|
|
22/05/2004 |
|
 |
Restoring deleted files 3/3 Kai Chandler delves into restoring deleted files - Part Three
In Part One of this series of three articles on restoring deleted files, we looked at the Recycle Bin and how to restore deleted files held there. In Part Two we focussed on recovering deleted files even after they’ve been removed from the Recycle Bin. This third and final part covers secure deletion of files. As there are so many ways of restoring deleted files, how can we be sure a sensitive file has been properly erased? It’s really a case of ‘horses for courses.’ Someone protecting government or commercially sensitive information may go to more extreme lengths than someone deleting routine office files. Single Pass files The simple answer is to use a software tool to overwrite a file with other data in a single pass. But is this enough? Department of Defence Method In the hands of a forensic technician, a hard disk can be made to reveal data even after it’s been overwritten once. The US Department Of Defence recommends that the data area is overwritten with 0s, then 1s and then once with pseudo-random data. But is this enough? Gutman method Peter Gutman of the Department of Computer Science, University of Auckland reported in his paper, "Secure Deletion of Data from Magnetic and Solid State Memory" that "…it is effectively impossible to sanitise storage locations by simply overwriting them, no matter how many overwrite passes are made or what data patterns are written." Overwritten data can be recovered using magnetic force microscopy, in which the magnetization patterns on the hard disk surface are made visible. However, it’s generally accepted that 35 passes of overwriting is as secure as it gets. Of course, the more overwrites, the longer it takes. Beware hidden copies Unfortunately for those wishing to hide their tracks, copies of the deleted files may be hidden elsewhere on the hard disk such as the slack space between used disk sectors, or in Windows’ swap files.
There’s a wealth of information on the subject of secure file deletion at the SANS Institute Information Security Reading Room http://rr.sans.org/incident/index.php
|
