EH-Net

Ethical Hacking Discussions and Related Certifications => Forensics => Topic started by: str8jack3t on June 28, 2011, 02:09:23 AM

Title: Erased Hard-Drive
Post by: str8jack3t on June 28, 2011, 02:09:23 AM

All-

I have two PC's setup and I'm trying to dump one of the hard-drives to the point where there is no trace of how it was dumped and NO reverse engineering can be done to determine the cause. Is there a method? If so, would I also have to dump/clear the memory?

Thank you in advance!

Title: Re: Erased Hard-Drive
Post by: chrisj on June 28, 2011, 10:08:55 AM

Look around for a live linux cd with the shred utilty on it. Read up on the program too. I think standard is 7 passes, but I could be wrong. I do 23 (because I can), last should always be random.

Title: Re: Erased Hard-Drive
Post by: El33tsamurai on June 28, 2011, 10:10:49 AM

I use DBAN works great!

Title: Re: Erased Hard-Drive
Post by: Joshsevo on June 28, 2011, 01:52:06 PM

Even if you do wipe it, it will still show that it was wiped.

Title: Re: Erased Hard-Drive
Post by: str8jack3t on June 28, 2011, 02:02:25 PM

Thank for the info to all!

Joshsevo- Is there anyway to mask that? I mean can it look like a complete crash/erase? From some program that took over and ran an erase? Another question - Should I also perform a wipe/dump on the memory to get rid of my history? I'm trying to have everything cleaned w/o trace? I appreciate the feedback!!!

Title: Re: Erased Hard-Drive
Post by: Joshsevo on June 28, 2011, 03:02:37 PM

The only way may be to reload a Operating system back onto the HD after you wipe it. Once you wipe it, it leaves a signature of the software used to wipe it, such as DBAN.

Even a crashed drive can still be recovered. The bad sectors may not be recovered but some files may be able to be recovered.

Best bet is to wipe or to drive a nail through the HDD in a few spots.

Title: Re: Erased Hard-Drive
Post by: El33tsamurai on June 28, 2011, 04:33:01 PM

Acid dip that beast :-D

Title: Re: Erased Hard-Drive
Post by: Joshsevo on June 28, 2011, 05:22:18 PM

LOL.^^

Title: Re: Erased Hard-Drive
Post by: El33tsamurai on June 28, 2011, 06:13:46 PM

Thought you might like that