"Reset device" does not really clear device memory
Hello,
in the light of a recent study I stumbled across (link) I was curious whether the "Reset device" functionality of Jolla/Sailfish fully clears the flash memory of the device so that no data can be recovered. What I did was copy a large text file with a known, repeating text on the device memory, clear it using the built-in "Reset device" function and afterwards grepping for the file's contents in /dev/mmcblk0p28 (using "grep -a" in order to treat it as a text file). In short, the text could be recovered just fine, leading me to the assumption that basically all data can be recovered if it was not overwritten by pure luck. Grepping for something else, for instance URLs I was browsing before the reset, I was also able to find occurrences, together with website contents, probably from some browser's cache.
My questions would thus be: (1) Is this the way it's supposed to be? (2) Should this circumstance be made clear to the user using the reset functionality? Since knowing this before e.g. selling a device would probably be helpful.
This is a very simple google-able question and applies to any storage device, companies destroy harddrives physically as you actually cannot make sure that not in X days someone finds a way to recover a magnetic drive after it has been wiped. This is a general problem in thinking! BUT to support you there, I don't know about current release but the first couple of resets I recognized that the phone was still able to pair with pre-reset setup BT devices, even those requiring a PIN (those without PIN will work until you reset the BT devices).
chemist ( 2015-05-27 12:01:34 +0200 )editAs far as I can tell the OPs questions were whether this is the way it is supposed to be and more importantly if there - at least regarding the UX - should be changes made. I don't really see how "this is a very simple google-able question". I would definitely argue for a warning message - especially now that I heard your BT-pairing-story ;)
Paul Hilbert ( 2015-05-27 12:15:53 +0200 )edit@Ochi so simple yes/no, 1) yes this is standard behaviour - close to all storage capable devices on the world work like this, there are devices though like new SSDs that have a writing algorithms that require a key that can be changed by a simple softwarebutton - everything else is "unsafe" 2) this isn't common knowledge but actually should be, so no, no warning needed otoh if you want Jolla to stand out, an option to securely erase the device would be nice - then otoh we are waiting for device encryption and makes everything I just said obsolete. If you really expect that a factory reset device is wiped clean you probably also believe that google does not track every step you make or that governments spy to protect people
@Paul Hilberthttp://lmgtfy.com/?q=safe+factory+reset&l=1 if you care about it you probably look it up, if you don't care you deserve someone else viewing your private p0rn collection!
chemist ( 2015-05-27 14:43:54 +0200 )editSo in order to find out if Jolla does what we as a community would expect from a community-focused project such as the jolla phone I google how Google fails to inform me about insecure measures? I kinda have the feeling you didn't get that my remark was about what "we" (as some weirdly patriotic isomorphism to jolla) should do, not how to find out what Google does.
And btw: "then otoh we are waiting for device encryption and makes everything I just said obsolete". This is not true at all. Regarding usage contexts unsafe storage and secure erasure are not mutually inclusive: One is for intentional and the other for unintentional losses of the device - not that I wouldn't want that LUKS encryption asap.
And btw #2: "If you really expect that a factory reset device is wiped clean". Cannot speak for the OP, but I would like to expect that Jolla does not tell me that it would wipe it clean but rather the opposite. If jolla does not inform its users that the cake is a lie - who would? Edward? He's kinda busy atm.
Paul Hilbert ( 2015-05-27 15:36:31 +0200 )editEhrm yes, had me laugh! So sure, Jolla can make a difference by educating everyone - WARNING, device factory reset does not safely erase user-data. Take other measures to wipe user-data, please. AWE nice (LUKS), but how about it solves both problems if setup as the default state - so what you think is there for your pleasure does actually solve this problem too... so if you think that Jolla can solve all problems the world has (phoneOS wise) at once, how about this -> Jolla does not solve anything yet - the system is still beta, we have a more or less reliable phone that is still struggling with btrfs and uSD support/quirks... I support Jolla for what it can be in the future but those 2 years in have me doubt that this future will be any time soon!
chemist ( 2015-05-27 16:36:15 +0200 )edit