• RSS
  • Twitter
  • FaceBook

Security Forums

Log in

FAQ | Search | Usergroups | Profile | Register | RSS | Posting Guidelines | Recent Posts

Free space wiping: Speed solution or not?

Users browsing this topic:0 Security Fans, 0 Stealth Security Fans
Registered Security Fans: None
Post new topic   Reply to topic   Printer-friendly version    Networking/Security Forums Index -> Computer Forensics and Incident Response

View previous topic :: View next topic  
Author Message
KLR
Just Arrived
Just Arrived


Joined: 02 Jan 2010
Posts: 0


Offline

PostPosted: Sat Jan 02, 2010 9:17 am    Post subject: Free space wiping: Speed solution or not? Reply with quote

I've recently attempted to wipe free space from both my hard drives - a solid state (64gig) and also ordinary drive (500gig), using the latest version of Eraser. Almost 24 hrs later it still isn't complete. I suspect it is due to the painfully slow speeds of writing small files to flash drives.
I'm wondering if I create one large truecrypt file to take up the rest of the drive space, then delete it. Would this have a similar effect as free space software?
Back to top
View user's profile Send private message
j7
Just Arrived
Just Arrived


Joined: 12 May 2005
Posts: 0


Offline

PostPosted: Sat Feb 06, 2010 7:51 am    Post subject: Reply with quote

I took a look at Eraser's description at download.com and it seems to do secure wipes, overwriting a space several times. So just deleting a big file does not work the same way. Besides, you don't know how Truecrypt creates the file, it may simply allocate the space from free space but leave the original data/junk intact until you use That space.
Back to top
View user's profile Send private message
capi
SF Senior Mod
SF Senior Mod


Joined: 21 Sep 2003
Posts: 16777097
Location: Portugal

Offline

PostPosted: Sat Feb 06, 2010 5:21 pm    Post subject: Reply with quote

j7 wrote:
Besides, you don't know how Truecrypt creates the file, it may simply allocate the space from free space but leave the original data/junk intact until you use That space.

Actually yes you do, and no it doesn't Smile Truecrypt overwrites the space by encrypting random data, giving a result which is theoretically undistinguishable from true random data -- as long as the underlying encryption algorithm (AES by default) isn't broken.

The difference here would be the number of times that the data is physically overwritten on the disk -- Truecrypt will only write one pass.

http://www.truecrypt.org/docs/
Back to top
View user's profile Send private message
heutenitaz
Just Arrived
Just Arrived


Joined: 26 Apr 2010
Posts: 0
Location: london

Offline

PostPosted: Mon Apr 26, 2010 11:02 am    Post subject: Reply with quote

I think it is basically depend on the hard drive space. If you have less space into the OS drive then the load of the services were very much to handle the operation and take very much time to complete so you need to remove unnecessary processes after then you can see the result.
Back to top
View user's profile Send private message Send e-mail
eddie5659
Just Arrived
Just Arrived


Joined: 16 May 2004
Posts: 0
Location: Bradford, England

Offline

PostPosted: Mon Apr 26, 2010 6:00 pm    Post subject: Reply with quote

Not sure about Eraser, but when I've wiped drives before using Dban, it also depends on how many wipes/passes you want to run.

A normal 7-DoD pass can take ages, even on a nice, small 250GB hardDrive.

Do you know how many wipes you set it up for?

eddie
Back to top
View user's profile Send private message
p.hall
Just Arrived
Just Arrived


Joined: 19 Apr 2010
Posts: 0


Offline

PostPosted: Mon Apr 26, 2010 6:29 pm    Post subject: Reply with quote

Just FYI - you need to have very *SPECIAL* equipment in order to recover information from a hard drive that has been fully rewritten once. This kind of equipment is very expensive and I doubt any of us will be of that interest, in order for our hard drives to end up in such forensics lab. So don't waste your time and only rewrite the hard drive once.
Back to top
View user's profile Send private message
DHay13
Just Arrived
Just Arrived


Joined: 21 Dec 2009
Posts: 0
Location: Pittsburgh, PA

Offline

PostPosted: Tue Apr 27, 2010 2:28 am    Post subject: Reply with quote

Agreed. I am a computer forensic examiner. One pass is sufficient to render the data unrecoverable. There is a technique that can be used to recover data that has been wiped but it is very expensive and has a low success rate.
Back to top
View user's profile Send private message Visit poster's website
Display posts from previous:   

Post new topic   Reply to topic   Printer-friendly version    Networking/Security Forums Index -> Computer Forensics and Incident Response All times are GMT + 2 Hours
Page 1 of 1


 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum

Community Area

Log in | Register