Re: Cops say everything can be pulled off computers,no matter how old,article link

Responding to Ari©:

On Fri, 20 Feb 2009 13:55:09 GMT, Mike Jones wrote:

Responding to AZ Nomad:

On Wed, 18 Feb 2009 12:29:28 GMT, Mike Jones <Not@xxxxxxxxxxx> wrote:
Responding to Nomen Nescio:

[..]

Retrieving encrypted information is a proper subset of "retrieving
any and all information."

On what planet?

If it's deleted it no longer exists and there's nothing to retrieve.
So quit playing this childish little semantics game, trying to cover
up the fact that you misread the article and posted a knee jerk
response.

Huh?

A deleted file only has its header chopped off. The data is still
there until something else is written over the disk space it used.

Not if the file is zeroed.
Not if the space is reused.

True, but physical "evidence" on the disk platter itself that the file
was there remains for several overwrites, like footprints in mud on top
of other footprints, and this is beyond simple file deletion, which was
the point I was responding to.

So, simply deleting a file doesn't mean it no longer exists, it just
means its not a file with a header to protect it, a "headless corpse"
of a file in effect, which is more than enough evidence required to
conclude an investigation, be that by legitimate authorities or illegal
hackings.

The effectiveness of running over the "scene of the crime" enough times
to obliterate that evidence is dependant on who is doing the
investigation and just what they are seeking to confirm. IOW, how many
dots do they need to confirm other evidences? A lot fewer than some
might be comfortable with I'd suspect.

While the traditional wipeover process might be more effective these
days simply down to the smaller size of data "dots" on the modern HDD
platter, the effectiveness of reading old footprints is also more
advanced. Then there is the legal factor, where the focus seems to be
drifing toward legally assumed guilt rather than innocent by default.
That is where even an accusation by somebody with zero evidence can
cost millions in defense fees in some countries.

It all adds up, and the only effective way to clean a HDD platter is to
physically destroy it. Anything else is only managing risk factors.

A better option would be to avoid contamination in the first place, but
thats another subject.

It is very nice for you to take the time to teach the "data children"
but let me remind you that their idea of deleted is "d00d someone, like,
deleted my warrior on Dunes And Dumbasses. like, wow, bummer."


Ah. Advanced stuff. ;)


--
*===( http://www.400monkeys.com/God/
*===( http://principiadiscordia.com/
*===( http://www.zenwalk.org/
.

Relevant Pages

  • Re: Cops say everything can be pulled off computers,no matter how old,article link
    ... Responding to AZ Nomad: ... Retrieving encrypted information is a proper subset of "retrieving ... but physical "evidence" on the disk platter itself that the file ... The effectiveness of running over the "scene of the crime" enough times ...
    (alt.privacy)
  • Re: Cops say everything can be pulled off computers,no matter how old,article link
    ... Retrieving encrypted information is a proper subset of "retrieving ... but physical "evidence" on the disk platter itself that the file ... The effectiveness of running over the "scene of the crime" enough times ...
    (alt.privacy)
  • Re: Impossible to rationally pick a winner? (10 meg DSLRS)
    ... I've seen no evidence that suggests in-body IS is as effective. ... Images (Plus Snaps & Grabs) by Mark² ... camera at no extra cost and promises the potential for 2 to 4 ...
    (rec.photo.digital.slr-systems)
  • Re: A new early Holocene human skeleton from Brazil
    ... >> to recognise that I was responding to the literal meaning of your ... Just as soon as we see the evidence you have that I am a patent ... you are a patent attorney, and your exact professional status, since ... >Except that you did misstate it, posting what my profession is as though it ...
    (sci.archaeology)
  • Re: A new early Holocene human skeleton from Brazil
    ... >> to recognise that I was responding to the literal meaning of your ... Just as soon as we see the evidence you have that I am a patent ... you are a patent attorney, and your exact professional status, since ... >Except that you did misstate it, posting what my profession is as though it ...
    (sci.anthropology.paleo)
Loading