RE: More on possible remnants of wiping ..

From: Robert Goto <rgoto(at)seanet.com>
Date: Mon Jul 14 2003 - 08:57:09 EDT

There are some 'wiping' type applications mentioned in the the registry of a standard Windows 9x installation. So the fact that you find them in a text search of the drive does not necessarily mean that these applications ever existed on a drive.

On a case I worked on a while I go, I got all excited when I found these apps showing up as the result of a text search but alas found them all to be from:

hkey_local_machine\system\current control set\control\session manager\checkbadapps

This appears to be a list of applications which Windows checks for and finding these entries does not mean that these applications ever existed on the subject computer.
Some of the applications found in this registry key are: Shred.exe
Wipeinfo.exe
Secure.exe

> Hi Jack (and curious listmembers!),

---

This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com Received on Mon Jul 14 08:57:09 2003