Five on Forensics Page 1 - Craig Ball

<strong>Five</strong> on Forensics
© 2002-2008 Craig Ball All Rights Reserved
the deleted data—stays on the drive until it is magnetically overwritten by new data (and can
even survive overwriting to some extent—but we’re getting ahead of ourselves).
If we return to our library card catalogue analogy, pulling an index card out of the card
catalogue doesn’t remove the book from the shelves, though consulting the card catalog,
alone, you’d think it’s gone. Deleting a computer file only removes the card. The file (the
“book” in our analogy) hangs around until the librarian needs the shelf space for new titles.
Let’s assume there is a text file called secrets.txt on your computer and it contains the
account numbers and access passwords to your Cayman Islands numbered account. Let’s
assume that the bloom has gone off the rose for you, marriage-wise, and you decide that
maybe it would be best to get this file out of the house. So, you copy it to a thumb drive and
then delete the original. Now, you’re aware that though the file no longer appears in its
folder, it’s still accessible in the Recycle Bin. Consequently, you open the Recycle Bin and
execute the “Empty Recycle Bin” command, thinking you can now rest easy. In fact, the file
is not gone. All that has occurred is that Windows has flipped a bit in the Master File Table to
signal that the space once occupied by the file is now available for reuse. The file, and all of
the passwords and account numbers it holds, is still on the drive and, until the physical space
the data occupies is overwritten by new data, it’s not that hard to read the contents of the old
file or undelete it. Even if the file’s overwritten, there’s a chance that part of its contents can
be read if the new file is smaller in size than the file it replaces. This is true for your text files,
financial files, images, Internet pages you’ve visited and your e-mail.
If a computer has been in use for a while, odds are that it contains a substantial volume of
unallocated file space and slack
space containing “deleted” data. To The BIG Lie
illustrate, the old laptop computer on Since the dawn of the personal computer, if you
which this paper was originally asked Microsoft, IBM, Compaq, Dell or others how
written had 1.8 gigabytes of free to guard your privacy when selling or giving away
space available on its 30-gigabyte a PC, chances are you’d be told to “delete the files
hard drive, and 98.56% of that and format your hard drive.” If you followed this
space contained deleted files: advice, DOS or Windows would solemnly warn
474,457 clusters of “deleted” data. you that formatting “will erase ALL data” on the
How long that data remains disk.” Trouble is, formatting doesn’t erase all data.
retrievable depends on may factors, Not even close. This is the big lie. Formatting
but one thing is certain: unless the erases less than 1/10 th of one percent of the
computer user has gone to data on the disk, such that anyone with
extraordinary lengths to eradicate rudimentary computer forensic skills can recover
every trace of the deleted data, bits your private, privileged and confidential data. If it’s
and pieces--or even giant chunks of not overwritten or physically destroyed, it’s not
it--can be found if you know where gone. For a fine article on this issue, see the
and how to look for it.
Jan/Feb 2003 issue of IEEE Security and Privacy
Magazine or visit:
What’s this Hex Stuff, Voodoo? http://www.computer.org/security/garfinkel.pdf
Binary numbers get very confusing
Page 25