On Sun, Sep 04, 2005 at 06:37:58PM +0100, Dylan wrote:
On Sunday 04 Sep 2005 18:11, Randall R Schulz wrote:
Mike,
On Sunday 04 September 2005 09:56, Mike wrote: <SNIP>
Data recovery experts are able to undo several writes to a disk, which is why wipe disk programs do several passes, and agencies that are concerned about loss of data grind up the disk afterwards rather than take the chance that someone may have improved the technique to read wiped data.
Ummm, yea, and the good people over at... Can't say, but they can read off a HD that has been on fire, and even after 49 overwrites.
Even assuming this claim is valid, why on earth would anybody go to these lengths?
Lol, you've never seen people in high tech espionage?
OK, one of my close friends is head of IT auditing for a major City law firm. Recently, a dispute arose between two of their clients over a clause in a contract. Basically, one party claimed a rewording had not been authorised. Several hard drives and backup sets were analysed by a third party data recovery outfit who recovered a complete edit trail of the relevant documents. Some parts had to be extracted from over-written temporaray files because intermediate copies of the documents had been deleted and didn't occur in the nightly backups. This being a law firm dealing in contracts amounting to many millions of pounds each, they keep copious backups. The fact the intermediate documents were deleted may or may not be a matter of criminal investigation. The edit trail of the documents in this case are currently being considered by other lawyers to assess whether they can be upheld in court. So, to answer your question - the claim IS valid, and when millions of pounds or criminal action can rest on the validity of a document it becomes worth going to those lengths.
Why not just take all that and say instead: Deleted isn't.
And does anyone ever stop to apply logic to this claim? Do you think this retained data is neatly layered so you can distinguish the remnants from each of those previous write cycles?
Manifestly, it is possible. The same heuristics which are applied in the analysis of document authenticity for historical attribution and plagiarism resolution can be applied to overlapping data sets in order to separate them diachronically.
There have also been rumors that they can read data from old ram,
I'd be very sceptical about that.
I wouldn't, seen inside the FBI ;)
and the EM leaking from your screen can be read from across the street.
Lol when I was young I used to use a TV on a certain channel and cordless phone to tap into calls. This isnothing new.
But this is true, I've seen it done first hand - how do you think TV detector vans work to find licence avoiders (in the UK.)
Dylan
-- "The man who strikes first admits that his ideas have given out." (Chinese Proverb) ^ That is awesome!
-Gore / Allen
-- Check the headers for your unsubscription address For additional commands send e-mail to suse-linux-e-help@suse.com Also check the archives at http://lists.suse.com Please read the FAQs: suse-linux-e-faq@suse.com