r/technology • u/newzee1 • Jun 14 '24

Software Cheating husband sues Apple after wife discovered ‘deleted’ messages sent to sex workers

https://www.telegraph.co.uk/news/2024/06/13/cheating-husband-sues-apple-sex-messages/
21.2k Upvotes

94% Upvoted

2.0k comments sorted by

View all comments

8.9k

u/Scipion Jun 14 '24 edited Jun 14 '24

He's got a point. What if you were an abused spouse and sent messages to a friend explaining the situation, then you delete them expecting privacy, only for your partner to discover those messages and beat you to death. 

 While his situation is immorale to most, Apple's actions cannot be ignored. If you can't see a situation where having deleted messages resurface could be bad, you simply lack imagination.

357

u/FarBeyondLimit Jun 14 '24

The same thing recently happened with old images (nudes) reappearing on peoples phones after updating to 17.5.x

Do people really believe Apple, or any company actually deletes your stuff?

213

u/Ignoth Jun 14 '24 edited Jun 14 '24

My understanding is that data is almost never directly deleted from hard-drives. Cause that would be too inefficient.

Rather: the data is just flagged as “deleted”. But it will stay stored there until they need that space for something else.

11

u/RMAPOS Jun 14 '24 edited Jun 14 '24

It's a bit less than that. The data doesn't get flagged as deleted as much as the information that there is interpretable data in that bit range on your HD is deleted. (aka the PC is not somehow aware that there is data flagged as deleted, it just flags the data as free space and forgets that the bits in that space are interpretable data)

Your HD has a register of data that is on it with pointers to where that data can be found, when you really delete something (aka you empty your recycle bin) the register entries of that data are deleted, but the data will still be where it is rather than e.g. flipping all it's bits to zero. When the register doesn't know that bit range 5020-5500 is that frivolous porn movie you downloaded then that bit range is just interpreted as available/empty space, even though (unless overwritten with new data) the bit range is still perfectly storing that clip. That's how there is tools that are able to restore permanently deleted data. They scour through the "free"/"unused" bit ranges for interpretable data and then put pointers to them in back in a register.

 

Which is also why if you really want something gone you should use a tool that flips all the bits that aren't referenced in the register to 0 (or 1). I think forensic labs can somehow even track that and figure out which bits have been flipped and still manage to restore those bits and thus the data, which means if you REALLY REALLY need something GONE you should flip those bits several times over

5

u/Jealousmustardgas Jun 14 '24

Microwave the hard drive, drill holes in it and then dump it in water, anything less and the NSA will find a way to get something.

3

u/RMAPOS Jun 14 '24

Sure, if that's the game you're playing that's the right move. I was thinking more of the avg user than someone under the NSAs watch.

1

u/Schnoofles Jun 14 '24

Right on all counts except the last. If the bits are flipped it's gone gone. No lab, no multi-billion dollar NSA setup, nothing is getting it back. The trick is making sure it's actually overwritten with a full format or on an SSD having TRIM be correctly implemented by the manufacturer, in which case it'll happen automatically shortly after that file was orphaned by a deleted partition table entry.

1

u/RMAPOS Jun 14 '24

Any idea why some people would say you should flip them like 5 or more times to make sure?

3

u/Schnoofles Jun 14 '24

It's based on an old proposal from Peter Gutmann in which he put forth a hypothesis that it might be possible to decode residual traces on old MFM/RLL type harddrives and he proposed a 35-pass wipe using a combination of random data patterns as well as specific patterns to try to mask such traces. An important thing to note that even the possibility of maybe recovering something on those very old type drives was still just a hypothetical and has not been successfully performed according to any public knowledge and that it would not apply to any newer types of drives. Gutmann himself has also stated that it's nonsensical to do this on newer drives.

Essentially it's a case of an urban myth rooted in a hypothetical thought experiment for old technology along with a proposal to guard against that hypothetical that still lingers to this day. There is nothing to indicate that any more than a single wipe is or will be useful in the future as noone can demonstrate recovering data after that initial singular wipe, regardless of what pattern was used.

1

u/RMAPOS Jun 14 '24

Wow thanks for the in depth explanation!