Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

My harddrive


  • Please log in to reply
1 reply to this topic

#1 mb58

mb58

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:05:24 AM

Posted 23 October 2009 - 12:54 PM

I often see where some poor guy/girl has had his/her hard drive seized and all the info on it looked into, usually resulting in some form of prosecution following discovery of porn, unauthorized website access while on the job, etc. My question is, and please answer in very simple terms as I am not a computer whiz, how is the information gotten off the hard drive? Why can't I look on my own harddrive and see what "they" will see? Will reformating a hard drive erase the old info?
I've read where sometimes the info found on a hard drive is several years old. Why wasn't it designed to automatically erase this stuff after a period of time? And lastly. Do they ever fill up?

BC AdBot (Login to Remove)

 


#2 DaffyKantReed

DaffyKantReed

  • Members
  • 190 posts
  • OFFLINE
  •  
  • Location:Vancouver, BC
  • Local time:02:24 AM

Posted 23 October 2009 - 03:35 PM

I often see where some poor guy/girl has had his/her hard drive seized and all the info on it looked into, usually resulting in some form of prosecution following discovery of porn, unauthorized website access while on the job, etc. My question is, and please answer in very simple terms as I am not a computer whiz, how is the information gotten off the hard drive? Why can't I look on my own harddrive and see what "they" will see? Will reformating a hard drive erase the old info?
I've read where sometimes the info found on a hard drive is several years old. Why wasn't it designed to automatically erase this stuff after a period of time? And lastly. Do they ever fill up?



Deleting files or formatting does not actually remove the data from the hard drive. In order to do this you need to overwrite the data.

http://www.dban.org/download
http://cmrr.ucsd.edu/people/Hughes/SecureErase.shtml

An application like Encase can be used to discover "hidden" data.
http://www.guidancesoftware.com/computer-f...al-evidence.htm

A common hex editor will allow you to view data in more or less the same way a forensic investigator would.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users