Loopy
Ranter Level 5
   
Karma: 43
Posts: 870
Son Of Liberty
|
 |
« Reply #15 on: September 03, 2008, 01:31:55 PM » |
|
What about..
Oops I slipped and molten slag fell on my hard drive?
Someone stole my HDD cage and beat the disk platters with a sledgehammer?
Oh well..
*this is not advice and I am just making this up, but fictionally, I would make a clay case that houses my HD externally with a thermite panic button... just for kicks. If they ask, just say that you thought they were burglars, or identity thieves. There is also the option of just using someone else's network (neighbors, library, via wireless router, etc.) Airsnort ring a bell? I made a can-tenna with BASIC parts and it doubled my signal range... fictionally of course. Isn't thermite just aluminum dust and rust powder mixed at a 3/8 ratio ignited with a magnesium fuse... just like the kind in your flint and tinder key chain? I would never do that kind of thing. Only a crook would even dare to think of something like that and the thought police would arrest you just for thinking about it.
|
|
|
|
« Last Edit: September 10, 2008, 01:16:05 PM by enloopious »
|
Logged
|
~I shall ask the Congress for the one remaining instrument to meet the crisis--broad Executive power to wage a war against the emergency, as great as the power that would be given to me if we were in fact invaded by a foreign foe ...In the spirit of this gift I shall take it. -FDR
|
|
|
Scott Skawronska
Ranter Level 5
   
Karma: 70
Posts: 951
Don't Pick Me.
|
 |
« Reply #16 on: September 05, 2008, 06:12:48 PM » |
|
Brother Loopy, your gift for tongue-in-cheek is refining with every passing minute.
On Data Forensics:
I am given to understand (and anyone may feel free to correct me if I am wrong) that forensic technology is at the point where it can be used to backtrack up to five read-writes on the same bit. That means, five wipes might not be enough, but seven would be.
And the gutmann 22-wipe option would definitely scrag the drive.
My knowledge is a couple years old. Has the software gotten better? And if so, the thing that scares me the most is that it is far too easy for a "forensics team" to just slap something on the blank hard drive, erase it a couple of times, then "find" it forensically.
Also, I've found in my porn searches that there are pics and videos with suggestive names that tend to use a "standard" picture, almost as if it is intended to be a "benchmark" for forensic analysis.
There's probably a lot I don't know.
I like the thermite option, too.
And if I did any filesharing or anything else that would put me in the .gov sights for anything, I'd have some kind of encryption scheme as well.
But I don't. In fact, my biggest problem is viruses and I end up wiping my hard drive about once every three months...so I don't even HAVE any really cool data.
I keep starting over from scratch.
S
|
|
|
|
|
Logged
|
Second Life: SSkawronska Seid
|
|
|
|
Enki
|
 |
« Reply #17 on: September 05, 2008, 08:08:51 PM » |
|
On Data Forensics:
I am given to understand (and anyone may feel free to correct me if I am wrong) that forensic technology is at the point where it can be used to backtrack up to five read-writes on the same bit. That means, five wipes might not be enough, but seven would be.
And the gutmann 22-wipe option would definitely scrag the drive.
I think that it depends on the wipe. A truly random bit write even twice should be enough to destroy all the data except in unusual cases. I read a paper (a while ago) on forensics and the recovery of data repeatedly wiped referred to overwriting with zeros over and over and over again. Truly random overwrites leave the drive in an unrecoverable state. Attacks against the random number algorithm would probably be a more likely method than being able to traceback through decreasing differences from the last known value. Bigger and faster drives have smaller margins of error too, so there is the argument that forensics are getting harder, not easier. Why stop with just one though? I would overwrite randomly, then with zeros if there was time. If there wasn't, loopy's method is actually pretty valid: burning the platters isn't a bad option. You don't need thermite, as a fireplace and a hammer should do well enough. The data is stored on a plastic based substrate.
|
|
|
|
|
Logged
|
|
|
|
Loopy
Ranter Level 5
   
