evidence eliminator

[tekman505]

Hey can anyone suggest a good free evidence eliminator download for windows xp :?: [/quote][/i][/b]

[wayout44]

Fdisk and format used a few times in a row.

[Yawgm0th]

I think what he might getting at is a program that removes stuff like visited web sites, but maybe not...

Just use XP's built in Disk Cleanup Utility (it's accessable from the start menu). If you wanted to try to remove traces of files ever existing on your system, you could try Window Washer from Webroot. I don't use it but I have used it on friend's computers. Sometimes it doesn't really work (says it cleans things that it doesn't), but it may be what you're looking for.

[Darthtanion]

Fdisk and format used a few times in a row.

Nope, I can still recover all your data if you do this. I used to think this a safe bet also, but this method only creates a new MBR and zeroes out the allocation information.

[Yawgm0th]

Exactly... You need a program to randomly allocate binary values (1s and 0z) all across te hard drive. Unfortunately, this takes a long time and doesn't work. It makes it much harder, but if someone determined enough wanted to get back data, they could. However, doing it just once or twice on particular files should be enough.
But unless tekman505 is in big trouble with the police , no one would go as far as recovering so much as zeroed-out data, much less data that has random writes all over it.

[bigjackusa]

Just a piece of related trivia. Math and physics say that writing 1s and 0s 7 times will make the data absolutely non-recoverable. It has been estimated that NSA can probably recover data overwritten 5 times, but NSA won't confirm it.

[RP Racing]

Also taking teh HD out of the computer and either......

1. 12 ga shotgun with 00 shot to it

2. melt it with a blowtorch

3. acid

4. put it on a train track for a train to run it over


those usually destroy it enough to render it unreadable. :lol:

[Yawgm0th]

Just a piece of related trivia. Math and physics say that writing 1s and 0s 7 times will make the data absolutely non-recoverable. It has been estimated that NSA can probably recover data overwritten 5 times, but NSA won't confirm it.

No.....
When binary data is written, it permanetly affects whatever it is written on, be it a hard drive or even RAM. In practical terms, writing a one over a zero makes it a one. In data recovery, though, it's more like turning it into a 0.95. There are methods that can show what data once was no matter how many times it has been overwritten. Math and physics say writing over previous data does nothing, it's logic and practicality that make it wrthwhile.
The NSA can recover data that has been overwritten well more than five times. However, the NSA doesn't even employ many of the leading experts in that particular field. There's no point; anything that contains military secrets or something of equal importance must be completely destroyed to eliminate the possibility of anyone finding it. The NSA, CIA, and FBI only care about such thing because criminals, terrorists, etc. aren't smart enough to destroy a hard drive and RAM and will simply random-write the whole thing a couple times over. In many cases, it has ben their downfall.

When it comes down to it, if someone wants something off of a hard drive, they can get it. You would have to completely destroy it to eliminate the possibility of recovery.

However, this is irrelevant... the post was likely about cleaning records of things such as visited web pages and opened files. If the poster were in so much trouble that he needed his hard drive completely wiped and all data on it made unrecoverable, he would have to be an idiot to post; it isn't hard to track his IP and computer to this web site...
Edit: BTW, method 2 of RP Racing's post is the only one that can be guaranteed to destroy all data on an HDD. Melting it or cutting it into pieces less than a cubic centimeter in size are the only ways to do it. Acid, train tracks, and shotguns can leave enough to find something incriminating. In fact, a shotgun wouldn't even pose much of a problem to and expert in the field of data recovery.

[bigjackusa]

What do you think the NSA is interested in? Think they might like to look at a hd from a foreign military computer? I once saw the math worked out on a blackboard that showed 7 times over-write will make the data unrecoverable. It seemed pretty convincing at the time. I can't now recall all of the myriad details but the who did it was with a premium data recovery company who had consulted with a physics department at a university.

I had to add a p.s..

Math and physics say writing over previous data does nothing, it's logic and practicality that make it wrthwhile.

Does nothing? It's not like piling sticky notes on top of another, where you can peel back the stack and see what was there before. Each element of recording material has a finite magnetic orietation. If you alter the orietation enough times. you cannot backtrack to the beginning. If you broke a rack of pool balls and shot 6 more times, it would be pretty hard for someone just then looking at the table to figure out how the table looked at earlier stages.

[amd_man2005]

No.....
When binary data is written, it permanetly affects whatever it is written on, be it a hard drive or even RAM. In practical terms, writing a one over a zero

Data has to be overwritten many times to make it unrecoverable. I used to have something as a part of "System Mechanic" called "the Incinerator" and it overwrote everything I deleted 9 times, making it unrecoverable

[Darthtanion]

Folks seem to be getting wrapped around the axle regarding the recovery of data from a piece of media. Without getting into too much detail, the overwritten data can be recovered but only to a certain extent. The full file structure usually can't be fully retrieved, but the data recovered can still have evidentiary value.

[DigitalDD]

i don't know of a good free evidence eliminator but to be honest most of the ones i've seen are scams. The best of the pay for ones is the one Steganos makes: http://www.steganos.com/?product=SIAPRO6&language=en

they also make great encryption products if anyone is interested..

their security suite 6 includes something called Internet trace destructor which is about as good as you can get.

http://www.steganos.com/?product=SSS6&language=en

[Yawgm0th]

Does nothing? It's not like piling sticky notes on top of another, where you can peel back the stack and see what was there before.

Actually, it is.

http://www.cs.auckland.ac.nz/~pgut001/pubs/secure_del.html

A paper on the Secure Deletion of Data from Magnetic and Solid-State Memory, which exposes a number of myths about the deletion of data, shows how data can be recovered long after it should have been erased, and indicates a method of erasure that should make it a considerable challenge to recover any deleted data. This paper was presented at the 1996 Usenix Security Symposium, but you had to attend the conference to see the cool colour slides of supposedly overwritten disk data which wasn't really overwritten (they were too big to fit in the paper itself).

If you read the article you'll see that Peter Guttman proved that overwriting any number of times could not render files unrecoverable, only more and more difficult to recover. To save you the time of reading through it, here's the conclusion:

Data overwritten once or twice may be recovered by subtracting what is expected to be read from a storage location from what is actually read. Data which is overwritten an arbitrarily large number of times can still be recovered provided that the new data isn't written to the same location as the original data (for magnetic media), or that the recovery attempt is carried out fairly soon after the new data was written (for RAM). For this reason it is effectively impossible to sanitise storage locations by simple overwriting them, no matter how many overwrite passes are made or what data patterns are written. However by using the relatively simple methods presented in this paper the task of an attacker can be made significantly more difficult, if not prohibitively expensive.

Basically, unless it relates to military or state secrets (or anything along those lines), it becomes more trouble than it is worth to recover data that has been overwritten more than three times. However, it is possible to recover data from both RAM and HDDs unless they are destroyed.


Bleh, Darthtanion summed it up quite well anyway. ;)

[Darthtanion]

Bleh, Darthtanion summed it up quite well anyway. ;)

Sorry to beat you to the punch, but this IS one of my job-related areas after all. :)