Re: Digital Evidence Question - What is an effective Windowshard -disk search tool?

["Meritt James" <meritt_james () bah com>]

Hence the DCID 6/3 specification that disks may only be used after
"cleaning" at the classification they were used on or above.  The "bad
sector" problem with disks thwarts many of the erase procedures.  There
may be data written in those sectors that tools (all tools, to my
understanding) do not overwrite because they are claimed to be "bad
areas" of the disk and not accessable.  They are accessible.  (;-).

I concur with the general comment:  If it is such a big deal to you, why
the reuse consideration?  Just destroy the thing!

I still recommend a blowtorch...

Jim

Jack Crone wrote:
> About fifteen years ago I was associated with a highly classified
> military program. We had a very real need to know whether overwritten
> data could be recovered and I believe we learned all that was known at
> the time. We learned that it was theoretically possible to recover
> data, but the theory had yet to be put to practical use. However,
> should such recovery become practical then, *theoretically*,
> overwriting a certain number of times with certain patterns would
> thwart the recovery. Hence the DoD standard -- protection against
> something which might become possible at some future date. I see no
> evidence to indicate that that future date has arrived. My personal
> experience is quite old, but consider the following:


-- 
James W. Meritt CISSP, CISA
Booz | Allen | Hamilton
phone: (410) 684-6566

---------------------------------------------------------------------------
Evaluating SSL VPNs' Consider NEOTERIS, chosen as leader by top analysts!
The Gartner Group just put Neoteris in the top of its Magic Quadrant,
while InStat has confirmed Neoteris as the leader in marketshare.
     
Find out why, and see how you can get plug-n-play secure remote access in
about an hour, with no client, server changes, or ongoing maintenance.
          
Visit us at: http://www.neoteris.com/promos/sf-6-9.htm
----------------------------------------------------------------------------