On Sunday 04 Sep 2005 18:11, Randall R Schulz wrote:
Mike,
On Sunday 04 September 2005 09:56, Mike wrote: <SNIP>
Data recovery experts are able to undo several writes to a disk, which is why wipe disk programs do several passes, and agencies that are concerned about loss of data grind up the disk afterwards rather than take the chance that someone may have improved the technique to read wiped data.
Even assuming this claim is valid, why on earth would anybody go to these lengths?
OK, one of my close friends is head of IT auditing for a major City law firm. Recently, a dispute arose between two of their clients over a clause in a contract. Basically, one party claimed a rewording had not been authorised. Several hard drives and backup sets were analysed by a third party data recovery outfit who recovered a complete edit trail of the relevant documents. Some parts had to be extracted from over-written temporaray files because intermediate copies of the documents had been deleted and didn't occur in the nightly backups. This being a law firm dealing in contracts amounting to many millions of pounds each, they keep copious backups. The fact the intermediate documents were deleted may or may not be a matter of criminal investigation. The edit trail of the documents in this case are currently being considered by other lawyers to assess whether they can be upheld in court. So, to answer your question - the claim IS valid, and when millions of pounds or criminal action can rest on the validity of a document it becomes worth going to those lengths.
And does anyone ever stop to apply logic to this claim? Do you think this retained data is neatly layered so you can distinguish the remnants from each of those previous write cycles?
Manifestly, it is possible. The same heuristics which are applied in the analysis of document authenticity for historical attribution and plagiarism resolution can be applied to overlapping data sets in order to separate them diachronically.
There have also been rumors that they can read data from old ram,
I'd be very sceptical about that.
and the EM leaking from your screen can be read from across the street.
But this is true, I've seen it done first hand - how do you think TV detector vans work to find licence avoiders (in the UK.) Dylan -- "The man who strikes first admits that his ideas have given out." (Chinese Proverb)