Please report all spam threads, posts and suspicious members. We receive spam notifications and will take immediate action!
Page 2 of 2 FirstFirst 12
Results 11 to 14 of 14

Thread: evidence eliminator




  1. #11
    Join Date
    Nov 2001
    Location
    Texas, USA
    Posts
    4,825

    Default

    Folks seem to be getting wrapped around the axle regarding the recovery of data from a piece of media. Without getting into too much detail, the overwritten data can be recovered but only to a certain extent. The full file structure usually can't be fully retrieved, but the data recovered can still have evidentiary value.
    Old age and treachery will overcome youth and skill
    My Toys

  2. #12
    Join Date
    Nov 2001
    Location
    The Land of OZ!
    Posts
    674

    Default

    i don't know of a good free evidence eliminator but to be honest most of the ones i've seen are scams. The best of the pay for ones is the one Steganos makes: http://www.steganos.com/?product=SIAPRO6&language=en

    they also make great encryption products if anyone is interested..

    their security suite 6 includes something called Internet trace destructor which is about as good as you can get.
    http://www.steganos.com/?product=SSS6&language=en

  3. #13
    Join Date
    Nov 2003
    Location
    Minnesota, United States
    Posts
    4,543

    Default

    Quote Originally Posted by bigjackusa
    Does nothing? It's not like piling sticky notes on top of another, where you can peel back the stack and see what was there before.
    Actually, it is.

    http://www.cs.auckland.ac.nz/~pgut00...ecure_del.html
    A paper on the Secure Deletion of Data from Magnetic and Solid-State Memory, which exposes a number of myths about the deletion of data, shows how data can be recovered long after it should have been erased, and indicates a method of erasure that should make it a considerable challenge to recover any deleted data. This paper was presented at the 1996 Usenix Security Symposium, but you had to attend the conference to see the cool colour slides of supposedly overwritten disk data which wasn't really overwritten (they were too big to fit in the paper itself).
    If you read the article you'll see that Peter Guttman proved that overwriting any number of times could not render files unrecoverable, only more and more difficult to recover. To save you the time of reading through it, here's the conclusion:
    Data overwritten once or twice may be recovered by subtracting what is expected to be read from a storage location from what is actually read. Data which is overwritten an arbitrarily large number of times can still be recovered provided that the new data isn't written to the same location as the original data (for magnetic media), or that the recovery attempt is carried out fairly soon after the new data was written (for RAM). For this reason it is effectively impossible to sanitise storage locations by simple overwriting them, no matter how many overwrite passes are made or what data patterns are written. However by using the relatively simple methods presented in this paper the task of an attacker can be made significantly more difficult, if not prohibitively expensive.
    Basically, unless it relates to military or state secrets (or anything along those lines), it becomes more trouble than it is worth to recover data that has been overwritten more than three times. However, it is possible to recover data from both RAM and HDDs unless they are destroyed.


    Bleh, Darthtanion summed it up quite well anyway. ;)

  4. #14
    Join Date
    Nov 2001
    Location
    Texas, USA
    Posts
    4,825

    Default

    Quote Originally Posted by Yawgm0th
    Bleh, Darthtanion summed it up quite well anyway. ;)
    Sorry to beat you to the punch, but this IS one of my job-related areas after all. :)
    Old age and treachery will overcome youth and skill
    My Toys

Page 2 of 2 FirstFirst 12

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •