- This topic has 14 replies, 11 voices, and was last updated 19 years, 5 months ago by
.
-
Posts
-
In our local newspaper, there was a story of a woman who had been arrested and fined by the state for illegal downloading of music. Apparently this woman’s computer had been searched and all the evidence needed was collected from the computer, even though this woman had “deleted” all temporary internet files, cookies, the illegal downloads, etc… What raised questions for me was that this woman had “deleted” all incriminating evidence against her WEEKS prior to the computer being searched… how did the law enforcement find all the “illegal” stuff even though all of the incriminating evidence had been deleted? When you “delete” your internet history, cookies, and recycle bin, is it in fact deleted, or does it actually stay on your HD? If it does, how do you truly delete that kinda stuff?
There are 1001 reasons why they could find clues that the computer was used for such things. What I don’t get is why they didn’t format it completely when they knew it was going to be searched?
One of those reasons is that it’s pretty simple to get hold of data recovery software. I have one such program called Recover My Files. It does take a while to search when trying to recover a disk format, and some of the files it finds are corrupted, but some complete files can be found.
What I’m not gettin is why they searched her. Did they have a search warrant? Isn’t it needed even in a case like this. What evidence did have to get a warrant? I am lost.
I’ve seen on Case Evidence files in Court TV where even after files have been deleted an expert can still examine the harddrive and possibly go back to past points and get clues as to what they had before or actually even recover it. I forget the actual process but it is possible. I think deleted files can be recovered, but purged files are permanently gone. Someone correct me if I’m wrong.
You’re not really wrong, but – for those interested – a little technical info:
A harddisk is a device in a computer that stores massive amounts of data, such as the operating system, the saved files and documents and basically everything else. The data in the harddisk is, simplified, devided in two parts.
1. The file allocation table
2. The actual dataThe file allocation table looks like this:
FOLDER: “C:MP3”, SECTOR 4838571
FILE: “C:MP3Bruce Springsteen – The River.mp3”, SECTOR 4838572-4838576The actual data looks like this:
4838571 = FOLDER DATA
4838572 = MP3 DATA part 1
4838573 = MP3 DATA part 2
4838574 = MP3 DATA part 3
4838575 = MP3 DATA part 4Knowing this, you can ask the following question:
What actually happens when I delete a file?
That’s where the problem here lies. When you delete a file, your computer removes the file only from the file allocation table. This means that the actual file data is still there, but the data isn’t identified or recognized in any way. The data will only get lost once it is overwritten by other data.
There is software to undelete files since a long time (starting with DOS). The software looks at the data that has no reference in the file allocation table and tries to make sense of the data. Often this method works quite well.
Now there are ways to permanently wipe files (making further recovery impossible), the most well-known way is formatting your harddisk. A quick format will only remove the file allocation table, but this will not remove the actual data. A full format will remove the file allocation table, but also the file data. This makes recovery impossible.
As for ‘specialists’ going back to previous ‘harddisk points’, that is complete nonsense.
don’t forget all the index.dat’s that get left everywhere by windows.. Plus you don’t need to format to get rid of files, OpenBSD and such can be configured to overwrite the sections of deleted files for security reasons quite easily, and I know there’s programs out there that do it for linux and windows as well, just can’t remember the names of them right now.
How do you permanently delet files so that recovery is impossible, without formatting your HD (won’t you have to reinstall your OS if you reformat the HD?)?
Well I have Mcafee Virus Protection and it comes with a thing called FileShredder that (as said by Mcafee) permanently deletes files. Does anyone know if it really works?
FirefoxMan wrote:How do you permanently delet files so that recovery is impossible, without formatting your HD (won’t you have to reinstall your OS if you reformat the HD?)?
shredders, but it’s better to format your hd then overwrite it with 0’s, then reinstall the OS.I know a way of doing this. I am unable to find the exact url of the page but it is located at data recovery forum.
The hard disk internal structure consist of 2 things:-
1. The file allocation table
2. The actual data
FAT contains the pointer to all the location where tha data stores,that linked with each other.
If the file is deleted from the specific location the location will be empty but the FAT contain the link to that location and it is easy to recover that file from location.
So,there is 2 way to delete the file permanently(that can’t recover using any s/w) is-:
1.Fill that location of HDD from which the data is deleted by adding some kind of data(u can say it as a rewrite but actually its not).
2.Just format the FAT.After formatting the FAT nobody can recover the data using s/w,but still there is a mechanism for recovery using h/w that is known by the HDD desingners according to the structure of particular company HDD.
@shergill 207769 wrote:
The hard disk internal structure consist of 2 things:-
1. The file allocation table
2. The actual data
FAT contains the pointer to all the location where tha data stores,that linked with each other.
If the file is deleted from the specific location the location will be empty but the FAT contain the link to that location and it is easy to recover that file from location.
So,there is 2 way to delete the file permanently(that can’t recover using any s/w) is-:
1.Fill that location of HDD from which the data is deleted by adding some kind of data(u can say it as a rewrite but actually its not).
2.Just format the FAT.After formatting the FAT nobody can recover the data using s/w,but still there is a mechanism for recovery using h/w that is known by the HDD desingners according to the structure of particular company HDD.
Er… This was already stated throughout the entire thread, no need to repeat everything. The person who posted this is long gone, as well, I’m sure. A few pointers are to read the entire thread before replying as well as checking the dates of the posts.
- You must be logged in to reply to this topic.