Re: computer forensics question

Top Page
Attachments:
Message as email
+ (text/plain)
Delete this message
Reply to this message
Author: Devin Rankin
Date:  
To: Main PLUG discussion list
Subject: Re: computer forensics question
I don't know.

I was a computer forensic guy for the Phoenix Police Department. I can tell
you that no local or state agency has any equipment to read a drive once it
has been erased and over written, even once.

There have long been rumors that equipment existed to read the data on a drive
that had been over written by detecting a residual magnetic charge of the
original data. But with something being over written 3 or more times, I
really don' know how you would sort out what was original and what was the
3rd or 4th pass of random characters.

Maybe this was possible on the older, lower density drives, but with todays
drives, and how tight the tolerances are getting between data tracks, I think
its getting less and less likely.

I trained with all kinds of government agent, from military to IRS, and none
of then had ever actually seen any equipment that would really be able to
read erased data. If the equipment exists that can do it, its very rare, or
very secret or both.

Devin


On 10/08/2005 10:08 pm, Technomage wrote:
> ok,
> I've been wrangling this question around a while and haven't been able to
> gain any real answers that make sense (and my knowledge base on this is
> lacking due to being 10 years out of date).
>
> so, here goes:
>
> is it possible, given the current understanding of the laws of physics, to
> so erase a hard drive as to make it virtually impossible to recover ANY
> data of any usefulness whatsoever (up to and including either a major
> government or major multinational corporationthrowing huge sums of money at
> the problem in an attempt to recover)?
>
> so far, the only answer I have found is: a conditional no (any or all the
> data can be recovered, including the previously written data multiple
> layers deep).
>
> is there a correct 9and unconditional) answer for this arguement?
> ---------------------------------------------------
> PLUG-discuss mailing list -
> To subscribe, unsubscribe, or to change you mail settings:
> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss

---------------------------------------------------
PLUG-discuss mailing list -
To subscribe, unsubscribe, or to change you mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss