Hot answers tagged

58

This 2013 article analyses retention time for several DRAM chips. Among the relevant information, one may list the following: Retention time depends on a lot of things, including the values of neighbouring bits. A DRAM bit is a potential well, and it loses its contents by moving charges from or into neighbouring areas, so whether there is room in these ...


19

The reason you write '0' instead of '1' has to do with the way magnetic storage encodes the 0 and the 1. a long explanation of it can be found on Wikipedia under Run-length_limited. In short RLL is the methodology used to store the '1' and '0' and it is more complex than just to store the bit values themselves. On a side note to make the drive more like it ...


17

There are mechanisms that could result in data remanence in DRAM beyond the charge stored in the gates (which is typically gone in seconds, especially at normal elevated operating temperature). One is movement of ionic contaminants which can cause slight shifts in thresholds. This could be the 'burn in' that Tom's answer refers to. There may not be any ...


11

Factory resets reset your phone to a stock like state but does not remove your data, just applications. This leaves some data behind. The best way to prevent this data from being recovered is to encrypt the phone, and use wipe data/factory reset from the recovery menu. This way you don't have to download a ton of data and you can be fairly certain your ...


10

This is enough, or not, depending on the disk technology, the budget of the attacker, and some other details. When you fill a disk with zeros, you force the filesystem to reuse free blocks, and rewrite them. So, as first order approximation, this looks good for you: your file contents are overwritten. However, there are details: On some operating systems ...


10

There are any number of different ways it can be done. In large part, the easiest way is following the link pointers to each of the chunks, but that isn't the only way by any means. (The MFT isn't the only source of those links in many file systems as well.) At a lower level, it can identify all the chunks and try to match some of them up on content if the ...


10

It is not possible to create a digital communication that will self-destruct after a certain amount of time (or upon sender's command). This because of the nature of the message, which once reaches the recipient' machine can be copied at will. This applies to email as well as instant messages. Therefore any service promising you messages that ...


9

Unlikely. It's AES-CBC-128, so there's no chance of you cracking the key. There are a few tools (e.g. Volatility, or Elcomsoft's forensics suite) that can recover the master key from a system memory dump, but that only works if the drive is already mounted and unlocked.


9

There are a few ways to solve this situation. One is to have the camera always encrypt one of the session keys to a camera backup key. The camera backup key is generated on account setup of the camera and a password is generated that is used to encrypt the backup key. This password is never stored on the camera itself. Your online storage would store the ...


8

Usually Factory Reset is probably enough for removing almost all data stored internally by the Android phone. Menu> Settings> Privacy> Factory data reset> Erase phone storage Un-tick backup if not necessary. To be double sure(Extra paranoid mode): Do the Factory reset and then Menu> Settings> Security> Encrypt phone> Encrypt ...


8

As a former developer for one of the biggest Security Card System organizations in the world, I can confirm with you that the answer is resounding YES depending on the manufacturer and the type of the card. For example, my company used the standard ISO encoding standard for magnetic stripes for Debit cards, and quite frankly there is not much confidential ...


7

The best citation I can give is from Overwriting Hard Drive Data: The Great Wiping Controversy, which was published as part of the 4th International Conference on Information Systems Security, ICISS 2008. You can view the full text of the paper by viewing the book on Google Books, and jumping to page 243. The following excerpt is from their conclusion: ...


7

What you describe is the worst possible practice possible apart from just handing it over. From a security standpoint it poses significant risks to both the previous and current parties. The easiest way to reformat PCs is to use what is called a "golden image" this image is a windows image you: keep up to date only install the bare minimum of programs ...


7

If you use sdelete from Microsoft (http://technet.microsoft.com/en-us/sysinternals/bb897443.aspx) you don't have to install anything. It has an option to fill the unused disk space with zeroes too. If you already deleted the files this is what I'd just to make sure that nothing remains of the original file.


7

Did a test with three different cards. Card 1 (Non-Chipped MC Pre-Paid) Swiped the card through a USB Magtek MSR Reader, and noted results. Got a clean Track 1 and Track 2 data. Cut the card vertically straight down the middle into a left piece and right piece. Took each piece and tried swiping through the card reader. Would only get an %E?;E? which ...


6

First check with your legal expert if there are any laws in your country which require you to have a minimum retention period. For instance depending on your industry you might have to take into account either of these regulations: Sarbanes-Oxley regulations: To comply with SOX guidelines, companies must retain auditable emails for a minimum of five years ...


