Comment by kevinventullo | Hacker News Reader

Comment by kevinventullo | Hacker News Reader

The superseding indictment alleges that she then attempted to delete a digital folder of documents on an external hard drive that she possessed containing records relating to her military service and visa fraud, including:

- A digital version of a letter from Song, written in Chinese and addressed to the People’s Republic of China consulate in New York, in which Song explained that her stated employer, “Beijing Xi Diaoyutai Hospital” was a false front, and that because relevant approval documents were classified, she had attempted to mail them;

- An image of Song’s PLA credentials, with a photograph of her in military dress uniform, covering the time period from July 2016 to July 2020; and

- A digital version of a resume for Song, written in Chinese, again with a photograph of her in military dress uniform and listing her employer as the Air Force General Hospital.

Yikes, that sounds pretty damning. I’m not an expert in digital forensics but I wonder why she wouldn’t destroy the hard drive after. Or is that not enough?

The FBI probably had a copy of the drive prior to her ever realizing she was under investigation. They have some pretty advanced physical access methods, even having cans of spray able dust to ensure nothing looks disturbed.

After reading these charges it sounds like less of a spy situation and more of an unfortunate past she was knew would conflict with her current goal of getting the F out of China. I'm pretty skeptical because like most cases involving state security, this one involves a desperate rube and a grandiose story that'll bolster some agents' careers. Maybe she didn't think her service was that relevant to working in neurology, but destroying a hard drive would make it seem like she was really a spy? Like she'd rather everyone forget about it because it never should have been of concern to begin with. I have neglected to check the, "Have you ever been charged with a crime?" box on job applications and if for some reason my mug shots were hanging about my workstation I'd throw them in the trash. Maybe I can or can't relate but I see why someone would go to some effort to keep something like that from coming to light without committing to the foregone conclusion implied by the charges. To be honest this story seems barely newsworthy, I have known a lot of grad students who lie on their Visa documents. But in this day and age people want to read news about Chinese spies being deported, so god help her that's what the news is going to report.

Follow up question, as someone who knows even less about forensics, what kind of traces stay on a hard drive if you just delete a file?

Generally when you just delete a file, its contents are marked as "unused", but not actually erased. This is why deleting a large file takes the same time as deleting a small file. Then, whenever a new file is created, it might be put (partially) on top of the old file, overwriting the old contents for good.

the whole file is still there until it gets overwritten by new data

A lot.

You need to write a drive with zeros(minimum)/random data(preferably) at least once to make forensic recovery difficult. I know all about the "5 times" rule, but I've never heard of anyone recovering a drive after even a single overwrite.

Personally, I just hammer a screwdriver through the platter. It generally converts it into glass shards--the drive sounds like a maraca afterward.

Flash, of course, is different. I suspect that writing zeros/random once is probably enough. However, I tend to just use diagonal cutters and slice through the chips.

If someone wants to reconstruct my drive after I've physically destroyed it, they've probably got enough money to just fabricate the evidence against me anyway.

I have a few HDs with bullet holes in them, and the platters are still intact. I've messed around with a lot of drives and never shattered a disk like glass. I've heard that there's labs that specialize in reading disks without even needing to spin them, but information seems to be tightly guarded about the processes.

The platters I've seen are aluminum alloy.

> Flash, of course, is different. I suspect that writing zeros/random once is probably enough.

SSDs won't necessarily actually erase a block when you tell them to, due to wear-leveling and weird internal RAID setups they could be doing anything in there.

https://en.wikipedia.org/wiki/Data_remanence

That link has a bit more, but the main issue is what the others wrote. Deleting a file from your disk may not actually delete it. It can leave an entry in the file system that marks it as deleted (for undeletion later) or it may just remove the entry, in which case the data is still on the disk and recoverable.

On most file systems, just deleting a file simply deletes the link between the filename and the data on disk, the actual data remains fully intact until the blocks are overwritten by new data. It's trivial to recover recently deleted files, and often not much more effort to recover less recently deleted files. It only becomes a challenge if the data has been long deleted or was intentionally overwritten before deletion (or the disk wiped using random data), in some cases becoming effectively impossible to recover.

