If this is your first visit, be sure to check out the FAQ by clicking the link above. You may have to register before you can post: click the register link above to proceed. To start viewing messages, select the forum that you want to visit from the selection below. |
|
|
Thread Tools | Display Modes |
#1
|
|||
|
|||
Forensic question about hard drives
Suppose A wants access to all the stuff on B's HD, both deleted and
undeleted, except a few letters which B wants to keep private. Is there any way to do a mirror copy of all the sectors except those containing B's private letters? |
#2
|
|||
|
|||
Forensic question about hard drives
On 27-Mar-2009, "Josh Roig" wrote: Suppose A wants access to all the stuff on B's HD, both deleted and undeleted, except a few letters which B wants to keep private. Is there any way to do a mirror copy of all the sectors except those containing B's private letters? Unlikely, if B is so worried about the security he should encrypt them with a long key, using UC, LC, numeric, and punctuation chars. An easily remembered phrase like I'm thinking of going 2 (the pub down the road, 20 or so characters is about right). Then secure delete the originals. |
#3
|
|||
|
|||
Forensic question about hard drives
Josh Roig wrote:
Suppose A wants access to all the stuff on B's HD, both deleted and undeleted, except a few letters which B wants to keep private. Is there any way to do a mirror copy of all the sectors except those containing B's private letters? It is technically possible to clone the drive at the sector level and then delete the private letters and wipe just the sectors that the private letters occupied so they cant be undeleted. |
#4
|
|||
|
|||
Forensic question about hard drives
On or about Fri, 27 Mar 2009 16:43:37 -0000 did "Josh Roig"
dribble thusly: Suppose A wants access to all the stuff on B's HD, both deleted and undeleted, except a few letters which B wants to keep private. Is there any way to do a mirror copy of all the sectors except those containing B's private letters? If you know which sectors the private information is stored on, sure. It'd probably be easier to make a full copy, then wipe the relevant areas on the copy (easier because you can refer to those sectors via the file system structure). |
#5
|
|||
|
|||
Forensic question about hard drives
On Mar 28, 2:00*am, Mike Ruskai
wrote: On or about Fri, 27 Mar 2009 16:43:37 -0000 did "Josh Roig" dribble thusly: Suppose A wants access to all the stuff on B's HD, both deleted and undeleted, except a few letters which B wants to keep private. Is there any way to do a mirror copy of all the sectors except those containing B's private letters? If you know which sectors the private information is stored on, sure. *It'd probably be easier to make a full copy, then wipe the relevant areas on the copy (easier because you can refer to those sectors via the file system structure). You also need to delete the sectors that were used for temp versions / working backups of the files. ie, you need to purge the complete unallocated area of the disk, and possibly the slack space as well. Michael www.cnwrecovery.com |
Thread Tools | |
Display Modes | |
|
|
Similar Threads | ||||
Thread | Thread Starter | Forum | Replies | Last Post |
SATA and IDE Hard drives question | Bob H[_4_] | Homebuilt PC's | 5 | December 14th 08 01:20 AM |
Question About Hard Drives | gecko | General | 6 | November 1st 07 10:57 AM |
Question about hard drives | John | Scanners | 8 | July 28th 07 03:06 PM |
Question on hard drives | Jethro | General | 2 | February 15th 07 05:53 AM |
Question(s) about 2 hard drives | Lurker | Homebuilt PC's | 2 | February 12th 04 08:54 PM |