Home page logo
/

pauldotcom logo PaulDotCom mailing list archives

How much wiping do you do? :)
From: nbaronian at gmail.com (Nick Baronian)
Date: Wed, 15 Apr 2009 22:14:05 -0400

http://www.metasploit.net/data/antiforensics/slacker.exe

Here is a good write up on it -
http://synfulpacket.blogspot.com/2008/11/metasploit-anti-forensics-project-mafia.html



On Wed, Apr 15, 2009 at 9:34 PM, Adrian Crenshaw <irongeek at irongeek.com>wrote:

I sent a simular question to Scott Moulton, but I figured I'd ask in this
gorup as well. I always wondered if wiping with more than just all zeros was
necessary, then I saw this:

http://16systems.com/zero.php
and this
http://www.anti-forensics.com/disk-wiping-one-pass-is-enough

So, is it totally useless to wipe a drive more that once? What would it
take to get the data off of a drive wiped once with all zeros?

Also as a side note, Scott sent me a link to this tool awhile back that
uses some on board stuff of modern drives to wipe even sectors marked as bad
by the internal drive logic:

http://crystalmark.info/download/index-e.html

One more side note: Anyone know how I can wipe my slack space with an
arbitrary set of bits? I though it would be funny to but the lemonparty jpg
all over my slack space for investigators to find :)

Thanks much,
Adrian

_______________________________________________
Pauldotcom mailing list
Pauldotcom at mail.pauldotcom.com
http://mail.pauldotcom.com/cgi-bin/mailman/listinfo/pauldotcom
Main Web Site: http://pauldotcom.com

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mail.pauldotcom.com/pipermail/pauldotcom/attachments/20090415/911fdfdc/attachment.htm 


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault