2 replaced http://askubuntu.com/ with https://askubuntu.com/
source | link

could you recommend what I should do to keep someone in computer forensics from finding any deleted files or files for that matter?

Securely delete files, and erase over the empty space on your hard disk with a three-pass algorithm. There's a great guide for that here, on AskUbuntuhere, on AskUbuntu. Technically you can recover stuff that has been passed with less than 51 passes, but that's with highly specialized equipment and lots of motivation. Unless you're the world's largest exporter of drugs, hitmen, pirated movies, and child pornography all at the same time, this kind of attack would most likely not be leveraged against you. If you are, cut it out man! :P

Now to the meat of your question. I've found it's easier to do forensics on virtual machines because they're portable and snapshots remove a lot of the logistics. However, if you strongly encrypt the vdmk file with a different passphrase than the host, do not save snapshots, and keep Virtualbox from spewing things all over the filesystem, that would in theory be more secure than just a host OS.

Virtual machines also give you the distinct advantage of being able to shred (securely delete) your computer. Shredding the virtual machine directory would be quicker than using Darik's Boot and Nuke, and it wouldn't look very suspicious at first glance.

As with all questions like this, you have to keep in mind the probability of a situation like this happening. Don't live in a moated castle to keep out the unicorns.

could you recommend what I should do to keep someone in computer forensics from finding any deleted files or files for that matter?

Securely delete files, and erase over the empty space on your hard disk with a three-pass algorithm. There's a great guide for that here, on AskUbuntu. Technically you can recover stuff that has been passed with less than 51 passes, but that's with highly specialized equipment and lots of motivation. Unless you're the world's largest exporter of drugs, hitmen, pirated movies, and child pornography all at the same time, this kind of attack would most likely not be leveraged against you. If you are, cut it out man! :P

Now to the meat of your question. I've found it's easier to do forensics on virtual machines because they're portable and snapshots remove a lot of the logistics. However, if you strongly encrypt the vdmk file with a different passphrase than the host, do not save snapshots, and keep Virtualbox from spewing things all over the filesystem, that would in theory be more secure than just a host OS.

Virtual machines also give you the distinct advantage of being able to shred (securely delete) your computer. Shredding the virtual machine directory would be quicker than using Darik's Boot and Nuke, and it wouldn't look very suspicious at first glance.

As with all questions like this, you have to keep in mind the probability of a situation like this happening. Don't live in a moated castle to keep out the unicorns.

could you recommend what I should do to keep someone in computer forensics from finding any deleted files or files for that matter?

Securely delete files, and erase over the empty space on your hard disk with a three-pass algorithm. There's a great guide for that here, on AskUbuntu. Technically you can recover stuff that has been passed with less than 51 passes, but that's with highly specialized equipment and lots of motivation. Unless you're the world's largest exporter of drugs, hitmen, pirated movies, and child pornography all at the same time, this kind of attack would most likely not be leveraged against you. If you are, cut it out man! :P

Now to the meat of your question. I've found it's easier to do forensics on virtual machines because they're portable and snapshots remove a lot of the logistics. However, if you strongly encrypt the vdmk file with a different passphrase than the host, do not save snapshots, and keep Virtualbox from spewing things all over the filesystem, that would in theory be more secure than just a host OS.

Virtual machines also give you the distinct advantage of being able to shred (securely delete) your computer. Shredding the virtual machine directory would be quicker than using Darik's Boot and Nuke, and it wouldn't look very suspicious at first glance.

As with all questions like this, you have to keep in mind the probability of a situation like this happening. Don't live in a moated castle to keep out the unicorns.

1
source | link

could you recommend what I should do to keep someone in computer forensics from finding any deleted files or files for that matter?

Securely delete files, and erase over the empty space on your hard disk with a three-pass algorithm. There's a great guide for that here, on AskUbuntu. Technically you can recover stuff that has been passed with less than 51 passes, but that's with highly specialized equipment and lots of motivation. Unless you're the world's largest exporter of drugs, hitmen, pirated movies, and child pornography all at the same time, this kind of attack would most likely not be leveraged against you. If you are, cut it out man! :P

Now to the meat of your question. I've found it's easier to do forensics on virtual machines because they're portable and snapshots remove a lot of the logistics. However, if you strongly encrypt the vdmk file with a different passphrase than the host, do not save snapshots, and keep Virtualbox from spewing things all over the filesystem, that would in theory be more secure than just a host OS.

Virtual machines also give you the distinct advantage of being able to shred (securely delete) your computer. Shredding the virtual machine directory would be quicker than using Darik's Boot and Nuke, and it wouldn't look very suspicious at first glance.

As with all questions like this, you have to keep in mind the probability of a situation like this happening. Don't live in a moated castle to keep out the unicorns.