> Are you saying that the spot on the drive can be a 0 with a residue of a 1?
yes, thats actually always the case for any bit that has been written to more than once, even under normal use. In the physical world, on the actual disk, its not a 1 or a 0, its a magnetic field with a certain orientation and a certain strength. The electronics normally read that field and then decide if its a one or a zero (based on certain threshold values) and then these binary values are used by the computer. When analyzing for forensics purposes, they use the information about how strong the field is - a bit that was '1' and then over-written with another '1' will have a stronger field than a bit that was '0' before it was overwritten with a '1' - and that is often enough information to determine the previous contents. This is also why people use several-pass wipes when destroying data - the more writes that have taken place since the 'interesting' data was written, the harder it will be to determine those original values. --Mike On Fri, Mar 7, 2008 at 11:22 AM, Michael Perelman <[EMAIL PROTECTED]> wrote: > Bill, I don't understand. I though that the system magnetically writes a 0 > or a 1 on > each location & that programs are available that overwrite everything with > 0's. > > > > On Fri, Mar 07, 2008 at 09:22:35AM -0600, Bill Lear wrote: > > Not reliably. First, wiping an ENTIRE disk is easy, but you have to > > hit each byte on the disk with multiple patterns of write --- > > otherwise you risk leaving enough information to recover. Writing the > > Bible over things just overlays those bytes on top of others and is > > sort of like writing 555-1212 down, then writing 123-4567 on top --- > > you can still make out the 555-1212 part, and you need to write many > > more things on top of it until it is fully obscured. > > > > Wiping a single file is MUCH harder, as the operating system or > > application may have stored copies of it in various places (temporary > > files, swap space for the OS, etc.). > > > > > > Bill > > _______________________________________________ > > pen-l mailing list > > [email protected] > > https://lists.csuchico.edu/mailman/listinfo/pen-l > > -- > Michael Perelman > Economics Department > California State University > Chico, CA 95929 > > Tel. 530-898-5321 > E-Mail michael at ecst.csuchico.edu > michaelperelman.wordpress.com > > > _______________________________________________ > pen-l mailing list > [email protected] > https://lists.csuchico.edu/mailman/listinfo/pen-l > _______________________________________________ pen-l mailing list [email protected] https://lists.csuchico.edu/mailman/listinfo/pen-l
