1

I know that every file on a computer is written to a specific disk location. Using Python I want to locate the file and overwrite it in order for it to be impossible to retrieve it. Using an SSD I believe that is impossible to do because of wear leveling. Is it possible on a HDD?

The reason why I'm asking this is because I have to write one script to do an anti forensic deletion and another one to recognise the pattern of this "weird" move. An easy approach for me would be to just generate random files until it will cover the whole free space of a computer, but it wouldn't be so professional for a master thesis. Do you have any ideas for an other way on how to do it?

2

It sounds like the point is to discover if anti-forensic techniques leave their own distinctive, forensically-detectable evidence behind.

In that case, you can probably choose to wipe the files with any method you want, regardless of how easy or difficult it is to recognize that wiping was performed, or what language is used to create the wiping routine. You could overwrite files with all zeros, all ones, alternating ones and zeroes, single or multiple passes, randomly generated bytes, the output of a lorem ipsum generator, or even thousands of random web pages using something like wget https://en.wikipedia.org/wiki/Special:Random.

As you mentioned thesis, you should talk to your advisor to figure out the level of sophistication expected. He or she might want to see the effectiveness of the wiping tools you created, but he or she may be even more interested in the effectiveness of your "wipe-detector". The advisor might want to see if your detector is capable of recognizing fingerprints of some of the various publicly available wiping tools, such as sdelete, DBAN, or others. For example, the OS may record when the tool was run in the application event log; the tool may leave a telltale series of "low disk space" entries in the system event logs; a recognizable pattern of deleted file names in the file allocation table; a sudden reduction in the size of backup files created in the backup logs. Caught early enough, you might discover a unique disk fragmentation pattern, or if these tools leave specific traces hiding in the swap files. To me, that's the level of sophistication I'd expect to see from a master's thesis.

Given all of that, it sounds like "Using Python, I want to overwrite" may be a premature statement. You may want to dig a bit deeper to figure out what you need to accomplish. And be sure to discuss this with your advisor.

  • Great answer thank you. I have 2 more questions. Is there a way to write zeroes or I have to create a file and fill it with zeroes? Also the wear leveling of the SSD, means I have to write the whole disk, so that makes it kind of obvious the existence of an anti-forensic tool? – user3347882 Jun 13 '16 at 22:49
  • The only practical way to write to disk from user mode is to create a file. Wiping SSD is even trickier than simply filling the whole SSD with random files. SSDs will reserve extra blocks for use when sectors go bad, but they may get rotated in and out of usage. Even a 100% full disk overwrite is not guaranteed to completely wipe all the legacy data. As far as defeating forensic examinations, there's a lot you'll have to figure out on your own. Your best bet is to study existing wiping tools and learn how to discover their patterns. – John Deters Jun 14 '16 at 13:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.