±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 36115
New Yesterday: 0 Visitors: 116

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Evidence of wiping utility

Discussion of forensic workstations, write blockers, bridges, adapters, disk duplicators, storage etc. Strictly no advertising of commercial products, please.
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

jlindmar
Member
 

Evidence of wiping utility

Post Posted: Jul 05, 06 21:15

Has anyone encountered a situation where the majority of sector bytes on a HDD have been written with 00 but, certain sectors still contain data. I recently imaged a Seagate Momentus 40 GB 2.5 HDD which did have bad sectors (read errors) and an obvious internal, mechanical problem. I know a new, unused HDD and a wiped HDD (when wiped with 00) will show 00 througout if there are no problems. I suspect the owner of the laptop attempted to have the drive wiped but, the bad sectors and hardware issue caused an incomplete wipe.

I'm curious if anyone knows of any situations, other than a new disk or a wiped disk, where bad sectors/hardware flaws can cause the overwrite of data with 00.  
 
  

youcefb9
Member
 

Re: Evidence of wiping utility

Post Posted: Jul 05, 06 22:26

that depends on how the OS implements file delete.
some secure operating system do wipe the unallocated space when a file is deleted as opposed to just deleting its entry.

If you can iron out the fact that another OS was installed, then you can narrow you assumption to a wipe utility bieng used.  
 

Page 1 of 1