blkdiscard?

    The idea is that blkdiscard will tell the SSD’s own controller to zero out everything. The controller can actually access all blocks regardless of what it exposes to your OS. But will it do it? Who knows?

    I feel that, unless you know the SDD supports secure trim, or you always use -z, dd is safer, since blkdiscard can give you a false sense of security, and TRIM adds no assurances about wiping those hidden cells.

    After reading all of this I would just do both… Each method fails in different ways so their sum might be better than either in isolation.

    But the actual solution is to always encrypt all of your storage. Then you don’t have to worry about this mess.


  • I don’t see how attempting to over-write would help. The additional blocks are not addressable on the OS side. dd will exit because it reached the end of the visible device space but blocks will remain untouched internally.

    The Arch wiki says blkdiscard -z is equivalent to running dd if=/dev/zero.

    Where does it say that? Here it seems to support the opposite. The linked paper says that two passes worked “in most cases”, but the results are unreliable. On one drive they found 1GB of data to have survived 20 passes.