A computer components & hardware forum. HardwareBanter

If this is your first visit, be sure to check out the FAQ by clicking the link above. You may have to register before you can post: click the register link above to proceed. To start viewing messages, select the forum that you want to visit from the selection below.

Go Back   Home » HardwareBanter forum » General Hardware & Peripherals » Storage (alternative)
Site Map Home Register Authors List Search Today's Posts Mark Forums Read Web Partners

Forensic question about hard drives



 
 
Thread Tools Display Modes
  #1  
Old March 27th 09, 05:43 PM posted to comp.sys.ibm.pc.hardware.storage
Josh Roig
external usenet poster
 
Posts: 1
Default Forensic question about hard drives

Suppose A wants access to all the stuff on B's HD, both deleted and
undeleted, except a few letters which B wants to keep private. Is there any
way to do a mirror copy of all the sectors except those containing B's
private letters?


  #2  
Old March 27th 09, 06:41 PM posted to comp.sys.ibm.pc.hardware.storage
Ato_Zee
external usenet poster
 
Posts: 230
Default Forensic question about hard drives


On 27-Mar-2009, "Josh Roig" wrote:

Suppose A wants access to all the stuff on B's HD, both deleted and
undeleted, except a few letters which B wants to keep private. Is there
any
way to do a mirror copy of all the sectors except those containing B's
private letters?


Unlikely, if B is so worried about the security he should encrypt
them with a long key, using UC, LC, numeric,
and punctuation chars.
An easily remembered phrase like
I'm thinking of going 2 (the pub down the road,
20 or so characters is about right).
Then secure delete the originals.
  #3  
Old March 27th 09, 07:16 PM posted to comp.sys.ibm.pc.hardware.storage
Rod Speed
external usenet poster
 
Posts: 8,559
Default Forensic question about hard drives

Josh Roig wrote:

Suppose A wants access to all the stuff on B's HD, both deleted and undeleted, except a few letters which B wants to
keep private. Is there any way to do a mirror copy of all the sectors except those containing B's private letters?


It is technically possible to clone the drive at the sector level
and then delete the private letters and wipe just the sectors
that the private letters occupied so they cant be undeleted.


  #4  
Old March 28th 09, 02:00 AM posted to comp.sys.ibm.pc.hardware.storage
Mike Ruskai
external usenet poster
 
Posts: 75
Default Forensic question about hard drives

On or about Fri, 27 Mar 2009 16:43:37 -0000 did "Josh Roig"
dribble thusly:

Suppose A wants access to all the stuff on B's HD, both deleted and
undeleted, except a few letters which B wants to keep private. Is there any
way to do a mirror copy of all the sectors except those containing B's
private letters?


If you know which sectors the private information is stored on, sure. It'd
probably be easier to make a full copy, then wipe the relevant areas on the
copy (easier because you can refer to those sectors via the file system
structure).
  #5  
Old April 4th 09, 05:31 PM posted to comp.sys.ibm.pc.hardware.storage
[email protected]
external usenet poster
 
Posts: 212
Default Forensic question about hard drives

On Mar 28, 2:00*am, Mike Ruskai
wrote:
On or about Fri, 27 Mar 2009 16:43:37 -0000 did "Josh Roig"
dribble thusly:

Suppose A wants access to all the stuff on B's HD, both deleted and
undeleted, except a few letters which B wants to keep private. Is there any
way to do a mirror copy of all the sectors except those containing B's
private letters?


If you know which sectors the private information is stored on, sure. *It'd
probably be easier to make a full copy, then wipe the relevant areas on the
copy (easier because you can refer to those sectors via the file system
structure).


You also need to delete the sectors that were used for temp versions /
working backups of the files. ie, you need to purge the complete
unallocated area of the disk, and possibly the slack space as well.

Michael
www.cnwrecovery.com
 




Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
SATA and IDE Hard drives question Bob H[_4_] Homebuilt PC's 5 December 14th 08 01:20 AM
Question About Hard Drives gecko General 6 November 1st 07 10:57 AM
Question about hard drives John Scanners 8 July 28th 07 03:06 PM
Question on hard drives Jethro General 2 February 15th 07 05:53 AM
Question(s) about 2 hard drives Lurker Homebuilt PC's 2 February 12th 04 08:54 PM


All times are GMT +1. The time now is 04:08 PM.


Powered by vBulletin® Version 3.6.4
Copyright ©2000 - 2024, Jelsoft Enterprises Ltd.
Copyright ©2004-2024 HardwareBanter.
The comments are property of their posters.