In hard disks, a "quick format" does nothing to the actual data on the disk - just clears the FAT (file allocation table), which then appears as a "blank disk" to the user. Therefore, it is fairly easy to ignore the FAT and read that data. Although it is tricky to read specific data, as there are no indicators to where a particular file begins and ends. Some format commands even save a backup of the FAT table, and restoring this backup manifests as the "unformat" feature.
A long-format of a hard disk does reset most of the data, which would seem to eliminate the possibility of reading said data - except for a characteristic inherent to magnetic storage media: hysteresis. When a bit is set or cleared on a hard disk, the process is not 100.00% accurate, as the media exhibits hysteresis. So some small amount of residual magnetism remains from the previous operation, and certain software tools can be used to scan areas of the disk (many times) to read that fraction of a percent of latent magnetization and "recover" this overwritten data.
But how do today's solid-state non-volatile memories fare? Thumb drives, SSD's, NAND Flash? The only relevant information I could find about their security and vulnerability is in this Wikipedia article which states:
In addition, deleted files on SSDs can remain for an indefinite period of time before being overwritten by fresh data; erasure or shred techniques or software that work well on magnetic hard disk drives have no effect on SSDs, compromising security and forensic examination.
Wait, what? These seem to be two completely different statements - the first implying that long-formats are never done and Flash therefore is always susceptible to my first paragraph's vulnerability. This can't be, correct? As I can "long format" a thumb drive or SSD, or instruct a uC to overwrite every block of a NAND Flash. And since wear-leveling places blocks somewhat randomly, I'd assume which blocks get overwritten to be rather random as well. So perhaps not all of a file would be overwritten in time, but some of it seems highly likely.
It also states that
erasure or shred techniques do not work on Flash which I find hard to believe. As long as every allocation unit were overwritten, that would make any data completely un-recoverable, correct?
How this applies to EE.SX: Imagine a NAND Flash with several crypto key pairs on it. If the chassis is opened, the device is erased, so nobody can "get" the keys. But is an "erase" enough?
That said, are nonvolatile flash memories susceptible to any type of data recovery technique? Is there any electrical field hysteresis to leverage for recovering overwritten data?