|
![](/i/fill.gif) |
Jim Henderson wrote:
> Send it here: http://www.ontrack.com
I see lots of talk of *boken* hard drives, but not much about
deliberately erased media.
> Or maybe here: http://salvagedata.com
Ditto.
> Or use something like this: http://freshmeat.net/projects/mobiusft/
I can't even find any documentation explaining what this *is*...
> Or maybe http://freshmeat.net/projects/fccubootcd/
>
> (The latter is reportedly used by the Belgian Federal Computer Crime Unit)
Seems to contain a bunch of tools for undeleting files, and recovering
deleted partition tables. The main "data aquisition" tool is listed as
being "dd". On the drives in question, all this will give you is a giant
image file full of zeros - useless for analysis perposes.
> Forensic data recovery is a booming business at the moment (got a friend
> who does it, in fact). Just wiping a drive is absolutely not sufficient
The DSS appears to disagree:
https://www.dss.mil/GW/ShowBinary/DSS/isp/odaa/documents/clear_n_san_matrix_06282007_rev_11122007.pdf
The NIST concludes
http://csrc.nist.gov/publications/nistpubs/800-88/NISTSP800-88_rev1.pdf
that "for ATA disks of 15 GB or more", clearing prevents a "laboratory
attack".
> - people have been convicted using evidence recovered from a drive
> without using "a microscope" (and BTW, how would that help? The data is
> encoded in a magnetic field, a microscope won't see that).
I didn't mean a light microscope - I was actually thinking of a Magnetic
Force Microscope...
--
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*
Post a reply to this message
|
![](/i/fill.gif) |