Wednesday, July 2, 2008

A Little TV Time.

A few months ago I was interviewed by WRAL-TV about computer forensics. While the interview went well, understand that over an hour of interview was condensed down to about 15 seconds.

Although it sounds like I mean that nothing can ever be deleted from a computer, etc, the fact is that some things are not recoverable. While deleted items are not lost from computers and other types of storage media normally, deleted items can be overwritten rendering them unretrievable. Also, it is possible to permanently erase something if you know how and have the right tools.

Having added all those clarifications, here is a link to the video if you are interested...

WRAL-TV Interview - Deleted Data Can Be Used Against You.

...

1 comment:

  1. While deleted items are not lost from computers and other types of storage media normally, deleted items can be overwritten rendering them unretrievable.

    Without a doubt. The old school stuff from the DOS era still applies (ie, 'deleted' doesn't mean gone...) but XP, for example, has it's own anti-forensics techniques built right into the OS. Add to that apps like Word, etc., and there's a great deal of writing to the disk that goes on during normal operations of a system, which means that deleted files will be overwritten.

    Other issues I constantly run into include no logging (it was disabled) or the action itself is not logged by any mechanism, as with copying files from one drive to another...).

    ReplyDelete

I have moderated my comments due to spam.