Darren, I don't have a policy for you, but I think you are going in the right direction. You raise a couple of interesting issues. For the purpose of fleshing out a policy, I throw out a few more questions. First, does it make economic sense to wipe drives, or would it be cheaper simply to destroy them? Hard drives are cheap, and their depreciation is quite fast. Any drive I buy today I can buy for $20-$50 cheaper in a couple of months. So what is the value of a drive that is a year or two old? Is that value worth more than the cost of wiping it? As for wiping, I may well start an argument, but I don't think it is necessary to wipe numerous times--once is enough to prevent software based data recovery. Unless you have some very valuable data on the drives, I wouldn't worry about more sophisticated, hardware focused data recovery efforts as these are quite expensive. As for wiping utilities, Maresware, AccessData, NTI, Digital Intelligence all make good wiping utilities. I wouldn't worry about file system support--use a wiping program to wipe the drive at the physical level rather at the logical. Troy Larson Computer Forensics, Electronic Evidence and Legal Support (Direct) 425-793-1988 (Cell) 425-503-5845 ntevidenceat_private AIM Address: WestCoastCFS -----Original Message----- From: Darren Welch [mailto:WELCHDat_private] Sent: Wednesday, June 20, 2001 8:45 AM To: forensicsat_private Subject: wipe utilities I am looking to draft a corporate policy requiring all hard drives to be wiped before being decommissioned, sold, donated, etc. The wipe utility must be able to make numerous (up to seven) uninterrupted passes and support a wide array of file systems (fat, ntfs, etc). Also, the software must support the ability to assign a particular hex character as the wipe character. Could anyone recommend some products? I currently use wiper for my forensic investigations and am very happy with that but I want to provide our IT group with several other acceptable options. Thanks, D
This archive was generated by hypermail 2b30 : Thu Jun 21 2001 - 12:36:36 PDT