Help with a dissertation idea

Hi.

I am an Msc student looking at the possibilities of a dissertation in and around computer forensics. i (think) I am interested in the physical side of actually erasing information, and then trying to find it again. I have heard that Encase is the best software to use for recovery, and there have even been a few law cases to confirm this.

What software do people recommend for erasing information? I would like people to say firstly which is best (regardless of cost) and then which is the best free tool.

Also if anyone can think up a good dissertation idea, I would be very grateful

Thanks
Andy

A program called DBAN is a very good data removal tool. by default it writes over the HD 3 times but you can set it to do it as many as 14 times. the really great part is its on a bootable disk so you pop it in, reboot and let it do its thing.

For deleting single files, there are many tools that all do basically the same thing... rewrite over the erased data X times. (at least seven is the DOD requirement for secure environments if I recall correctly)

Other tools overwrite the data once and then relabel the pointer so it looks like something not worth recovering. This has the disadvantage of being less secure on an absolute scale, but being as secure on a practical scale and has the advantage of putting less wear on the drive.

For clearing an entire drive you'll want to use a degaussing ring.

cheers,

catch

from a linux command prompt you could use

Code:

---

dd if=/dev/zero of=/dev/hdX bs=1k

---

(where X is the number of the hard drive, hda for prim. master)
This will effectively overwrite the complete hard drive (including the partition table) with zeroes.
This will prevent 'normal' users from finding anything on your drive.
If you want to be really sure you could do a

Code:

---

dd if=/dev/random of=/dev/hdX bs=1k

---

to overwrite the complete harddisk with random data.

Afterwards repartition and reinstall or physicly destruct the harddrive.

For the government standard on data destruction you would have to repeat this process a bunch of times.

Thanks for the quick reply's!

I did read somewhere that you can replace with o's etc, but also with random digits kind of like what was mentioned above. How exactly is this done on a windows machine? Do you just use the programs suggested, or can you use the command prompt and do it a bunch of times?

Second thing - How exactly can data be recovered. I know that programs such as Encase are used, but i have also read that data can be recovered, even after being re-written a number of times (I gather this has to do with the hardware?) Does anyone know any more on this, and where I could find some information?

Thanks
Andrew

Quote:

---

Originally posted here by andrewsco
Thanks for the quick reply's!

I did read somewhere that you can replace with o's etc, but also with random digits kind of like what was mentioned above. How exactly is this done on a windows machine? Do you just use the programs suggested, or can you use the command prompt and do it a bunch of times?

Second thing - How exactly can data be recovered. I know that programs such as Encase are used, but i have also read that data can be recovered, even after being re-written a number of times (I gather this has to do with the hardware?) Does anyone know any more on this, and where I could find some information?

Thanks
Andrew

---

you might need knowledge of assembly
With assembly, you can "talk" low level to the HDD..
for a start, you could search for some open source "format" or "fdisk" programs and look at how the author do it.
eg the Spinrite data recovery program was written in assembly.
cheers

Thanks again for the reply's. One thing; I tried to google on what a 'degaussing ring' is, but couldn't find any info on actually using it to wipe an entire drive...could you explain please?

Gostmachine: I will have a look into that thanks, that would be really interesting if i could put some programming into my dissertation somehow. I dont suppose there are any tutorials you know of explaining this in a bit more detail?

Andy

isnt a degaussing ring just a means of demagnetising something? for instance a HDD? this would destroy everything cos you should know that the HDD stores data magnetically.

Past few times ive bought HDD second hand off places such as Ebay, ive found some interesting bits and pieces. - most people dont bother to erase.

Maybe you could try this? by a bunch of HDD off ebay and see whats recoverable? youd be able to get some interesting stats this way I think, personally I'd go for SCSI disks cos they tend to be a bit more "industrial" then your home computer IDE disk so you mihgt get some more interesting information - finacial, medical, etc.... this would be good for stating your case at why this is a serious issue.

Try writing to CSEG, NCIS, and some bank companies likem KPMG, PWC, morgan and stanley and others and see what there policies are on disposal of HDD's are.

As for acessing the HDD "low level" so to speak, try using DOS debug - have a look into tutorials on bootsectors in dos debug - similar principles apply to access the main area (has it got a real name?) of a HDD

i2c

ps - as im currently doing my dissertation, if I were you, id kill urself now, there far to much hassle!

Forgot to mention - degausing rings (A.K.A degausing coils) are used for deguassing tellies and CRT montiors, maybe even O-scopes to.

You can buy them for under £50 I think, or make them (personnally i'd make one, but im an idiot and i enjoy messing with high voltage stuff, Its safer to buy and a lot less effort)

http://images.google.co.uk/images?q=...ff&sa=N&tab=wi

i2c

Quote:

---

Originally posted here by i2c

Past few times ive bought HDD second hand off places such as Ebay, ive found some interesting bits and pieces. - most people dont bother to erase.

Maybe you could try this? by a bunch of HDD off ebay and see whats recoverable? youd be able to get some interesting stats this way I think, personally I'd go for SCSI disks cos they tend to be a bit more "industrial" then your home computer IDE disk so you mihgt get some more interesting information - finacial, medical, etc.... this would be good for stating your case at why this is a serious issue.

