RE: Interesting One

["Chris Chandler" <chandlerchrisc () earthlink net>]

When they say it can be retrieved if a drive has been formatted up to 30
times, they are probably a little ambitious. Most formats are done using
"format c:" and nothing else. Again, this just removes the pointers.
When I redo a drive, I run a zero fill 3 times over it. Then to test
whether or not data has been completely erased, I run the drive on my
Encase machine. If anything shows up I erase some more. 
So your FAST person may be a little ambitious in his/her claims, I know
that just regular formatting can leave a drive recoverable up to about 5
times anyway.

Chris Chandler
A+, Network +, MCSE NT4/2000
Network Security Consultant
http://www.wilykiote.com

-----Original Message-----
From: Thomas Sjögren [mailto:thomas () northernsecurity net] 
Sent: Tuesday, October 29, 2002 5:29 PM
To: Dave Adams; security-basics () security-focus com
Subject: Re: Interesting One

On Monday 28 October 2002 23:06, Dave Adams wrote:

> I had an interesting conversation today with someone from FAST
> (Federation
> Against Software Theft) They pretend not to be a snitch wing of the
> BSA. Anyway, to get to the point, the guy that came to see me said
> that their forensics guys could read data off a hard drive that had
> been written over
> up to thirty times. [...]

Really? Wow. Please email me about the tools they are using, but that's 
probably classified.