User-Level Secure Deletion on Log-Structured File Systems

Abstract

We address the problem of secure data deletion on logstructured file systems. We focus on the YAFFS file system, used on Android smartphones, and on the flash translation layer (FTL), used in SD cards and USB memory sticks. We show that neither of these systems provide temporal data deletion guarantees and that deleted data remains indefinitely on these systems if the storage medium is not used after the data is marked for deletion. Moreover, the time that data remains on log-structured file systems increases with the storage medium's size. We propose two user-level solutions that achieve secure deletion: purging, which ensures that all data is deleted, and ballooning, which reduces the expected deletion latency. We show that these two solutions can be combined to guarantee the periodic, prompt secure deletion of data regardless of the storage medium's size and with acceptable wear of the memory. As these solutions require only user-level permissions, they enable the user to securely delete data even if this feature is not supported by the kernel or hardware, over which users typically do not have control. This, for example, allows mobile phone users to achieve secure deletion without violating their warranties or requiring non-trivial technical knowledge to update their firmware with a customized kernel. Our solutions empower users to ensure the secure deletion of their data without relying on the manufacturer to provide this functionality. We implement these solutions on Nexus One smartphones and show that they succeed in secure deletion. When used properly, our solutions neither prohibitively reduce the longevity of the flash memory nor noticeably reduce the device's battery lifetime.

Remote Wiping and Secure Deletion on Mobile Devices: A Review

“…Reardon et al developed a secure deletion tool for the Android OS that will monitor the amount of free space and fill it with random data. This ensures unwanted data marked as invalid are filled with random data to achieve random deletion.…”

ErasuCrypto: A Light-weight Secure Data Deletion Scheme for Solid State Drives

“…A user-level secure deletion scheme named purging is proposed in [20], which requires no modifications to the storage system. Since the user does not have direct control to the lower-level storage controller, a passive method is applied: the user should fill all the empty space in the file system with as much junk files as it can holds.…”

Secure Data Sanitization for Android Device Users

“…S. M. Diesburg, et al, summarized and compared existing methods of providing confidential storage and deletion of data in personal computing environments [6]. Paper [8] shows that these systems provide no temporal guarantees on data deletion and that deleted data still persists for nearly 44 hours with average phone use and indefinitely if the phone is not used after the deletion. They proposed three mechanisms for secure deletion on log-structured file systems.…”

“…They proposed three mechanisms for secure deletion on log-structured file systems. R. Joel, et al, presented three user-level solutions for secure deletion on log-structured file systems assuming a coercive attacker capable of compromising both the storage medium and any secret keys required to access it [9]. The principle behind their three solutions -purging, ballooning, and our hybrid solution-is that they reduce the file system's available free space to encourage more frequent garbage collection, thereby decreasing the deletion latency of deleted data.…”

“…The strategies above are not friendly to user data secure since deleted files still exist in NAND and can thus be recovered [7]. Secure deletion is the act of deleting data from a storage medium such that the data is afterwards irrecoverable from the storage medium [8]. The time between deleting data and it becoming irrecoverable is called the deletion latency in [8].…”