Viewing a single comment thread. View all comments

[deleted] t1_iy41j00 wrote

Reply to comment by Neuro0Cancer in eli5 How is computer memory deleted? by unlikemike123

[deleted]

0

AdmirableOstrich t1_iy470c2 wrote

There isn't really (official) publicly available software to do this, but depending on the storage technology you can often tell not only the current binary state of a memory bit but also the previous one.

As an example, we might say a bit is on if it is at 5V and off at 0V. However, real bits have voltages that vary quite a bit and we just threshold at (say) 2.5V. The actual voltages depend on (among other things) the previous state of the bit. If AB denotes a previous state A and a current state B, you might have something like:

00 -> 0.5V 10 -> 0.9V 01 -> 4.1V 11 -> 4.5V

Note that is doesn't quite work like this. The main point is that with dedicated hardware you can try to read data that has been lightly overwritten. This is why tools intended to purge data will overwrite many times with random bit sequences to minimize the chance of data recovery.

7

Alternative_Log3012 t1_iy4kkgi wrote

You won’t be able to do these sort of voltage reads in the standard OS the computer is running. I’m assuming you will need to remove the drive and put it into dedicated forensic recovery hardware. This could be even more difficult if your SSDs are soldered on like it most modern ultra books.

1

tim36272 t1_iy439pq wrote

Programs like Recuva do it for you. In the basic mode it is just reading all the entries that are marked as deleted.

2