[/B]

---

This is an excellent idea IMHO. One of the things that Rob Lee did in the SANS Forensics track (8 if I remember) was buy some harddrives off of ebay, image them, and then provide us to them as a Forensics challenge. It was really kind of scary, found out more than I wanted to about a preacher, a raytheon employee (with tons of info), and I forget off the top of my head what was on the other. But if you were to do the analysis and then discuss research ways of clearing the data and tie that into corporate/government policies for destroying data and you could have yourself a very interesting topic :)

On a side note, I want to second the person talking about 'dd', between it, Autopsy, TCT, Helix, and a couple of other tools, you'd be very well covered in comparison to Encase (which is not free). I would highly recommend you looking into them.

Hi,

andrewsco ,

Here is a link to a tutorial I wrote a while back that may have some relevance.

http://www.antionline.com/showthread...hreadid=248897

I would suggest that you look at the posts by groovicus in the forensics forum. I recall he did some testing of data erasure and recovery.

Cheers :)

Thanks for all your help guys. This is a really interesting topic...one which i myself am interested in, and there is a good scope for interviews with employees on thier policy, linking it to business - whilst also stressing the importance of this for a home user. The stats would be could, and i'm sure would bring up some interesting results.

I will look into other tools, (I know some people who work in law enforcement and are invloved that way, so maybe I can use that angle. Maybe i can use a copy of Encase from one of them...who knows.

I could also show techniques for secure deletion of data, and actually demeonstrate how it works. The only other thing I was considering was the use of how hard drives can be encrypted, how would this effect getting information off the drive (obviously it needs to be unencrypted) but I hear that there are some encryption that is impossible to break. Does anyone have any info on encryption of hard drives, the best programs to use, and how someone would go about decrypting it?

A really good idea, I have a lot to discuss with my tutor! :D

Andy

Quote:

---

Originally posted here by andrewsco
Thanks again for the reply's. One thing; I tried to google on what a 'degaussing ring' is, but couldn't find any info on actually using it to wipe an entire drive...could you explain please?

Gostmachine: I will have a look into that thanks, that would be really interesting if i could put some programming into my dissertation somehow. I dont suppose there are any tutorials you know of explaining this in a bit more detail?

Andy

---

Yes there are many, have a google search on "assembly language" on the net and you will find many.good luck

I think Sony already use some form of encryption on there disk (magic gate i beleive) but thats to prevent priracy of the disks, so that only there stuff can be used in there products.

Check out the nintendo ds for information on media encryption, --> delsinux.org

there many open source disk encryption drivers

http://www.netbsd.org/guide/en/chap-cgd.html

try google.

i2c

Didn't XP include this in SP2, the option to encrypt the hdd data ? I was wanting to say it came up in the forensics class I was in and although I don't think it will have/cause any issues with actually copying the data off the disk (you are just transferring bytes, which is irrespective of the data content; however, it was mentioned you would need the key to be able to access anything...

Quote:

---

Originally posted here by andrewsco
Second thing - How exactly can data be recovered. I know that programs such as Encase are used, but i have also read that data can be recovered, even after being re-written a number of times (I gather this has to do with the hardware?) Does anyone know any more on this, and where I could find some information?

Thanks
Andrew

---

Hi, Andrew,
I've confirmed, using before-and-after direct disk view software, that at least one program does indeed wipe data: Eraser 5.7 (open source software). That includes wiping small files that reside in the Master File Table (MFT).

However, there's a catch: on NTFS systems, there is journaling data temporarily stored in a file called $LogFile. This system file, which essentially serves as a short-term record of what's written to the disk so that the system can recover should power be lost, consists of a bunch of 4kB records. That can include information that's from a file you wanted to wipe.

The good news, from a privacy point of view, is that the $LogFile is routinely overwritten, so any information stored there has a very limited shelf life (perhaps less than 24 hours during normal computer use, or less with heavy disk access activities).

However, there are other places for file recovery programs like Encase to find data. When disks are defragmented, files shortened or data moved from one disk to another, old data is frequently left in its old positions on the disk, data which is now orphaned. The computer's pagefile and hibernation file can both leave lots of data behind, too. If disk freespace is not routinely overwritten, there can be a surprising amount of info left through normal use. And, of course, Encase can find all sorts of info in obscure, non-deleted files.

Encase isn't magic. It can't recover data that's been overwritten. But you'd better make sure that there aren't other copies or fragments of copies lying around on the disk, or it can find them.

On the topic of encryption, a program I've been experimenting with is Truecrypt 3.1a (also open source). It incorporates basically unbreakable on-the-fly encryption in several ways, has quite a few clever options and can even be used, with an add-on, to encrypt a user's entire profile on disk.

In addition to the above, I use both WinPT and Enigmail, which use GnuPG public-key encryption.

All of these are open-source programs that are available for Windows XP.

Eraser (website is down this evening, presumably temporarily):
http://www.heidi.ie/eraser/

Truecrypt:
http://www.truecrypt.org/

WinPT:
http://www.stud.uni-hannover.de/~twoaday/winpt.html

Enigmail (plug-in for Mozilla and Mozilla Thunderbird email programs):
http://enigmail.mozdev.org/