RE: Digital Evidence Question - What is an effective Windows hard -disk search tool?

From: Robinson, Sonja <SRobinson(at)HIPUSA.com>
Date: Mon Jun 30 2003 - 09:04:12 EDT

I agree with you 100%. As far as I know, it would be very expensive to recover the data. But because I deal with PHI, I have to be 100% certain. Since I can't know 100% of the s/w tools available I don't want to say that no s/w can retrieve or that there isn't another way to retrieve, especially for the normal person.

I wouldn't be surprised if we knew a lot of the same people - it was a pretty small field a few years ago and still is. :)

Sonja Robinson, CISA
Network Security Analyst
HIP Health Plans
Office: 212-806-4125
Pager: 8884238615

-----Original Message-----
From: Troy Larson [mailto:ntevidence@attbi.com] Sent: Friday, June 27, 2003 3:42 PM
To: Robinson, Sonja; 'NC Agent'; security-basics@securityfocus.com Subject: RE: Digital Evidence Question - What is an effective Windows hard -disk search tool?

Sonja,

I would be very interested (actually, surprised) if any software tool could recover any data after only one overwrite. It is my understanding that software is limited to the capability of the drive--and the hard drive itself isn't going to see data once it is overwritten. The overwritten data is noise to filter out to prevent data corruption.

I am familiar with the research that you mentioned (we must run with the same crowd). My only point was that unless you needed to worry about someone spending money for an expensive, hardware-based data recovery, one pass should be sufficient. (I don't want to do 7-31 passes on a 160GB drive unless I really, really have to.)

Thanks for the excellent points.

Troy

> -----Original Message-----

---

CONFIDENTIALITY NOTICE: This e-mail transmission, including any attachments to it, may contain confidential information or protected health information subject to privacy regulations such as the Health Insurance Portability and Accountability Act of 1996 (HIPAA). This transmission is intended only for the use of the recipient(s) named above. If you are not the intended recipient, or a person responsible for delivering it to the intended recipient, you are hereby notified that any disclosure, copying, distribution or use of any of the information contained in this transmission is STRICTLY PROHIBITED. If you have received this transmission in error, please immediately notify me by reply e-mail and destroy the original transmission in its entirety without saving it in any manner.

---

---

Evaluating SSL VPNs' Consider NEOTERIS, chosen as leader by top analysts! The Gartner Group just put Neoteris in the top of its Magic Quadrant, while InStat has confirmed Neoteris as the leader in marketshare.      

Find out why, and see how you can get plug-n-play secure remote access in about an hour, with no client, server changes, or ongoing maintenance.           

Visit us at: http://www.neoteris.com/promos/sf-6-9.htm

---

Received on Mon Jun 30 18:15:21 2003