Re: [sleuthkit-users] secure erase in raid 5

[Atila <ati...@dp...>]

Ok , I just got curious if there was some technology that a forensic 
examiner could apply to recover data in this situation.

On 12-03-2014 09:30, Simson Garfinkel wrote:
> The dd command may not finish. You don’t know unless you check.
> The drive controller may not write NULLs, but instead just indicate that the sector is blanked. You need to write a pseudorandom sequence and verify it by reading it back.
> You asked for ‘secure’ erase, not erase.
>
> On Mar 12, 2014, at 8:05 AM, Atila <ati...@dp...> wrote:
>
>> On 12-03-2014 08:39, Simson Garfinkel wrote:
>>> That will erase, but not securely.
>> But, given that someone erased a disk with dd, how would a forensic
>> examiner recover data from it?
>>
>> ------------------------------------------------------------------------------
>> Learn Graph Databases - Download FREE O'Reilly Book
>> "Graph Databases" is the definitive new guide to graph databases and their
>> applications. Written by three acclaimed leaders in the field,
>> this first edition is now available. Download your free book today!
>> http://p.sf.net/sfu/13534_NeoTech
>> _______________________________________________
>> sleuthkit-users mailing list
>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>> http://www.sleuthkit.org