Tag Info

Hot answers tagged

7

This is enough, or not, depending on the disk technology, the budget of the attacker, and some other details. When you fill a disk with zeros, you force the filesystem to reuse free blocks, and rewrite them. So, as first order approximation, this looks good for you: your file contents are overwritten. However, there are details: On some operating systems ...


7

What you describe is the worst possible practice possible apart from just handing it over. From a security standpoint it poses significant risks to both the previous and current parties. The easiest way to reformat PCs is to use what is called a "golden image" this image is a windows image you: keep up to date only install the bare minimum of programs ...


6

The best citation I can give is from Overwriting Hard Drive Data: The Great Wiping Controversy, which was published as part of the 4th International Conference on Information Systems Security, ICISS 2008. You can view the full text of the paper by viewing the book on Google Books, and jumping to page 243. The following excerpt is from their conclusion: ...


5

First check with your legal expert if there are any laws in your country which require you to have a minimum retention period. For instance depending on your industry you might have to take into account either of these regulations: Sarbanes-Oxley regulations: To comply with SOX guidelines, companies must retain auditable emails for a minimum of five years ...


5

The virtual machine usually stores its virtual hard disk as a normal file on the host operating system's filesystem. Think of a filesystem like a warehouse. The warehouse contains a large number of boxes (files) and a manifest that lists all of the boxes (the file table). When you delete a file, it doesn't actually destroy the data, it just deletes the ...


5

The best cryptographers use cryptography only when necessary. That being said, this proposed design is needlessly complex. Your design incorporates two different hash functions, symmetric and asymmetric encryption. Further more you make no mention of what attacks you are trying prevent, which leads to a superstitious design that is difficult to ...


5

If you use sdelete from Microsoft (http://technet.microsoft.com/en-us/sysinternals/bb897443.aspx) you don't have to install anything. It has an option to fill the unused disk space with zeroes too. If you already deleted the files this is what I'd just to make sure that nothing remains of the original file.


4

Many TPMs will allow a backup to be stored of the key either prior to loading it on to the TPM or via some kind of export. As long as you have the key, you can reload it on a new TPM if the TPM fries. I actually had this exact thing happen with an IBM ThinkPad with an early TPM where the TPM circuit fried and I had to replace the system board. I was ...


4

How does the Recycle Bin work? When you delete a file from a hard drive the file is moved to a folder named $Recycle.Bin on the same drive. So when you delete the file D:\Work_Files\SuperWeirdPr0n.mp4 it's actually moved to D:\$Recycle.Bin. How does that apply to TrueCrypt volumes? Well, pretty much the same. When you send a file from a mounted encrypted ...


3

A first method is to open up the old hard disk, and extract the platters. Hard drives are usually closed with screws, so it can be unscrewed; beware, though, that it is customary for hard disk vendors to hide the screws under stickers (a disk is sealed and letting the air in can kill it, so vendors want to prevent inquisitive customers from unknowingly ...


3

It depends. If you want to delete every trace of the file, it is more complex than overwriting sectors. Depending on which file system you are using, but if e.g. NTFS: even if you fill all free space, there can be things left behind in the MFT, journaling areas, etc. If it is a very small file, the entire file can be contained in the MFT, etc Also, ...


3

If you want to destroy all data on your disk, why not use a file shredding tool? There are plenty of them available, and it is a lot easier solution that creating a truecrypt volume and then deleting that volume. I also don't know how truecrypt initializes volumes. It is possible that truecrypt writes random data to the volume only once, while file ...


2

TrueCrypt encrypts the whole volume, as a big bag of sectors. TrueCrypt does not know what a "file" is, it sees only sectors. It protects your data against people who steal your disk but do not know the password. The operating system manages the sectors, using some of them as metadata to describe directories and usage of other sectors for containing pieces ...


2

When you are using a HDD; writing filling it all up over and over again and changing file format and operating system and than filling it up over and over would help you. It is actually said that changing the OS and changing the file format (NFST to FAT32 etc) makes revocery pretty hard. And if you fill it up with newer data and do these practices in a ...


1

No. Adding 0s to the hard drive is easily recoverable (with a special machine). It is not If you really want to reuse a hard drive in a safe way I recommend you using the "shred" utility in linux or any other similar utility. Let's say that simply writing once over a hard disk is not enough to make the hard drive truly forget about the data that was ...


1

In addition to Lucas's answer above, you might want to start with prying the various EEPROMs off the motherboard, and reflash them with the latest firmware downloaded and verified from the manufacturers' website before soldering them back. These steps would make sure there is no persistent malicious firmware present in the box before it is shipped to the ...


1

I'd implement either disk replacement, disk circulation, or secure disk wiping, depending on your resources/time constraints. If possible, I'd take the large datacenter approach, and just remove and replace the disks, ideally destroying those that come out. Given that these will be fairly entry level machines, I'd say it would be easy to incorporate the ...


1

Nope. Symetric keys must be random. If you want to make the key recoverable, store it somewhere, or use some other recovery option. But don't generate it using some predictable algorithm or the whole system falls apart. Storing the key is far safer than generating it using a predictable system. Because when someone knows your system, then they have all the ...


1

I've had numerous discussions with forensic analysts and security IT folk, and the general consensus is that DoD wiping your drives is sufficient to destroy your data. Smashing a hard drive may be fun and cathartic, but from the research I've done, not necessary in many cases. DoD wipe your devices and then take it to an e-waste recycling facility.


1

You can't be guaranteed that your file will be deleted successfully just by trying to overwrite it with other files. You don't have any say over what sectors get written with data. Your deleted file will stay on the hard drive until the OS determines that it needs to write over those sectors. So the short answer is no. Sdelete is a sysinternals tool that ...


1

As usual, the Wikipedia page contains useful links (Wikipedia is not "The Truth" but it is a great starting point for investigating technical issues and making one's own mind). In particular, it says that: As of November 2007, the United States Department of Defense considers overwriting acceptable for clearing magnetic media within the same security ...


1

The only way to really guarantee that data cannot be recovered is (a) use full-disk encryption, so all sensitive data is already encrypted before it hits the media, and then (b) destroy the encryption key when you no longer want the data on that media. spinning disks Yes, a single zero-fill, on a spinning disk, is adequate. Civilian data recovery ...


1

Quick and dirty data recovery for Linux often involves dd for disk imaging. ddrescue if you find you have to deal with bad sectors. May not be optimized for flash memory (i.e. sd card/usb stick etc) though. photorec for scanning raw disk images for various data formats (maybe copy the image and zero out the known files, so you only find deleted ones?). ...



Only top voted, non community-wiki answers of a minimum length are eligible