Help with a dissertation idea
Page 1 of 2 12 LastLast
Results 1 to 10 of 17

Thread: Help with a dissertation idea

  1. #1
    Junior Member
    Join Date
    Mar 2005
    Posts
    18

    Help with a dissertation idea

    Hi.

    I am an Msc student looking at the possibilities of a dissertation in and around computer forensics. i (think) I am interested in the physical side of actually erasing information, and then trying to find it again. I have heard that Encase is the best software to use for recovery, and there have even been a few law cases to confirm this.

    What software do people recommend for erasing information? I would like people to say firstly which is best (regardless of cost) and then which is the best free tool.

    Also if anyone can think up a good dissertation idea, I would be very grateful

    Thanks
    Andy
    \"Get busy livin\', or get busy dyin\'...\" Come visit www.computer-tutorials.org

  2. #2
    Senior Member
    Join Date
    May 2003
    Posts
    1,199
    A program called DBAN is a very good data removal tool. by default it writes over the HD 3 times but you can set it to do it as many as 14 times. the really great part is its on a bootable disk so you pop it in, reboot and let it do its thing.
    Everyone is going to die, I am just as good of a reason as any.

    http://think-smarter.blogspot.com

  3. #3
    Banned
    Join Date
    May 2003
    Posts
    1,004
    For deleting single files, there are many tools that all do basically the same thing... rewrite over the erased data X times. (at least seven is the DOD requirement for secure environments if I recall correctly)

    Other tools overwrite the data once and then relabel the pointer so it looks like something not worth recovering. This has the disadvantage of being less secure on an absolute scale, but being as secure on a practical scale and has the advantage of putting less wear on the drive.

    For clearing an entire drive you'll want to use a degaussing ring.

    cheers,

    catch

  4. #4
    Member
    Join Date
    Dec 2003
    Posts
    99
    from a linux command prompt you could use
    Code:
    dd if=/dev/zero of=/dev/hdX bs=1k
    (where X is the number of the hard drive, hda for prim. master)
    This will effectively overwrite the complete hard drive (including the partition table) with zeroes.
    This will prevent 'normal' users from finding anything on your drive.
    If you want to be really sure you could do a
    Code:
    dd if=/dev/random of=/dev/hdX bs=1k
    to overwrite the complete harddisk with random data.

    Afterwards repartition and reinstall or physicly destruct the harddrive.

    For the government standard on data destruction you would have to repeat this process a bunch of times.

  5. #5
    Junior Member
    Join Date
    Mar 2005
    Posts
    18
    Thanks for the quick reply's!

    I did read somewhere that you can replace with o's etc, but also with random digits kind of like what was mentioned above. How exactly is this done on a windows machine? Do you just use the programs suggested, or can you use the command prompt and do it a bunch of times?

    Second thing - How exactly can data be recovered. I know that programs such as Encase are used, but i have also read that data can be recovered, even after being re-written a number of times (I gather this has to do with the hardware?) Does anyone know any more on this, and where I could find some information?

    Thanks
    Andrew
    \"Get busy livin\', or get busy dyin\'...\" Come visit www.computer-tutorials.org

  6. #6
    Member
    Join Date
    Jun 2004
    Posts
    77
    Originally posted here by andrewsco
    Thanks for the quick reply's!

    I did read somewhere that you can replace with o's etc, but also with random digits kind of like what was mentioned above. How exactly is this done on a windows machine? Do you just use the programs suggested, or can you use the command prompt and do it a bunch of times?

    Second thing - How exactly can data be recovered. I know that programs such as Encase are used, but i have also read that data can be recovered, even after being re-written a number of times (I gather this has to do with the hardware?) Does anyone know any more on this, and where I could find some information?

