Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

Username:
Password:
1 Hour 1 Day 1 Week 1 Month Forever

Welcome, Guest. Please login or register.
Did you miss your activation email?

There aren't any users online.

[James]

Anyone with knowledge of computers help me here? I have a bomber who wants to eradicate all traces of certain websites he has accessed on his computer. He doesn't want to wipe the memory clean - just those websites that may incriminate him. How would he go about this so that a forensic examination of his computer by the police shows nothing inciminating? Can it be done?

[Lance Charnes]

It's hard to get rid of all traces everywhere -- if, for instance, he has to log in to a bulletin board (like this one), there will be a record at the server end. If he works from a computer with a fixed IP address (such as at work), he may be traceable if the site keeps records of accesses by IP. That's how SiteMeter and its ilk work.

On the client side, he can do something like the following:

• Clean the browser's cache (Tools --> Internet Options in IE V6, Safety --> Delete Browsing History in IE8), then...
• Run a program such as Eraser, which overwrites deleted files and unused space with random, repeated patterns of 1s and 0s. DoD uses Eraser-like tools to decommission magnetic media that held classified information. After a three- or seven-pass treatment with Eraser, any residual data is pretty much gone.
• If he's extremely paranoid, he can then run a defrag (Accessories --> System Tools --> Disk Defragmenter in WinXP), which rearranges the files on a drive so they occupy contiguous space. This ends up overwriting formerly unused areas on the disk (such as those occupied by deleted files) with live data.

Will this absolutely, positively get rid of every last scrap? Maybe. It will certainly force anyone who's interested to work really, really hard to find anything useful. Even then, they may not. If your malefactor is religious about this process, there may not be anything left to find. In that case, those interested parties will likely turn to the server and ISP end of the equation.

[Lance Charnes]

I thought of another thing -- if your evildoer uses a modern browser (IE8 or the latest versions of Firefox or Opera), he'd use InPrivate browsing (IE8 name, don't know the name for the others). This creates a temporary cache for downloaded files, cookies, and so on, then deletes it at the end of the session. This eliminates step 1 in the list I posted before. The other steps are still valid.

[wonderactivist]

I'm not so great with electronics myself, but my son is a complete whiz. Friends call him to fix their computers and he built our new computer for $250.  It's more powerful that the one we paid over $800 for. 

I'll ask him to review this tonight. 

Lucie

[wonderactivist]

According to my son, when you delete something, it's actually still there. The computer simply removes it from the file system, but the block of data is still there until it is overwritten. (in my own non-computer lingo that means it can re-use that spot on the disk).  The info is still there and experts at the FBI or some police departments could definitely get to it. 

File shredders attempt to overwrite data but aren't particularly effective.  If the CIA, FBI or a large-city police department gets into them, the stuff IS STILL THERE.  The only way to get rid of it is to wipe the disc--reformatting it hundreds of times--to be certain. 

Sam says, "the best way would be to take a hammer to the hard drive...after reformatting hundreds of times."

FUN!

Lucie

[Lance Charnes]

Single-pass overwrites don't do a very good job, true. Multiple-pass overwrites do progressively better work. Three passes with randomized patterns are more-or-less standard for DoD media used to store unclassified information; seven passes are used for media storing up to Top Secret. We had a seven-pass utility we used at HQ CENTCOM for blanking magnetic media before copying new files for internal transfer. Eraser does both three- and seven-pass DoD overwrite, as well as a 35-pass (!) Gutmann routine.

In essence, multiple-pass overwrites are like reformatting the medium in a controlled manner. After seven passes, not even the CIA is going to get anything out of it (that's why they use it on their own media). Data isn't that persistent except in the movies.

[wonderactivist]

Typical teenager--exaggerating!   

[James]

Thanks everyone. From what you've told me, I guess that if my bomber erased everything, the police would know he had got rid of something or other. But they'd still need proof that he was accessing bomb-making sites, so I guess I'll have him wiping the hard disk over and over again.

What if the police broke in just as he was completing a final wipe, but were too late? Might work. I'll think about it.

[Lance Charnes]

If he wipes the entire drive, he'll have to reinstall his operating system and software over and over again. That takes too much time and renders the computer useless for most of it. It's also an obvious red flag.

It's much more effective for him to be scrupulous about using private mode on his browser and going through one of the anonymous-browsing services (such as Anonymizer) when he's looking at the sketchy stuff, then cleaning up after himself using the steps above. He can do his browsing of I Can Has Cheezburger and the like using normal mode on his browser. This way, he (or his lawyer) can show he only uses his computer for normal things and isn't hiding anything.

Alternately, he can go to the public library for his, ahem, professional browsing. Most libraries don't keep track of who uses which computer when, so there'd be no way to link him to the bombmaking sites.

[Leon]

Lance,

If it can be done, few people know how to do it.

However,
Even if a hard drive is destroyed, info may reside on one or more severs.

Hope this is of some help.

Leon

[B L McAllister]

... He doesn't want to wipe the memory clean - just those websites that may incriminate him. How would he go about this so that a forensic examination of his computer by the police shows nothing inciminating? Can it be done?

I have to hope not.

[fleamailman]

repost from elsewhere

Anyone with knowledge of computers help me here? I have a bomber who wants to eradicate all traces of certain websites he has accessed on his computer. He doesn't want to wipe the memory clean - just those websites that may incriminate him. How would he go about this so that a forensic examination of his computer by the police shows nothing incriminating? Can it be done?

and then the goblin showed, explaining "...the way they retrieve deleted pictures and folders, can be by using a windows data recovery program, yes, but mostly the authorities use a linux live CD booting up onto the ram, then transferring any retrieved stuff to a harddrve, because it doesn't leave a trace on the harddrive, meaning they one can't counter claim that the data has been planted by them then, so the answer if clearly no as they can still trace your deleted internet history of stuff and identify your computer and you by it...", in fact, when the goblin thought about it, linux seemed to be the key to everything here, continuing "...hats use linux for various reasons then, first off the ip address is fluid, the mac address behind the ip address is a clone too, and there is no reporting to central control the moment one has logged on like in the case of windows operating system where one license number tells them which computer and straight off who you are too...", simply, two things became clear by this, one that if one wanted to be on the internet anonymously one used a linux live CD to do so, and if one wanted to store private stuff one stored it to a USB key directly from the live CD session, where the harddrive of the computer is not used in either case, simply one uses the way of the authorities back at them,  and ones harddrive one leave as a paragon of virtue for them then, at which point the goblin just smiled "...welcome to world of internet creatures then..."