I love it when some one comes up with a wiping tool that leaves
information behind. This tool presents some interesting scenarios. For
imaging, the unused space on the disk would have a timestamp indicating
when the disk was wiped before use. For forensics, it is rather
frustrating to do an exam and find that the disk was wiped. In this
case, you would at least have evidence of when it might have been wiped.
Just thoughts,
Jason
Simson Garfinkel wrote:
I have found a most interesting drive on the secondary market.
Every block of the drive contains the following:
10 digit decimal number with the block number.
A timestamp
The capital letter "E" filled to the end of the block.
It looks to me like this drive was properly sanitized with some tool.
Is anybody familiar with such a tool as this? I'm very curious,
because I've previously suggested filling drives with E's --- but the
idea of writing individual sector numbers and timestamps had not
previously occurred to me.
Thanks!
