0

My question is not about the recovery of deleted file, nor is it about the complete wiping of a disk; it's to ask about the traces deleted files leave, and how I could possibly 'see' them or visualise them?

I'm very much interested in the right to be forgotten, data loss, technological decay etc. Which made me question the traces of the deleted files. I have read that unless you physically destroy the harddrive or override the files/disk the deleted files leave traces of some sort- loose fragments of the file that used to be there.

Is there a way for me to see those fragments and access them? Can I pull metadata from them, for instance how many files were deleted, what the extensions were of those files, sizes, names etc.

0

At a high level, the answer is, that we know something about the files or directory structure. If we know something, that means that we can look for it on a disk, even if it is not in the current directory tree.

This may sound very abstract, and it probably is. If you have a Linux system available, you can use a small (stay below the 1G if you can) USB stick for experimentation. I say small, because larger takes more time.

On the USB stick, create a file with an text editor, with something like this:

't Was brillig and the slythe toves
 did gyre and gimble in the wabe

Once you are satisfied that the file is there, delete it.

Plug it in your Linux system and do

sudo strings /dev/sdx1 | grep brillig

(replace devx1 with our actual device name). You should see the first line of Jabberwocky. It this case we knew it was ASCII-text (so we used strings to filter it out) and it contained brillig.

In most files, there is a starting set of bytes (called Magic Number) that allows you to determine what kind of file it is. For example, if you see a sector starting with 0xffd8, there is a fair chance that it is the beginning of a JPEG file (not certain, but a fair chance). Wikipedia has a whole list of those magic numbers.

There are many tools in the forensics discipline, that might even allow the recovery of files. On the low-level, the Linux/Unix dd allows you to low-level copy parts of the disk file.

| improve this answer | |
  • Thank you! However I don't have a linux system nearby (and the schools etc closed). I do wonder, with these magic numbers, is is possible to figure out how many files of which extension where deleted on the said usb? Even if this is an estimate maybe? (just some random thoughts here, just writing down my stream of thought) – user229077 Mar 16 at 18:40
  • @user229077 You can use binwalk to check for such file signatures. It will read the file (in this case, /dev/sdx1) to check for things like those magic bytes. binwalk will report what files (using their file signatures) are embedded in a file and where they are in the file, – John Zhau Aug 14 at 3:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.