    Thanks
    Andrew
    you might need knowledge of assembly
    With assembly, you can "talk" low level to the HDD..
    for a start, you could search for some open source "format" or "fdisk" programs and look at how the author do it.
    eg the Spinrite data recovery program was written in assembly.
    cheers

  7. #7
    Junior Member
    Join Date
    Mar 2005
    Posts
    18
    Thanks again for the reply's. One thing; I tried to google on what a 'degaussing ring' is, but couldn't find any info on actually using it to wipe an entire drive...could you explain please?

    Gostmachine: I will have a look into that thanks, that would be really interesting if i could put some programming into my dissertation somehow. I dont suppose there are any tutorials you know of explaining this in a bit more detail?

    Andy
    \"Get busy livin\', or get busy dyin\'...\" Come visit www.computer-tutorials.org

  8. #8
    Senior Member
    Join Date
    Jul 2003
    Posts
    634
    isnt a degaussing ring just a means of demagnetising something? for instance a HDD? this would destroy everything cos you should know that the HDD stores data magnetically.

    Past few times ive bought HDD second hand off places such as Ebay, ive found some interesting bits and pieces. - most people dont bother to erase.

    Maybe you could try this? by a bunch of HDD off ebay and see whats recoverable? youd be able to get some interesting stats this way I think, personally I'd go for SCSI disks cos they tend to be a bit more "industrial" then your home computer IDE disk so you mihgt get some more interesting information - finacial, medical, etc.... this would be good for stating your case at why this is a serious issue.

    Try writing to CSEG, NCIS, and some bank companies likem KPMG, PWC, morgan and stanley and others and see what there policies are on disposal of HDD's are.

    As for acessing the HDD "low level" so to speak, try using DOS debug - have a look into tutorials on bootsectors in dos debug - similar principles apply to access the main area (has it got a real name?) of a HDD

    i2c

    ps - as im currently doing my dissertation, if I were you, id kill urself now, there far to much hassle!

  9. #9
    Senior Member
    Join Date
    Jul 2003
    Posts
    634
    Forgot to mention - degausing rings (A.K.A degausing coils) are used for deguassing tellies and CRT montiors, maybe even O-scopes to.

    You can buy them for under 50 I think, or make them (personnally i'd make one, but im an idiot and i enjoy messing with high voltage stuff, Its safer to buy and a lot less effort)

    http://images.google.co.uk/images?q=...ff&sa=N&tab=wi

    i2c

  10. #10
    Jaded Network Admin nebulus200's Avatar
    Join Date
    Jun 2002
    Posts
    1,356
    Originally posted here by i2c

    Past few times ive bought HDD second hand off places such as Ebay, ive found some interesting bits and pieces. - most people dont bother to erase.

    Maybe you could try this? by a bunch of HDD off ebay and see whats recoverable? youd be able to get some interesting stats this way I think, personally I'd go for SCSI disks cos they tend to be a bit more "industrial" then your home computer IDE disk so you mihgt get some more interesting information - finacial, medical, etc.... this would be good for stating your case at why this is a serious issue.

    [/B]
    This is an excellent idea IMHO. One of the things that Rob Lee did in the SANS Forensics track (8 if I remember) was buy some harddrives off of ebay, image them, and then provide us to them as a Forensics challenge. It was really kind of scary, found out more than I wanted to about a preacher, a raytheon employee (with tons of info), and I forget off the top of my head what was on the other. But if you were to do the analysis and then discuss research ways of clearing the data and tie that into corporate/government policies for destroying data and you could have yourself a very interesting topic

    On a side note, I want to second the person talking about 'dd', between it, Autopsy, TCT, Helix, and a couple of other tools, you'd be very well covered in comparison to Encase (which is not free). I would highly recommend you looking into them.
    There is only one constant, one universal, it is the only real truth: causality. Action. Reaction. Cause and effect...There is no escape from it, we are forever slaves to it. Our only hope, our only peace is to understand it, to understand the 'why'. 'Why' is what separates us from them, you from me. 'Why' is the only real social power, without it you are powerless.

    (Merovingian - Matrix Reloaded)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

 Security News

     Patches

       Security Trends

         How-To

           Buying Guides