We have moved to a new Sailfish OS Forum. Please start new discussions there.
18

"Reset device" does not really clear device memory

asked 2015-05-26 23:13:00 +0200

Ochi gravatar image

Hello,

in the light of a recent study I stumbled across (link) I was curious whether the "Reset device" functionality of Jolla/Sailfish fully clears the flash memory of the device so that no data can be recovered. What I did was copy a large text file with a known, repeating text on the device memory, clear it using the built-in "Reset device" function and afterwards grepping for the file's contents in /dev/mmcblk0p28 (using "grep -a" in order to treat it as a text file). In short, the text could be recovered just fine, leading me to the assumption that basically all data can be recovered if it was not overwritten by pure luck. Grepping for something else, for instance URLs I was browsing before the reset, I was also able to find occurrences, together with website contents, probably from some browser's cache.

My questions would thus be: (1) Is this the way it's supposed to be? (2) Should this circumstance be made clear to the user using the reset functionality? Since knowing this before e.g. selling a device would probably be helpful.

edit retag flag offensive close delete

Comments

1

This is a very simple google-able question and applies to any storage device, companies destroy harddrives physically as you actually cannot make sure that not in X days someone finds a way to recover a magnetic drive after it has been wiped. This is a general problem in thinking! BUT to support you there, I don't know about current release but the first couple of resets I recognized that the phone was still able to pair with pre-reset setup BT devices, even those requiring a PIN (those without PIN will work until you reset the BT devices).

chemist ( 2015-05-27 12:01:34 +0200 )edit
3

As far as I can tell the OPs questions were whether this is the way it is supposed to be and more importantly if there - at least regarding the UX - should be changes made. I don't really see how "this is a very simple google-able question". I would definitely argue for a warning message - especially now that I heard your BT-pairing-story ;)

Paul Hilbert ( 2015-05-27 12:15:53 +0200 )edit
1

@Ochi so simple yes/no, 1) yes this is standard behaviour - close to all storage capable devices on the world work like this, there are devices though like new SSDs that have a writing algorithms that require a key that can be changed by a simple softwarebutton - everything else is "unsafe" 2) this isn't common knowledge but actually should be, so no, no warning needed otoh if you want Jolla to stand out, an option to securely erase the device would be nice - then otoh we are waiting for device encryption and makes everything I just said obsolete. If you really expect that a factory reset device is wiped clean you probably also believe that google does not track every step you make or that governments spy to protect people

@Paul Hilberthttp://lmgtfy.com/?q=safe+factory+reset&l=1 if you care about it you probably look it up, if you don't care you deserve someone else viewing your private p0rn collection!

chemist ( 2015-05-27 14:43:54 +0200 )edit
3

So in order to find out if Jolla does what we as a community would expect from a community-focused project such as the jolla phone I google how Google fails to inform me about insecure measures? I kinda have the feeling you didn't get that my remark was about what "we" (as some weirdly patriotic isomorphism to jolla) should do, not how to find out what Google does.

And btw: "then otoh we are waiting for device encryption and makes everything I just said obsolete". This is not true at all. Regarding usage contexts unsafe storage and secure erasure are not mutually inclusive: One is for intentional and the other for unintentional losses of the device - not that I wouldn't want that LUKS encryption asap.

And btw #2: "If you really expect that a factory reset device is wiped clean". Cannot speak for the OP, but I would like to expect that Jolla does not tell me that it would wipe it clean but rather the opposite. If jolla does not inform its users that the cake is a lie - who would? Edward? He's kinda busy atm.

Paul Hilbert ( 2015-05-27 15:36:31 +0200 )edit
1

Ehrm yes, had me laugh! So sure, Jolla can make a difference by educating everyone - WARNING, device factory reset does not safely erase user-data. Take other measures to wipe user-data, please. AWE nice (LUKS), but how about it solves both problems if setup as the default state - so what you think is there for your pleasure does actually solve this problem too... so if you think that Jolla can solve all problems the world has (phoneOS wise) at once, how about this -> Jolla does not solve anything yet - the system is still beta, we have a more or less reliable phone that is still struggling with btrfs and uSD support/quirks... I support Jolla for what it can be in the future but those 2 years in have me doubt that this future will be any time soon!

chemist ( 2015-05-27 16:36:15 +0200 )edit

2 Answers

Sort by » oldest newest most voted
4

answered 2015-05-27 21:18:45 +0200

Yo gravatar image

updated 2015-05-28 20:29:12 +0200

I'm just going to answer your questions as my opinion on this because 1) can only be answered by the designer and 2) is a question of opinion.

  1. Resetting is not erasing or wiping. So I think this is supposed to be like this. Unfortunately Jolla is mixing this up as well: They are using the words "reset device" and "clear device" as if they meant the same.
  2. I too think that it is essential (when not mandatory) to inform the user about that resetting the device will not permanently erase the data and it may be recoverable with end user tools.

I would like to see an option for wiping (or secure erase, call it whatever you want) in the settings.

edit flag offensive delete publish link more

Comments

4

The option's page title says: "Reset device", The actual button says: "Clear device". The info text below the button says "Clears everything from the device and […]". To me there would be no doubt my data is gone after pushing said button. So there shouldn't just be an added notice, but the text should be rewritten and clarified.

Fuzzillogic ( 2015-05-27 21:43:29 +0200 )edit

Thanks @Fuzzillogic for pointing that out. You are correct: Jolla mixes this up as well. Oh geez…

Yo ( 2015-05-28 20:31:32 +0200 )edit
3

answered 2015-05-26 23:35:35 +0200

lakutalo gravatar image

updated 2015-05-27 09:29:26 +0200

It is the same when you do a hard reset on an android device. It just reflashes the os image and restores basic software. If you want to wipe the flash you have to include formatting it, too. This is how it works on android. Steps for a device reset on your Jolla can be found here: https://jolla.zendesk.com/hc/en-us/articles/204709607-How-do-I-use-the-Recovery-Mode- but I guess you would have to manually delete your personal files before resetting and selling it.

edit flag offensive delete publish link more

Comments

2

you mean wipe the Flash ..

kimmoli ( 2015-05-27 08:41:30 +0200 )edit
1

sure - I guess it was a bit late already :) - corrected

lakutalo ( 2015-05-27 09:30:16 +0200 )edit
Login/Signup to Answer

Question tools

Follow
7 followers

Stats

Asked: 2015-05-26 23:13:00 +0200

Seen: 1,051 times

Last updated: May 28 '15