Free space wiping: Speed solution or not?

Networking/Security Forums -> Computer Forensics and Incident Response

Author: KLR PostPosted: Sat Jan 02, 2010 9:17 am    Post subject: Free space wiping: Speed solution or not?
    ----
I've recently attempted to wipe free space from both my hard drives - a solid state (64gig) and also ordinary drive (500gig), using the latest version of Eraser. Almost 24 hrs later it still isn't complete. I suspect it is due to the painfully slow speeds of writing small files to flash drives.
I'm wondering if I create one large truecrypt file to take up the rest of the drive space, then delete it. Would this have a similar effect as free space software?

Author: j7 PostPosted: Sat Feb 06, 2010 7:51 am    Post subject:
    ----
I took a look at Eraser's description at download.com and it seems to do secure wipes, overwriting a space several times. So just deleting a big file does not work the same way. Besides, you don't know how Truecrypt creates the file, it may simply allocate the space from free space but leave the original data/junk intact until you use That space.

Author: capiLocation: Portugal PostPosted: Sat Feb 06, 2010 5:21 pm    Post subject:
    ----
j7 wrote:
Besides, you don't know how Truecrypt creates the file, it may simply allocate the space from free space but leave the original data/junk intact until you use That space.

Actually yes you do, and no it doesn't Smile Truecrypt overwrites the space by encrypting random data, giving a result which is theoretically undistinguishable from true random data -- as long as the underlying encryption algorithm (AES by default) isn't broken.

The difference here would be the number of times that the data is physically overwritten on the disk -- Truecrypt will only write one pass.

http://www.truecrypt.org/docs/

Author: heutenitazLocation: london PostPosted: Mon Apr 26, 2010 11:02 am    Post subject:
    ----
I think it is basically depend on the hard drive space. If you have less space into the OS drive then the load of the services were very much to handle the operation and take very much time to complete so you need to remove unnecessary processes after then you can see the result.

Author: eddie5659Location: Bradford, England PostPosted: Mon Apr 26, 2010 6:00 pm    Post subject:
    ----
Not sure about Eraser, but when I've wiped drives before using Dban, it also depends on how many wipes/passes you want to run.

A normal 7-DoD pass can take ages, even on a nice, small 250GB hardDrive.

Do you know how many wipes you set it up for?

eddie

Author: p.hall PostPosted: Mon Apr 26, 2010 6:29 pm    Post subject:
    ----
Just FYI - you need to have very *SPECIAL* equipment in order to recover information from a hard drive that has been fully rewritten once. This kind of equipment is very expensive and I doubt any of us will be of that interest, in order for our hard drives to end up in such forensics lab. So don't waste your time and only rewrite the hard drive once.

Author: DHay13Location: Pittsburgh, PA PostPosted: Tue Apr 27, 2010 2:28 am    Post subject:
    ----
Agreed. I am a computer forensic examiner. One pass is sufficient to render the data unrecoverable. There is a technique that can be used to recover data that has been wiped but it is very expensive and has a low success rate.



Networking/Security Forums -> Computer Forensics and Incident Response


output generated using printer-friendly topic mod, All times are GMT + 2 Hours

Page 1 of 1

Powered by phpBB 2.0.x © 2001 phpBB Group