6

How does the Recycle Bin work? When you delete a file from a hard drive the file is moved to a folder named $Recycle.Bin on the same drive. So when you delete the file D:\Work_Files\SuperWeirdPr0n.mp4 it's actually moved to D:\$Recycle.Bin. How does that apply to TrueCrypt volumes? Well, pretty much the same. When you send a file from a mounted encrypted ...


6

In theory any device can store anything, because it is speced to meet an interface, not spec'd for its implementation. Realistically speaking, the answer is more murky. This, by the way, is where SSD's get so interesting because there is no accepted way to tell a SATA SSD to "wipe everything" (edit: no way that is reliably trustworthy, at least) From ...


6

The best cryptographers use cryptography only when necessary. That being said, this proposed design is needlessly complex. Your design incorporates two different hash functions, symmetric and asymmetric encryption. Further more you make no mention of what attacks you are trying prevent, which leads to a superstitious design that is difficult to ...


5

The virtual machine usually stores its virtual hard disk as a normal file on the host operating system's filesystem. Think of a filesystem like a warehouse. The warehouse contains a large number of boxes (files) and a manifest that lists all of the boxes (the file table). When you delete a file, it doesn't actually destroy the data, it just deletes the ...


5

Due to the microscopic nature of current HDD internals this may no longer be possible... I once witnessed an 8" 12MB HDD having most of its data recovered after being "security wiped" with several passes of 0's, then 1's bit patterns. This may have been pre-RLL or RLE. I do not remember if the method employed had a name, which makes it difficult for me to ...


5

Self destructing emails, like email read receipts and mail services which tell you they can tell you which recipients have read your message and which have not are at best misleading and at worse a con perpetrated on ignorant managers, executives and uses who don't understand how email works. In general, all of these schemes rely on the recipient buying ...


4

Many TPMs will allow a backup to be stored of the key either prior to loading it on to the TPM or via some kind of export. As long as you have the key, you can reload it on a new TPM if the TPM fries. I actually had this exact thing happen with an IBM ThinkPad with an early TPM where the TPM circuit fried and I had to replace the system board. I was ...


4

A forensic tool such as FTK imager, is essentially a binary data reader and interpreter. Oversimplified, it reads each value and shows you both the hexidecimal (or decimal) absolute value and/or the interpreted value (such as text). Google for more examples and explanations of how FTK imager works. Notice that a forensic toolkit is merely a tool. Most ...


4

In NTFS, all of the metadata is stored in the MFT. This includes names, dates, parent folder, etc. the occupied clusters are also stored in there in a structure called data runs. The clusters storing the file data hold only file data and there is no linked list that holds info about the next or previous cluster. When a file is deleted (assuming a skip of ...


4

Yes, it is a good strategy if a disk has held sensitive data and may be accessible by others. A Google search for "wipe disk free space" finds numerous such tools. There are a couple of other considerations. One is "slack space." That's the unused space in the last cluster of a file. It's not part of free space, so it won't get wiped by many disk wiping ...


4

If you're talking about modern hard disks (spinning platters, magnetic data), then it doesn't matter what is written as long as something is written. The NIST Special Publication 800-88 Rev 1 contains the relevant guidelines. It's updated and talks about different types of media. Now they do say that the overwrite should be verified (because maybe something ...


4

It depends on how you copy them. If you do a bitwise copy, aka exactly replicating every single bit from one disk to the other, you are copying over "slack space" which is where the recovery tool will work. If you do a file copy, then the empty space of the disk is ignored, and only the segments of data attached to a file header will copy over. The ...


3

A first method is to open up the old hard disk, and extract the platters. Hard drives are usually closed with screws, so it can be unscrewed; beware, though, that it is customary for hard disk vendors to hide the screws under stickers (a disk is sealed and letting the air in can kill it, so vendors want to prevent inquisitive customers from unknowingly ...


3

It depends. If you want to delete every trace of the file, it is more complex than overwriting sectors. Depending on which file system you are using, but if e.g. NTFS: even if you fill all free space, there can be things left behind in the MFT, journaling areas, etc. If it is a very small file, the entire file can be contained in the MFT, etc Also, ...



Only top voted, non community-wiki answers of a minimum length are eligible