Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.
226 votes
Accepted

How secure is 'blacking out' sensitive information using MS Paint?

As mentioned in the answers to a very similar question, scribbling over part of an image will destroy the original pixels, assuming that your editor doesn't store any layers or undo history in the ...
user avatar
  • 2,491
192 votes
Accepted

Secure way of masking out sensitive information in screenshots?

Yes, it can be recovered. As long as shutter does not use layer (it almost certainly does not) and as long as the black is really all black (it must not be transparent), it is enough. The picture ...
user avatar
159 votes

Are the sticks of RAM in my desktop computer volatile? Is it safe to sell them?

Yes, they're safe. Consumer memory DIMMs use volatile SDRAM memory. Volatile means that it does not hold its state after you turn it off. SDRAM memory chips are constructed from an array of memory ...
user avatar
  • 132k
156 votes

Why is this 435 × 652 pixel JPEG over 6 MB?

Short answer: It's an artifact of Nikon Picture Project I had difficulty finding "Nikon Picture Project" but finally found a 1.5 version to try. The last version produced was 1.7.6 . It turns out ...
user avatar
  • 7,298
80 votes

Secure way of masking out sensitive information in screenshots?

You don't even need to use an image editor in this case to recover the "redacted" text. Simply zooming in on the image is enough to read it. So I would say that yes, it most certainly is possible to ...
user avatar
  • 757
71 votes

Secure way of masking out sensitive information in screenshots?

In this case the image can be recovered very well As others already pointed out the dark patch is not completely black. It has a transparent effect and only darkens the original image. The original ...
user avatar
71 votes

Are the sticks of RAM in my desktop computer volatile? Is it safe to sell them?

Yes, they’re safe to sell. No consumer PCs use non-volatile RAM for their main memory.
user avatar
  • 10.1k
64 votes

How secure is 'blacking out' sensitive information using MS Paint?

Ditto Ben N, but let me add a couple of points that are too long to fit as comments. I'd emphasize the distinction between layered and un-layered data formats. Drawing a black box over a section of a ...
user avatar
  • 859
62 votes
Accepted

Is a password-protected stolen laptop safe?

Is a password-protected stolen laptop safe? No. The immutable laws of security say: Law #3: If a bad guy has unrestricted physical access to your computer, it's not your computer anymore. It doesn'...
user avatar
  • 1,013
46 votes
Accepted

Can you recover original data from a screenshot that has been 'blacked out'?

Usually the PNG format does not support multiple layers. So when you draw over something, whatever was there before is lost. However, the PNG format supports storage of an unlimited amount of ...
user avatar
  • 48.8k
45 votes
Accepted

Is NTFS encrypted by default?

No, NTFS is not encrypted by default. can data be read straight from the sectors in clear text? Yes, by default NTFS files are unencrypted. Since NTFS 3.0, EFS (Encrypting File System) is a ...
user avatar
  • 71.8k
45 votes

Why is this 435 × 652 pixel JPEG over 6 MB?

This was less interesting than it seemed at first. The user might just have a broken camera, broken memory card, or malfunctioning photo editing software that fails to save the full resolution image, ...
user avatar
40 votes

At what point is deleted data irrecoverable?

This depends a lot on what medium is used to store the data and what you consider "irrecoverable". "Deleting" data mostly does not what most people think it does. Simply put, after a standard ...
user avatar
  • 1,144
38 votes
Accepted

Is there a need to image the hard drive when using a write blocker?

Because normal read operation on a disk presenting error (physical or logical) may cause data corruption, destruction and even writing to recover bad blocks. You have to keep in mind that even the ...
user avatar
  • 3,033
30 votes
Accepted

Why is this 435 × 652 pixel JPEG over 6 MB?

As other commenters have mentioned, the file contains data from Nikon Picture Project. What if you couldn't run that software, but you still wanted to know what was hidden inside? Nikon's Picture ...
user avatar
  • 495
29 votes

Secure way of masking out sensitive information in screenshots?

Yes, the text can be unmasked, either by simply zooming in or using any of the techniques - but not restricted to - pointed by pabouk and Peter answers. I have clearly asked for the correct/most ...
user avatar
22 votes

How secure is 'blacking out' sensitive information using MS Paint?

When blacking out sensitive information in Paint the original pixels are destroyed. But using Inkscape to black out part of a vector image does not destroy the pixels, but instead covers them. If ...
user avatar
21 votes

Is a password-protected stolen laptop safe?

Just to add a very simple answer here, I regularly boot a linux live cd/usb on friends' computers who have done something weird and need to recover files, and simply copy them over to an external ...
user avatar
17 votes

How secure is 'blacking out' sensitive information using MS Paint?

As a raster image program that does not use layers nor contain an undo history after saving, overwriting sensitive pixels in Paint irrevocably changes them in the saved image. More reasoning: ...
user avatar
  • 310
17 votes

Why is this 435 × 652 pixel JPEG over 6 MB?

It's not corrupt, it's just filled with APP10 segments, containing some sort of application specific data. Nikon-specific probably, because there are Nikon-references in the APP1/EXIF segment at the ...
user avatar
  • 171
15 votes

How are attacks and APTs attributed?

As someone who runs personal honeypots and used to defend a massive global corporation, I can tell you that any attack leaves fingerprints. Styles of commands or command sequence, coding style of ...
user avatar
  • 123k
14 votes

Is it possible to recover securely deleted data from a hard drive using forensics?

Your question has a problem with the definitions of the words in it. If a HDD has been securely wiped, by definition, no recovery is possible. If a HDD has not been securely wiped, by definition, ...
user avatar
  • 9,273
14 votes
Accepted

Is it possible to prove a certain email has been sent using a certain computer?

Experts are experts. What an expert says stands in court as long as: He is an expert. The other party cannot provide another expert, who says that the first expert is wrong, and says it in a more ...
user avatar
13 votes

How secure is 'blacking out' sensitive information using MS Paint?

Already a few good answers here, saying Paint is safe. (I have no reason to believe otherwise.) Just want to add that while blacking out a rectangle that fully covers the area and any surrounding ...
user avatar
  • 231
13 votes

How can you detect kernel exploits?

No, there is nothing all kernel exploits have in common. Or at least, there is nothing unique to them and not present in standard, legal interaction with the kernel (such as using syscalls or ...
user avatar
  • 64k
13 votes

Is NTFS encrypted by default?

It actually doesn't need any forensics effort and is routinely done by Windows sysadmins. Change the password of the Windows admin by booting a toolset of choice or simply attach the disk to a ...
user avatar
  • 3,395
12 votes

Can you recover original data from a screenshot that has been 'blacked out'?

When you paint over a jpg or png file, you are not putting a sticker over the image, you are more ripping a hole on the image and filling the hole with ink. Even on Photoshop, if you export the ...
user avatar
  • 50.5k
12 votes

Is a password-protected stolen laptop safe?

As anion's answer points out, the data on your hard disk is generally not safe under the system you described. However, Windows does offer several encryption methods beyond just BitLocker, and they ...
user avatar
  • 38.8k
11 votes
Accepted

How does forensic software detect deleted files

There are any number of different ways it can be done. In large part, the easiest way is following the link pointers to each of the chunks, but that isn't the only way by any means. (The MFT isn't ...
user avatar
  • 41.8k

Only top scored, non community-wiki answers of a minimum length are eligible