Hard drive: Difference between revisions

From BoyWiki
Eskimo (talk | contribs)
Deleted unproven and unrelated information about Osama Bin Laden and Guantamo Bay, I will carry on work on this section tomorrow and try to fill the gap with meaningful information
Eskimo (talk | contribs)
Improved the forensic analysis section
Line 7: Line 7:
== Forensic analysis ==
== Forensic analysis ==


What follows deals exclusively with the older magnetic technology.
In an operating system there are always temporary files and logs created all over the place. Every time you open a document, view a picture or watch a video your operating very often creates a temporary copy in another part of the drive that is not visible to you but it will be found with specialist forensic tools, even with the browser in Private mode something could be left behind.  


In an operating system such as Windows, there are temporary files and logs all over the place. Even with the browser in Private mode. Can these be erased? Sure, if you know what they are and how to do it. You can easily buy programs that claim to carry out military-grade erasure, which overwrites with multiple passes of ones and zeros. This cannot be done between the knock on the door and the law enforcement official reaching the drive and unplugging it from its power supply. Can the military-grade erasure truly prevent recovery of data? I don't know. A lawyer who has been to workshops says the only safe thing is to physically destroy the disk platter, bending it with a hammer or etching it with acid. Drives are cheap. Buy a new one.
You can download programs like CyberScrub that claim to carry out military-grade erasure of all data, including temporary files, by overwriting it with multiple passes of a random algorithm or zeros and wiping hard drive free space, this makes it very difficult or impossible to recover the data but depending on many factors, like how good the software is, your computer unexpectedly crashing or permissions stopping data erasure, sometimes the software might not erase 100% of everything left behind. Another caveat of secure data erasing is that you don´t have the time to run the software every single day and if you lose your laptop it could be that the last time you securely erased the data was a week ago and every single page you visited and file you viewed will be found. Another common problem is that although the file can not be recovered, the file name can and this could be telling of the kind of file you viewed.


Note that a program wiping the free space of a drive, with the erased files (which are not truly erased when you erase them, the space they occupy is marked as "available" so that if and when needed, other data can be written on top of it, and until this happens they are simple to recover)). The program wiping the free space is not going to wipe the space not marked as free, the temporary files, caches, and logs. Do not think these can be identified and erased manually, or that some program you acquire knows what all of these are. There is no static checklist of what these are that you can use to check. They change all the time with different versions of operating systems and applications.
The best way to secure your operating system is by fully encrypting it with a tool like VeraCrypt in Windows, Linux and Mac have different software that can do that. I for some reason you can´t encrypt your operating system and you care about privacy you should still use Private mode in your browser and use software to securely erase data but always bearing in mind that this might not be totally effective and learning how full disk encryption works is well worth if the leakage of the personal data you hold could lead to life changing situations such as a divorce or financial ruin.


In a forensic laboratory such as state police etc. will run, erased files and the like are recovered. The first thing they will do is make a byte-by-byte copy (image) of your drive. Then not altering the original, they will analyze the image. This is expensive, time-consuming, and these laboratories have backlogs.
There are also differences in between how data must be securely erased in a hard drive with plates, a solid state disk and a hybrid disk, that is why not all software that promises to securely data is going to be effective.


== Encryption ==
== Encryption ==

Revision as of 11:52, 9 August 2022


A hard drive records data (text, images, databases, software) on a magnetic platform. Originally independent peripherals, a desktop PC, tablet and smartphone will usually have one built in, that is where the operating system resides, you can expand storage with external drives attached to a hardware port, the main way peripherals are attached. This is the same technology used in server farms such as the ones Google, Youtube, and Pornhub use.

Other technologies have partly replaced magnetic hard drives in consumer products: read-write optical drives (CDs, DVDs, and BluRay discs use this technology), and using RAM circuits to act as memory, thus producing memory sticks and solid state disks. These are usually more expensive than rotating drives but have faster access and reliability because they have no moving parts, and therefore are less susceptible to catastrophic crashes, smartphones and tablets use solid state disk drives to store data because of their small size, reliability and low power consumption.

Forensic analysis

In an operating system there are always temporary files and logs created all over the place. Every time you open a document, view a picture or watch a video your operating very often creates a temporary copy in another part of the drive that is not visible to you but it will be found with specialist forensic tools, even with the browser in Private mode something could be left behind.

You can download programs like CyberScrub that claim to carry out military-grade erasure of all data, including temporary files, by overwriting it with multiple passes of a random algorithm or zeros and wiping hard drive free space, this makes it very difficult or impossible to recover the data but depending on many factors, like how good the software is, your computer unexpectedly crashing or permissions stopping data erasure, sometimes the software might not erase 100% of everything left behind. Another caveat of secure data erasing is that you don´t have the time to run the software every single day and if you lose your laptop it could be that the last time you securely erased the data was a week ago and every single page you visited and file you viewed will be found. Another common problem is that although the file can not be recovered, the file name can and this could be telling of the kind of file you viewed.

The best way to secure your operating system is by fully encrypting it with a tool like VeraCrypt in Windows, Linux and Mac have different software that can do that. I for some reason you can´t encrypt your operating system and you care about privacy you should still use Private mode in your browser and use software to securely erase data but always bearing in mind that this might not be totally effective and learning how full disk encryption works is well worth if the leakage of the personal data you hold could lead to life changing situations such as a divorce or financial ruin.

There are also differences in between how data must be securely erased in a hard drive with plates, a solid state disk and a hybrid disk, that is why not all software that promises to securely data is going to be effective.

Encryption

Data on a storage device can be encrypted, that is requiring some kind of password or similar to decode. Encryption is a major military topic. Both sides - as in World War Two - struggle to come with up with an encryption protocol that the other side can not figure out how to decode.

Briefly, the longer the passcode, the more protected the data is; it would take more time to try every possible code, what cryptographers call the "brute force" method. This is in essence the technique used by PGP]] (Pretty Good Privacy) and many commercial encryption applications, who may claim that their protection has never been broken, which is true but not cause for relaxation. (in military applications it's more complicated, there may be a separate passcode for each character, as in the Nazi's Enigma machine, which the Allies decoded thus changing the course of World War Two. See the Wikipedia article.)

The government is not going to use a brute force method on you. It is too resource-intensive, and incredible as it seems, there are on the other side some who are sane enough to think it's more important to use their finite resources to go after terrorists rather than individual boylovers, girllovers, family lovers, or child porn collectors. There are too many of them, and the authorities have all the cases they can handle using other methods. These include other people informing on you, financial records (money can always be followed), ISP logs, analysis of Internet traffic, etc.

See also