How do a secure erase of an iPhone or iPad

I'm no expert on data detruction or data recovery; however, I am a physician who fears the 1.5 million dollar fine the US government can levy against me if patient data is exploited from a lost or stolen iPhone (which would violate HIPAA - even if I was prudent in attempting to secure that data.) That said, I've tried to read and understand as much as possible from the experts in the fields of encryption (such as Phil ZImmerman of PGP fame back when I was a teenager) and the field of data destruction (such as Peter Gutmann, the creator of the legendary "35 pass Gutmann Wipe"). Two of Mr. Gutmann's most informative papers on the subject are "Secure Deletion of Data from Magnetic and Solid-State Memory" http://www.cs.auckland.ac.nz/~pgut001/pubs/secure_del.html and "Data Remanence in Semiconductor Devices" http://www.cypherpunks.to/~peter/usenix01.pdf Basically, he points out that the Gutmann 35-Pass wipe applies to old technology & though it is often referred to as "the MOST secure method of data deletion" - it simply does not apply to modern stoarge devices, including the iPhone's SDRAM, and using that technique is a complete waste of time. He writes, "To erase SSDs.... Well, you're on your own there." However, he points out as do several other replies to your question - that, because the data is initially stored using AES-256 encryption, using the iPhone's built in "Erase and Reset" function makes data recover NEARLY impossible. If the people trying to get your data have access to some very sophisticated techniques and can get past the Flash Translation Layer - well, you have bigger worries & you should obliterate your phone.

Thx!

Btw although it's an old question, it's still useful as reference for people who would have otherwise made the same question again in the forums ;)

bill501 wrote:

{snip}

What I'd really like to do is mount the iOS drive on a desktop, and use a disk utility to rub out all data on the drive until I cannot recover any data anymore.

What you are seeking is not a design feature of iOS software or iPhone hardware. The most intrusive wiping of data is still the Device Firmware Update popularly known as DFU.

If you have researched the subject, then you know the iPhone 3GS and above comes with built-in hardware encryption by default that can't be turned off. AES-256 encryption.

With your research, did come across a single report that any data was recovered from an iPhone 3GS or above after the erase all content and settings option was used, or have you tried to do so with a data recovery utility after using the option on your iPhone?

You can pay for app such as iShredder for addiional, which is overkill IMO.

http://www.protectstar.com/en/iShredder.html

bill501 wrote:

Yeh I've done a google search and researched the subject. But that is not good enough. I need an enterprise solution and need to know exactly what is happening. I want control. The only other option is to destroy the drive.

What I'd really like to do is mount the iOS drive on a desktop, and use a disk utility to rub out all data on the drive until I cannot recover any data anymore.

There is no drive to mount. The iPhone has embedded SSD memory. It is encrypted using AES-256. Erase All Content and Settings destroys the encryption key, rendering the contents as random garbage. If this isn't good enough you should simply physically destroy the phone.

The US Department of Defense has approved the iPhone for use by individuals with access to classified information, because they were unable to break its encryption. And various law enforcement agencies have complained that they cannot get access to the content of iPhones without the cooperation of the owner.

If your standards are higher than this the only option is to destroy the phone.

How do a secure erase of an iPhone

On the iPhone go to Settings > General > Reset and select Erase All Content and Settings.

This is a secure erase of everything but iOS.

you can erase all the data on your phone by connecting it to itunes and restoring it. you can do this multiple times if you want to feel more secure, but the first time should do it.

I'm not sure what you have one there that you are so paranoid about other people seeing, but a 35x overpass is insane overkill. Allan Sampsons advice is quite enough to erase it completley.

Considering the device uses flash memory, this damages the drive.

Good answer. Although you are answering a 3 month old question 😉