Search: Home Bugtraq Vulnerabilities Mailing Lists Jobs Tools Vista
Security Basics
RE: Hard Drive Forensics Question Oct 06 2008 03:00AM
Murda Mcloud (murdamcloud bigpond com) (1 replies)
Re: Hard Drive Forensics Question Oct 06 2008 01:25PM
Razi Shaban (razishaban gmail com) (2 replies)
On Mon, Oct 6, 2008 at 7:00 AM, Murda Mcloud <murdamcloud (at) bigpond (dot) com [email concealed]>

I won't reply to the first part, as I feel that it doesn't really need
much more elaboration.

>> >> And why do you feel that random is better?
>> >
>> >If it is actual files that are copied, they may be recovered.
>> >Depending on the nature of those files, opinions could be made either
>> >way. If it's random data, nothing can be retrieved and they are left
>> >with nothing to work with. If they are accusing him of wrong-doing
>> >that he is innocent of, he should leave them with as little as
>> >possible to work with, in my opinion.
>
> Maybe I should have asked, "Why do you feel that random is better than
> something else eg 0's?"
>
> I don't think it matters whether it's random or not-overwrite something and
> it's overwritten. Which means it's unrecoverable. Some apps will overwrite
> with random numbers. Eg DBAN
> If someone sees a pattern in the hard drive after I do
> dd if=/dev/zero of=/dev/hdax
> because it's not random they would be right. It's not random. However, can
> they see any files I had on there before? No.
>

Which is more likely to appear on a normal hard drive that has not
been tampered with or set up: Entire blocks of 0s, or random malformed
data?

--
Razi

[ reply ]
RE: Hard Drive Forensics Question Oct 07 2008 12:37AM
Murda Mcloud (murdamcloud bigpond com) (1 replies)
Re: Hard Drive Forensics Question Oct 08 2008 09:01AM
Matt (matt-martin tx rr com) (1 replies)
Re: Hard Drive Forensics Question Oct 08 2008 04:49PM
Ansgar Wiechers (bugtraq planetcobalt net) (1 replies)
Re: Hard Drive Forensics Question Oct 08 2008 05:27PM
J. Oquendo (sil infiltrated net) (1 replies)
Re: Hard Drive Forensics Question Oct 08 2008 07:54PM
Ansgar Wiechers (bugtraq planetcobalt net) (1 replies)
Re: Hard Drive Forensics Question Oct 08 2008 10:05PM
J. Oquendo (sil infiltrated net) (1 replies)
Re: Hard Drive Forensics Question Oct 09 2008 04:37PM
Ansgar Wiechers (bugtraq planetcobalt net) (1 replies)
Re: Hard Drive Forensics Question Oct 10 2008 05:41PM
Chris Barber (cmbarber gmail com)
Re: Hard Drive Forensics Question Oct 06 2008 08:42PM
Ansgar Wiechers (bugtraq planetcobalt net) (1 replies)
Re: Hard Drive Forensics Question Oct 07 2008 05:56PM
anonymous pimp (anonymouspimp gmail com) (1 replies)
Re: Hard Drive Forensics Question Oct 07 2008 06:33PM
Ansgar Wiechers (bugtraq planetcobalt net)







 

Privacy Statement
Copyright 2008, SecurityFocus