The Ethical Hacker Network - Erased Hard-Drive

Latest Additions

Who's Online

EH-Net News Feeds

Latest Additions

EH-Net > Ethical Hacking Discussions and Related Certifications > Forensics (Moderator: don) > Erased Hard-Drive

Pages: [1] Go Down

« previous next »

	Author	Topic: Erased Hard-Drive (Read 5051 times)
0 Members and 2 Guests are viewing this topic.

str8jack3t

Newbie

Offline

Posts: 7

Erased Hard-Drive

« on: June 28, 2011, 02:09:23 AM »

All-

I have two PC's setup and I'm trying to dump one of the hard-drives to the point where there is no trace of how it was dumped and NO reverse engineering can be done to determine the cause. Is there a method? If so, would I also have to dump/clear the memory?

Thank you in advance!


	Logged

chrisj

Hero Member

Offline

Posts: 997

Re: Erased Hard-Drive

« Reply #1 on: June 28, 2011, 10:08:55 AM »

Look around for a live linux cd with the shred utilty on it. Read up on the program too. I think standard is 7 passes, but I could be wrong. I do 23 (because I can), last should always be random.


	Logged

OSWP, Sec+

El33tsamurai

Full Member

Offline

Posts: 180

Re: Erased Hard-Drive

« Reply #2 on: June 28, 2011, 10:10:49 AM »

I use DBAN works great!


	Logged

CCENT, A+, Network+, Security+

Joshsevo

Sr. Member

Offline

Posts: 263

Re: Erased Hard-Drive

« Reply #3 on: June 28, 2011, 01:52:06 PM »

Even if you do wipe it, it will still show that it was wiped.


	Logged

CHFI, C|EH, Security+, CPT

str8jack3t

Newbie

Offline

Posts: 7

Re: Erased Hard-Drive

« Reply #4 on: June 28, 2011, 02:02:25 PM »

Thank for the info to all!

Joshsevo- Is there anyway to mask that? I mean can it look like a complete crash/erase? From some program that took over and ran an erase? Another question - Should I also perform a wipe/dump on the memory to get rid of my history? I'm trying to have everything cleaned w/o trace? I appreciate the feedback!!!


	Logged

Joshsevo

Sr. Member

Offline

Posts: 263

Re: Erased Hard-Drive

« Reply #5 on: June 28, 2011, 03:02:37 PM »

The only way may be to reload a Operating system back onto the HD after you wipe it. Once you wipe it, it leaves a signature of the software used to wipe it, such as DBAN.

Even a crashed drive can still be recovered. The bad sectors may not be recovered but some files may be able to be recovered.

Best bet is to wipe or to drive a nail through the HDD in a few spots.