Karma: 43
Posts: 870
Son Of Liberty
|
 |
« Reply #18 on: September 06, 2008, 11:23:57 AM » |
|
One of the guys here was doing something online (he wont tell me what) but he used some brand name software to erase traces before the feds showed up. There were around 20 agents at his house one day when he came home and they took his box. Its been 7 mos and they haven't charged him with anything yet so the software might have worked... or they may be waiting for better evidence.
|
|
|
|
|
Logged
|
~I shall ask the Congress for the one remaining instrument to meet the crisis--broad Executive power to wage a war against the emergency, as great as the power that would be given to me if we were in fact invaded by a foreign foe ...In the spirit of this gift I shall take it. -FDR
|
|
|
The Resonator Twins.
Ranter Level 1
Karma: 1
Posts: 3
|
 |
« Reply #19 on: September 06, 2008, 09:21:34 PM » |
|
You guys know linux, right? Just run dd and use /dev/zero as input to overwrite the drive as described here: http://16systems.com/zero/index.html. Seriously. Let dd complete - JUST ONE PASS, and I defy anyone to recover anything. While you're at it, play both sides of the same coin: make several copies on removable media of everything you've downloaded, and give them to as may people as you can. Stuff gets taken, so what it's just stuff - the information is already free. Or fuck the coin altogether. You don't need their media/programming. 99% of it is all just bullshit anyways, and we do better ourselves. Their culture is like their fast-food - mass produced, and a steady diet *will* kill you. Maybe less hoarding and consuming and maybe some more sharing and creating. Open Source: it's ours. (Please note: although a linux-based distro was used to compose this, no linux-based boxes were harmed in the creation of this message. No Windows boxes were harmed either, because I don't do Windows. Mac FanBois - don't get me started...)
|
|
|
|
|
Logged
|
|
|
|
|
Enki
|
 |
« Reply #20 on: September 06, 2008, 09:39:40 PM » |
|
You guys know linux, right? Just run dd and use /dev/zero as input to overwrite the drive as described here: http://16systems.com/zero/index.html. Seriously. Let dd complete - JUST ONE PASS, and I defy anyone to recover anything. That is a trivial recovery for a forensics lab. The zero write doesn't go all the way to zero flux, it goes MOST of the way. This is enough for the DSP on the hard disk to read a zero back afterwards, but there will be a trace of the previous data left in the background noise. /dev/urandom is a much better choice, especially with more than one pass. http://www.dban.org/ is even a better choice. Or fuck the coin altogether. You don't need their media/programming. 99% of it is all just bullshit anyways, and we do better ourselves. Their culture is like their fast-food - mass produced, and a steady diet *will* kill you. Maybe less hoarding and consuming and maybe some more sharing and creating. Open Source: it's ours. (Please note: although a linux-based distro was used to compose this, no linux-based boxes were harmed in the creation of this message. No Windows boxes were harmed either, because I don't do Windows. Mac FanBois - don't get me started...)
Now you're talking!
|
|
|
|
|
Logged
|
|
|
|
The Resonator Twins.
Ranter Level 1
Karma: 1
Posts: 3
|
 |
« Reply #21 on: September 07, 2008, 09:15:30 PM » |
|
http://16systems.com/zero/index.htmlThat's the whole point of the article though - everyone *says* you can't really wipe the drive, but that's the point of the article, and the challenge. I know, the fact that the NSA or whoever haven't taken them up on the offer may just be because they do not want to disclose any methods, or maybe it's that they can't and the article is true. I don't have a clean room or a lab, nor have I pulled off the platters but I've had some time to play with some drives I ran across and running a full dd did have the interesting side effect of wiping all traces of prior partition tables in some restore software, whereas the typical fdisk operations (linux or Windows) leave those traces, at least with the software I'm using (Restorer 2000 Pro being the most successful so far) - so at least it is doing something fundamentally different. And common sense would dictate urandom would be better but again, according to the article it doesn't seem to matter. I've done some looking but of course it's by no means extensive or exhaustive, but I do have *some* computer experience (about 10 years in the industry, various certs, currently at a software company I probably shouldn't name in public - my position specializes in SANs (Fibre Channel, hardware (HBA) and software (LAN-based) iSCSI, NFS) and Storage Arrays (including Datacentre Management (including all of the format/partition/file system stuff), Thick disk / Thin disk provisioning, LUN presentation, masking and zoning, virtualization and server environments - physical and virtualized, but if you run across urbanmonkey and he feels like telling you, he works there too), so I'm not totally in the dark either. Also, i did not say *impossible*, but I still do defy. Trivial matter? I'm not so sure, and I really would like to see 16systems challenge taken up by someone, just to clear up the paranoia and FUD. Tangent: so if you even just re-partition and format with a standard XP CD, there would have to be "forensics" and "re-construction" done. I would argue that any "re-construction" could be tantamount to tampering with evidence, or at the very least a form of hearsay, insofar as the contents of the drive had to be "RE-constructed" so the *actual* evidence does not exist. May not fly, but may - do not take this as legal counsel, for fucks sake. Personal note - I brought 263 CDs and DVDs over to my girlfriend's place a few weeks or a month or two ago. A real collection of a bunch of stuff I'll never hae time to watch, listen to, play, use, whatever. Windoze warez (who even uses Windoze anymore except for work, and why are you worried about the RIAA barging in through your front door when you let the NSA in through the backdoor on your Windoze box?), whole albums, metallica mp3s (at the time just for sharing, tee hee), movies, tv shows (like I'm ever going to endure another minute of 24), etc, ad-nauseum. I told her if she didn't want 'em to bring 'em to work and give them away or throw them out. They made it to the curb in record time. Sure, I've still got quite a few CDs, DVDs,LP's, 7"s (2 turntables - I know, I know...) etc... but mainly now just the good stuff. Server provides a massive buffet - it doesn't mean you have to gorge.
|
|
|
|
|
Logged
|
|
|
|
hatterofmaddnesz
Ranter Level 4
  
