Dailydave mailing list archives
Re: Forensics: USB fobs
From: felix-dailydave () fefe de
Date: Tue, 31 Oct 2006 18:30:37 +0100
Thus spake Dave Aitel (dave () immunityinc com):
Someone yesterday at a conference talk I went to told the crowd that you can overwrite a file (aka srm it) on a USB Key fob and it will still be there for Autopsy to see. That makes no sense to me. Can anyone verify this?
On flash media you have a limit on how often you can overwrite a sector. It's about 10000 times. For typical FAT file systems, that means the FAT region will be the first to fail. So they put a translation layer between the actual media and the hardware, so that logically you read/write sector 5, but the layer remaps the physical layout so that you distribute the writes optimally. I don't know how many usb sticks have this, but I know that embedded people using flash memory do this. Linux even has a file system that does this for you. Felix _______________________________________________ Dailydave mailing list Dailydave () lists immunitysec com http://lists.immunitysec.com/mailman/listinfo/dailydave
Current thread:
- Forensics: USB fobs Dave Aitel (Oct 31)
- Re: Forensics: USB fobs Dave Korn (Oct 31)
- Re: Forensics: USB fobs Alaric Dailey (Oct 31)
- Re: Forensics: USB fobs s17 -- (Oct 31)
- Re: Forensics: USB fobs Michael Spath (Oct 31)
- Re: Forensics: USB fobs felix-dailydave (Oct 31)
- Re: Forensics: USB fobs William Watson (Oct 31)