|
![](/i/fill.gif) |
On Fri, 27 Jun 2008 20:00:50 +0100, Orchid XP v8 wrote:
> Jim Henderson wrote:
>
>> Send it here: http://www.ontrack.com
>
> I see lots of talk of *boken* hard drives, but not much about
> deliberately erased media.
They've got the equipment for that. I used to talk with them
occasionally, and they did do forensic analysis for law enforcement back
then. Don't know if they still do.
>> Or maybe here: http://salvagedata.com
>
> Ditto.
>
>> Or use something like this: http://freshmeat.net/projects/mobiusft/
>
> I can't even find any documentation explaining what this *is*...
It's a forensic data toolkit. Used for investigating criminal activity
that's been stored on hard drives and then wiped/erased/whatever. Often
times, you don't recover a file, but you recover data on individual
blocks (think like chkdsk).
>
>> Or maybe http://freshmeat.net/projects/fccubootcd/
>>
>> (The latter is reportedly used by the Belgian Federal Computer Crime
>> Unit)
>
> Seems to contain a bunch of tools for undeleting files, and recovering
> deleted partition tables. The main "data aquisition" tool is listed as
> being "dd". On the drives in question, all this will give you is a giant
> image file full of zeros - useless for analysis perposes.
>
>> Forensic data recovery is a booming business at the moment (got a
>> friend who does it, in fact). Just wiping a drive is absolutely not
>> sufficient
>
> The DSS appears to disagree:
>
> https://www.dss.mil/GW/ShowBinary/DSS/isp/odaa/documents/
clear_n_san_matrix_06282007_rev_11122007.pdf
>
> The NIST concludes
>
> http://csrc.nist.gov/publications/nistpubs/800-88/NISTSP800-88_rev1.pdf
>
> that "for ATA disks of 15 GB or more", clearing prevents a "laboratory
> attack".
>
>> - people have been convicted using evidence recovered from a drive
>> without using "a microscope" (and BTW, how would that help? The data
>> is encoded in a magnetic field, a microscope won't see that).
>
> I didn't mean a light microscope - I was actually thinking of a Magnetic
> Force Microscope...
Well, all I know is that I know people who actually *do* this kind of
work on a regular basis.
Doing a DoD style wipe is generally sufficient, but as others pointed
out, the point from a data security standpoint is to make the cost of
recovery more than the value of the data when recovered. In *most*
cases, a wipe is sufficient, but it really depends on how valuable the
data is to your competition.
Jim
Post a reply to this message
|
![](/i/fill.gif) |