When they say it can be retrieved if a drive has been formatted up to 30 times, they are probably a little ambitious. Most formats are done using "format c:" and nothing else. Again, this just removes the pointers. When I redo a drive, I run a zero fill 3 times over it. Then to test whether or not data has been completely erased, I run the drive on my Encase machine. If anything shows up I erase some more. So your FAST person may be a little ambitious in his/her claims, I know that just regular formatting can leave a drive recoverable up to about 5 times anyway.
Chris Chandler A+, Network +, MCSE NT4/2000 Network Security Consultant http://www.wilykiote.com -----Original Message----- From: Thomas Sj�gren [mailto:thomas@;northernsecurity.net] Sent: Tuesday, October 29, 2002 5:29 PM To: Dave Adams; [EMAIL PROTECTED] Subject: Re: Interesting One On Monday 28 October 2002 23:06, Dave Adams wrote: > I had an interesting conversation today with someone from FAST > (Federation > Against Software Theft) They pretend not to be a snitch wing of the > BSA. Anyway, to get to the point, the guy that came to see me said > that their forensics guys could read data off a hard drive that had > been written over > up to thirty times. [...] Really? Wow. Please email me about the tools they are using, but that's probably classified.
