Dailydave mailing list archives
Re: Forensics: USB fobs
From: Alaric Dailey <alaricd () pengdows com>
Date: Tue, 31 Oct 2006 08:00:22 -0600
Dave Aitel wrote:
Someone yesterday at a conference talk I went to told the crowd that you can overwrite a file (aka srm it) on a USB Key fob and it will still be there for Autopsy to see. That makes no sense to me. Can anyone verify this? -dave
Believe it or not, I have run across info recently that confirms this AND that it can be harder to destroy data on flash memory than it is magnetic media. And in a bit of related news: http://www.usatoday.com/news/nation/2006-08-30-cell-phone-secrets_x.htm Given this info, I find it annoying that "Window Washer" won't wipe flash media. If anyone looks at such a tool, be sure that you get one that wipes the NTFS journals (PGP calls this the NTFS Internal File Structures), ideally such a tool would also support the Gutmann Wipe. _______________________________________________ Dailydave mailing list Dailydave () lists immunitysec com http://lists.immunitysec.com/mailman/listinfo/dailydave
Current thread:
- Forensics: USB fobs Dave Aitel (Oct 31)
- Re: Forensics: USB fobs Dave Korn (Oct 31)
- Re: Forensics: USB fobs Alaric Dailey (Oct 31)
- Re: Forensics: USB fobs s17 -- (Oct 31)
- Re: Forensics: USB fobs Michael Spath (Oct 31)
- Re: Forensics: USB fobs felix-dailydave (Oct 31)
- Re: Forensics: USB fobs William Watson (Oct 31)