.

Erased Hard-Drive

<<

str8jack3t

Newbie
Newbie

Posts: 7

Joined: Mon Jun 27, 2011 6:19 pm

Post Tue Jun 28, 2011 2:09 am

Erased Hard-Drive

All-

I have two PC's setup and I'm trying to dump one of the hard-drives to the point where there is no trace of how it was dumped and NO reverse engineering can be done to determine the cause. Is there a method? If so, would I also have to dump/clear the memory?

Thank you in advance!
<<

rattis

User avatar

Hero Member
Hero Member

Posts: 1172

Joined: Mon Jul 27, 2009 1:25 pm

Post Tue Jun 28, 2011 10:08 am

Re: Erased Hard-Drive

Look around for a live linux cd with the shred utilty on it. Read up on the program too. I think standard is 7 passes, but I could be wrong. I do 23 (because I can), last should always be random.
OSWP, Sec+
<<

El33tsamurai

User avatar

Full Member
Full Member

Posts: 219

Joined: Sat Feb 03, 2007 4:01 pm

Post Tue Jun 28, 2011 10:10 am

Re: Erased Hard-Drive

I use DBAN works great!
CCENT, A+, Network+, Security+
<<

Joshsevo

User avatar

Sr. Member
Sr. Member

Posts: 281

Joined: Tue Dec 29, 2009 11:00 pm

Post Tue Jun 28, 2011 1:52 pm

Re: Erased Hard-Drive

Even if you do wipe it, it will still show that it was wiped.
Security+, Network+, C|EH, CHFI, CPT
<<

str8jack3t

Newbie
Newbie

Posts: 7

Joined: Mon Jun 27, 2011 6:19 pm

Post Tue Jun 28, 2011 2:02 pm

Re: Erased Hard-Drive

Thank for the info to all!

Joshsevo-  Is there anyway to mask that?  I mean can it look like a complete crash/erase? From some program that took over and ran an erase? Another question - Should I also perform a wipe/dump on the memory to get rid of my history? I'm trying to have everything cleaned w/o trace?  I appreciate the feedback!!!
<<

Joshsevo

User avatar

Sr. Member
Sr. Member

Posts: 281

Joined: Tue Dec 29, 2009 11:00 pm

Post Tue Jun 28, 2011 3:02 pm

Re: Erased Hard-Drive

The only way may be to reload a Operating system back onto the HD after you wipe it.  Once you wipe it, it leaves a signature of the software used to wipe it, such as DBAN.

Even a crashed drive can still be recovered.  The bad sectors may not be recovered but some files may be able to be recovered.

Best bet is to wipe or to drive a nail through the HDD in a few spots.
Security+, Network+, C|EH, CHFI, CPT
<<

El33tsamurai

User avatar

Full Member
Full Member

Posts: 219

Joined: Sat Feb 03, 2007 4:01 pm

Post Tue Jun 28, 2011 4:33 pm

Re: Erased Hard-Drive

Acid dip that beast :-D
CCENT, A+, Network+, Security+
<<

Joshsevo

User avatar

Sr. Member
Sr. Member

Posts: 281

Joined: Tue Dec 29, 2009 11:00 pm

Post Tue Jun 28, 2011 5:22 pm

Re: Erased Hard-Drive

LOL.^^
Security+, Network+, C|EH, CHFI, CPT
<<

El33tsamurai

User avatar

Full Member
Full Member

Posts: 219

Joined: Sat Feb 03, 2007 4:01 pm

Post Tue Jun 28, 2011 6:13 pm

Re: Erased Hard-Drive

Thought you might like that
CCENT, A+, Network+, Security+

Return to Forensics

Who is online

Users browsing this forum: No registered users and 1 guest

.
Powered by phpBB® Forum Software © phpBB Group.
Designed by ST Software