The file is still there. A regular delete just tells the disk that the segments of memory are available to be overwritten. Zeroing out (or /dev/urandom) the memory is an option, but even that is not 100% safe, especially when it comes to forensic labs with the ability to read and analyze platters removed from a complete, sealed disk. Really safe deleters will overwrite the segments of memory multiple times to scramble magnetic signatures

The world has moved on.

You can’t transplant a platter into another reader, the old days of Guttman method don’t really apply anymore, density is so high that outside of research settings it’s just not practical.

That said I still put a drill through mine before disposing of them, because close to zero isn’t zero.

The reality though is we have no idea what's possible here: we just know what's not commercially viable to offer as a service.

HDD recovery research is almost certainly a well-funded area of intelligence services, so I imagine their are a few electron microscopes and STMs which can do it.

There's certainly no military data destruction guide which doesn't start with "shred the platter to this grain size".

>You can’t transplant a platter into another reader

Then why do I get tons of results on YouTube of people doing exactly that, when searching for “HDD transplant”?

I typed it into YouTube and every result (of the first dozen or so) is years old, including the most recent video citing an example where it's impossible.

https://www.youtube.com/watch?v=bml8ovt4nfI

From 2020 (it's about drive savers):

https://youtu.be/v0QkafslnrM

https://drivesaversdatarecovery.com/data-recovery-services/d...

I wonder if they can recover the HD the other video says is impossible.

If you actually watched the video that you've linked, you'll see that the platters in the drive has shattered. That's completely different from your initial claim of "You can’t transplant a (unshattered] platter into another reader"

...in that case, can't you just shatter an HD platter to make it unrecoverable? If the goal is to prevent discovery, that seems pretty trivial.

It's really unclear to me whether or not HDs are recoverable from the comments I'm seeing, and honestly I don't care that much so I'm going to stop commenting.

> ...in that case, can't you just shatter an HD platter to make it unrecoverable? If the goal is to prevent discovery, that seems pretty trivial.

...only if the platters are glass. Many (most?) are made of metal.

>It's really unclear to me whether or not HDs are recoverable from the comments I'm seeing, and honestly I don't care that much so I'm going to stop commenting.

The same video also mentions him being able to salvage a hard drive that was in a multi-vehicle accident, because the platters haven't been shattered.

Well there you go. Buy an HD with a glass platter, shatter it, and now nobody can recover your data. Security secured.

I was thinking of this from the forensics standpoint initially of erasing data from an HD (however many comments up it was about hiding data). I don't really care about the particulars of the method. If there's an easy way to store data and secure it, it sounds like it's impossible for that data to be recovered.

It really hasn't, though. There are tons of data recovery services which will, for a fee, recover data from damaged hard drives. The process for recovering data forensically can be quite similar, depending on what the person did to "delete" it.

https://www.ontrack.com/en-us/data-recovery/hard-drive

https://www.gillware.com/hard-drive-data-recovery/scratched-...

A drill is pointless because it only damages a tiny part of the platter. That might deter commercial recovery companies, but probably not the feds (depending on how big of a target you have on your back).

Not when it shatters the glass/ceramic platters and shards fall out (which is nearly every drive I've put a drill through for the last while).

Note: I do overwrite the drives (DBAN) then drill them and these are going to recycling anyway - it's quantifying the risk - I drill the drives because they usually have had customer or client data on them at some point so it's just good practice.

I’ve done this a few months ago on a 6TB drive.

You remove the cover, unscrew the platter, use sticky tape on the sides of the platters to remove them and place them in the donor drive...

With an identical drive you don’t even need to worry about anything else the data will be there as nothing has happened.

The “new” drive just worked it still does...

Unless the plates are completely shattered you can recover the data.

And I can guarantee you that the FBI has a data recovery lab that is much better than what I can do at home.

> but even that is not 100% safe, especially when it comes to forensic labs with the ability to read and analyze platters removed from a complete, sealed disk.

No, this is completely impossible and noone has ever done it. (An exception would be HDDs with bad block mapping because they might not actually erase some sector.)

SSDs don't even have platters and you could probably recover things from the flash, but you can avoid this with disk encryption by simply losing the keys.

> Really safe deleters will overwrite the segments of memory multiple times to scramble magnetic signatures

Deletion programs do this because it looks cool. It's not necessary - literally noone has ever recovered anything from a zeroed out HD sector.

>No, this is completely impossible and noone has ever done it.

