For many companies, I can imagine that they would like to have a
positive validation that a disk was wiped, rather than that it just
happened to be blank.
On Nov 2, 2005, at 9:40 PM, Jason Upchurch wrote:
I love it when some one comes up with a wiping tool that leaves
information behind. This tool presents some interesting
scenarios. For imaging, the unused space on the disk would have a
timestamp indicating when the disk was wiped before use. For
forensics, it is rather frustrating to do an exam and find that the
disk was wiped. In this case, you would at least have evidence of
when it might have been wiped.
Just thoughts,
Jason
Simson Garfinkel wrote:
I have found a most interesting drive on the secondary market.
Every block of the drive contains the following:
10 digit decimal number with the block number.
A timestamp
The capital letter "E" filled to the end of the block.
It looks to me like this drive was properly sanitized with some
tool. Is anybody familiar with such a tool as this? I'm very
curious, because I've previously suggested filling drives with
E's --- but the idea of writing individual sector numbers and
timestamps had not previously occurred to me.
Thanks!
