Re: Program to wipe data from disk free space

From: Kurt Seifried (btat_private)
Date: Sun Aug 10 2003 - 14:03:11 PDT

  • Next message: Keith Oxenrider: "Re: Program to wipe data from disk free space"

    Like most first attempt wiping programs this one fails miserably. It fails
    to wipe slack space (i.e. 16k data allocations, a 10k file leaves 6k unused,
    a previous file may have used it). It fails to wipe MFT space (small files
    may be stored directly in the MFT). This would leave a TON of evidence. My
    advice: Buy wiping software that actually works. I did some testing, the
    commercial ones don't even fare to well, none of the amateur ones came even
    close to being truly effective.
    
    
    Kurt Seifried, kurtat_private
    A15B BEE5 B391 B9AD B0EF
    AEB0 AD63 0B4E AD56 E574
    http://seifried.org/security/
    
    
    ----- Original Message ----- 
    From: <koxenrider@sol-biotech.com>
    To: <forensicsat_private>
    Sent: Saturday, August 09, 2003 9:32 AM
    Subject: Program to wipe data from disk free space
    
    
    >
    >
    > To indulge my paranoia I wrote a little ANSI C program to write random
    > data to a drive.  I wrote it targeted toward Windows, but it should work
    > with minimal editing on any machine with an ANSI C compiler.  It can be
    > found at http://www.sol-biotech.com/code/wipeIt/wipeIt.c and I placed it
    > in the public domain.
    >
    > -----------------------------------------------------------------
    > This list is provided by the SecurityFocus ARIS analyzer service.
    > For more information on this free incident handling, management
    > and tracking system please see: http://aris.securityfocus.com
    >
    
    
    -----------------------------------------------------------------
    This list is provided by the SecurityFocus ARIS analyzer service.
    For more information on this free incident handling, management 
    and tracking system please see: http://aris.securityfocus.com
    



    This archive was generated by hypermail 2b30 : Mon Aug 11 2003 - 12:37:34 PDT