Pedantic devil's advocate - nobody has claimed to do it. When dealing with international espionage and possibly the DoD or DHS examining the drive, I wouldn't bet on that assumption.

We do know that stuff too, there were HD firmware implants and such in the Snowden leaks and there wasn't anything about recovering things from a zeroed hard drive.

I believe the government outsources to the same data recovery firms as everyone else; they can get things off drives with dead electronics or platters that haven't actually been erased, but that's it.

>Deletion programs do this because it looks cool. It's not necessary - literally noone has ever recovered anything from a zeroed out HD sector.

anything of value

From what I recall, with an electron microscope you can detect polarity around the edges of bits for certain magnetic storage devices and I recall seeing a paper where this was stepped through a several bits were recovered with fairly good success rates. This is part of the reason behind the old rationale of overwriting multiple passes.

With that said, given current data density for anything useful, reassembling anything remotely useful from such an approach would be nearly impossible and take a huge amount of time.

With NAND based storage, none of this applies or at least has entirely different context to consider.

Edit, was curious, here's a reference you could follow to the actual paper for empirical backup: https://www.sans.org/blog/overwriting-hard-drive-data/

Once, I recovered 600MB of my /dev/null file from my zeroed out HD! It's like it was never deleted.

They probably copied the drive way before she ever realized she was under surveillance.

What exactly do they have on the lady, except that she is an officer in the PLA? OK, she's wearing uniform and is employed at a military hospital, but members of the US Medical Corps are officers at military hospitals. It's easy to understand why a physician might wish to work in brain disease. What secrets were exfiltrated?

From the article:

"Members of the Chinese People's Liberation Army cannot lie on their visa applications and come to the United States to study without expecting the FBI and our partners to catch them." said Assistant Director Alan E. Kohler Jr. of the FBI's Counterintelligence Division. "Time and again, the Chinese government prioritizes stealing U.S. research and taking advantage of our universities over obeying international norms."

It doesn't matter if she was unsuccessful at exfiltrating secrets. What matters is that, apparently, she's an agent of a foreign government who lied about said affiliation on her application for a visa.

This is what foreign nationals are prosecuted for when it comes to espionage - failure to declare yourself as a foreign agent.

Most espionage laws are only directly applicable to citizens of the state in question.

I’m not sure what else, but this alone would prove she lied on her Visa application and lied to authorities in an interview. From the article:

If convicted, she faces a maximum statutory penalty of up to 10 years in prison and a fine of $250,000 for the visa fraud count; up to 20 years in prison and a fine of $250,000 for each of the obstruction and alteration charges; and up to five years in prison and a fine of $250,000 for the false statements charge.

The point is: why bother prosecuting that crap when patently no state secrets are involved? Why not simply revoke the visa, deport the person and ban her from re-entry? Do they want to create uncertainty for people who have served in the PLA or generally discourage Chinese researchers from working in the US? The purpose of the exercise is wholly unclear! What is the Department of State up to?

They want to discourage people from doing the things with which she is charged; lying on visa applications, obstructing justice, and making false statements. Those all seem like good goals to me?

It seems like a misdirection of resources to me, like the cops catching speeders on open roads. Instead of investigating and preventing crime they stop someone who is above the speed limit, talk to them really condescendingly and issue a fine. That stuff does wonders for the perception of law enforcement but lines the city's coffers.

> What is the Department of State up to?

Is not enforcing existing law one of their functions?

It doesn't matter whether the questions are important to you, they are important to the Federal agencies that hold in their hand life changing stuff: whether you are allowed to live in the US, whether your grant gets funded, whether you get employment at a US funded research department. These are high stakes disclosures to obtain much sought after benefits. Omit something that would instantly disqualify you from said benefits and expect to have a house fall on you that is the same order of magnitude as the benefits obtained.

Now what is the value of a given career, US residency, Stanford employment, or Federal grant? At least hundreds of thousands of dollars - easily in the millions.

That is the scale of fraud being committed here, as none of these would have been an option for her if the PLA ties were disclosed. She would not be at Stanford, nor even in the US, nor in her current employment if her status were known.

Now you may disagree with the policy of not giving Federal dollars to PLA members or not hiring them in US research departments, but just because you disagree with the policy doesn't make the stakes any lower.

Reply on news.ycombinator.com