Dailydave mailing list archives
Re: Forensics: USB fobs
From: "Michael Spath" <michael.spath () gmail com>
Date: Tue, 31 Oct 2006 17:40:39 +0100
On 11/1/06, Dave Aitel <dave () immunityinc com> wrote:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Someone yesterday at a conference talk I went to told the crowd that you can overwrite a file (aka srm it) on a USB Key fob and it will still be there for Autopsy to see. That makes no sense to me. Can anyone verify this?
I guess that your guy was thinking about wear-levelling algorithms. Basically to maximize the lifetime of the sticks, manufacturers add an address translation layer between USB interface and the actual flash, so that erase and write cycles are spread evenly on all blocks. This means that when srm will try to overwrite a file, the data will actually be written to another block and the old data will still be there. regards, --spath _______________________________________________ Dailydave mailing list Dailydave () lists immunitysec com http://lists.immunitysec.com/mailman/listinfo/dailydave
Current thread:
- Forensics: USB fobs Dave Aitel (Oct 31)
- Re: Forensics: USB fobs Dave Korn (Oct 31)
- Re: Forensics: USB fobs Alaric Dailey (Oct 31)
- Re: Forensics: USB fobs s17 -- (Oct 31)
- Re: Forensics: USB fobs Michael Spath (Oct 31)
- Re: Forensics: USB fobs felix-dailydave (Oct 31)
- Re: Forensics: USB fobs William Watson (Oct 31)