Jim Henderson wrote:

> Send it here:  http://www.ontrack.com

I see lots of talk of *boken* hard drives, but not much about 
deliberately erased media.

> Or maybe here:  http://salvagedata.com

Ditto.

> Or use something like this: http://freshmeat.net/projects/mobiusft/

I can't even find any documentation explaining what this *is*...

> Or maybe http://freshmeat.net/projects/fccubootcd/
> 
> (The latter is reportedly used by the Belgian Federal Computer Crime Unit)

Seems to contain a bunch of tools for undeleting files, and recovering 
deleted partition tables. The main "data aquisition" tool is listed as 
being "dd". On the drives in question, all this will give you is a giant 
image file full of zeros - useless for analysis perposes.

> Forensic data recovery is a booming business at the moment (got a friend 
> who does it, in fact).  Just wiping a drive is absolutely not sufficient

The DSS appears to disagree:

https://www.dss.mil/GW/ShowBinary/DSS/isp/odaa/documents/clear_n_san_matrix_06282007_rev_11122007.pdf

The NIST concludes

http://csrc.nist.gov/publications/nistpubs/800-88/NISTSP800-88_rev1.pdf

that "for ATA disks of 15 GB or more", clearing prevents a "laboratory 
attack".

> - people have been convicted using evidence recovered from a drive 
> without using "a microscope" (and BTW, how would that help?  The data is 
> encoded in a magnetic field, a microscope won't see that).

I didn't mean a light microscope - I was actually thinking of a Magnetic 
Force Microscope...

-- 
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*

Post a reply to this message