246
Why ‘deleted’ doesn’t mean gone: How police recovered Nancy Guthrie’s doorbell footage
(www.theverge.com)
this post was submitted on 11 Feb 2026
246 points (98.0% liked)
Technology
81026 readers
3884 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Magnetic platter drives still have the highest storage density per dollar and so they are still heavily in use. Theoretically, overwritten data can be recovered from them by analyzing the magnetic fields directly from the platter. However, this is extremely time and money intensive and requires specialized equipment and expertise. Overwriting a partition multiple times severely complicates this process just by performing multiple overwrites.
Realistically, overwriting once with random data is enough, especially if the drive is to be physically destroyed. You can also use a powerful magnet (top end neodymium in direct contact) to scramble the delicate magnetic fields that encode the data on the platter, but at that point you may as well shred the drive anyways.
SSDs are a fundamentally different storage paradigm that make this kind of recovery essentially impossible. Due to the limitations of NAND memory, data can be written to blocks inaccessible except at the hardware level. To make SSDs secure, modern drives usually implement processes (TRIM) that erase blocks marked for deletion. Or, all data written to the drive is encrypted by onboard hardware (SED), and “erasing” the drive simply deletes the encryption keys.
One thing to keep in mind though, is even on ssds you need to encrypt your data to be absolutely sure it isn't recoverable. Nothing more permanently unrecoverable than deleting your encryption key short of physically destroying the media.
One nifty fact about ssds is they usually have a good amount of extra space (over provisioning, with newer drives having less so than older ones) to allow the controller to swap out bad blocks without losing available space or use it as cache. Because of this, you may have normally inaccessible blocks that still contain data but have been taken out of the normal usage pool.