Karma: 28
Posts: 309
To Much Mercury
|
 |
« Reply #22 on: September 08, 2008, 06:24:29 PM » |
|
Tangent: so if you even just re-partition and format with a standard XP CD, there would have to be "forensics" and "re-construction" done. I would argue that any "re-construction" could be tantamount to tampering with evidence, or at the very least a form of hearsay, insofar as the contents of the drive had to be "RE-constructed" so the *actual* evidence does not exist. May not fly, but may - do not take this as legal counsel, for fucks sake.
The reconstruction of data from a hard drive is not construed as tampering. Much care and procedure is followed when doing actual forensic work on a hard drive. Whenever an electronic storage device is examined by an analyst, it is removed from the safe, the custody of evidence form filled out, hooked up to the device that will copy the data off with a hardware (preferred) write blocked in place, and then the device is placed back in the safe. Analysis is never done on the actual drive itself, a forensic copy is made and then examined. If wiped, the drive is "re-constructed" per say, but the output of such re-construction would be done to another forensic drive, never the original, and a write blocker would be in place. Even the forensic analyst's character can be called into question if taken to trial, much like a police officer.
|
|
|
|
|
Logged
|
I'd Rather Have It And Not Need It Than Need It And Not Have It hatterofmaddnesz
|
|
|
The Resonator Twins.
Ranter Level 1
Karma: 1
Posts: 3
|
 |
« Reply #23 on: September 08, 2008, 09:07:38 PM » |
|
But hang on... Despite my experience and knowledge I honestly don't know nearly enough about it so pardon my ignorance. First of all, I hear a lot of data recovery methods require direct access to the platters - how could a write to another device make that "ghost data" survive? In these cases it would seem the investigator would require access to the actual platters of the physical drive in question (or the actual RAM in a frozen state, or something like that I read in a previous post in this thread). So in this way there would not be a copy or the ability to do a "second pass". Someone else earlier also alluded to the issue of possible tampering, in that an investigator could, for whatever reason put suspect material on the drive and then "wipe" it, making it appear to those less informed as "truth". I just don't know. I mean, I just want all the Wogs or cyberpunks or individuals or people or whatever to be safe. I'm not trying to say "Hey everybody, listen to me and do next to nothing and you'll be safe". I honestly just don't fucking know, and I'm pretty sure we're all in the same boat. We can say "Oh sure, blah blah blah" but are we right? How do we ever know? I mean, I try to do what I can to see results for myself, but fucked if I know if they build some funky phone-home-to-the-Rothschilds shit into the firmware of every hard drive controller, or some secret cache that I can't understand or don't have the technology or techniques to decipher but is just another day at the office for the Bilderberg Group or CFR/Tri-lateral Commission to decode while worshipping that 50 foot statue of an owl out there at Bohemian Grove. But I try, and I communicate, and I'm not too scared of failure because I'm more scared of living in a society that is getting exponentially more fucked and controlling by the day, and the possible outcomes to creative loving people that I know and that I haven't even met yet. Server was the equalizer, but now everyone has to watch their backs. Don't think Google or your ISP isn't keeping logs of your "comings and goings", for sale to the highest bidder who will hire Anthropologists, Psychologists and Marketers to mine that info to know you better than you ever could know yourself so they can sell you a lifetime of experiences. Everything you fucking dream and hope for is a fucking marketing decision that goes beyond the concept of fascism and strikes the core of your very soul. You will become Human v2.0, and join the hive transcendence upon the occurrence of "singularity". Not me, man. Not me. So I want to help. I want to know. I want to find out for myself. And I want you to know. I want you to find out for yourself. It's "Go Time" folks. It's time to show the world what you are made of. It's time to tap into the hero inside of each and every one of yourselves because it's happening right now and it's up to us. Right NOW. And really, I keep going back to the best way to not get caught file sharing is to walk away from the modern culture industry and give them nothing. Quit buying, and consuming it altogether. You don't need it and it's programming you. Mostly everything we've been told has been sold to us - even our experiences are often not our own. Fuck them. This is total war. The battlefield is your mind, body and soul. The prize is the future. Quit hoarding. Create. Share.
|
|
|
|
|
Logged
|
|
|
|
avagdu
Ranter Level 5
   
Karma: 67
Posts: 1335
Son Of Liberty
|
 |
« Reply #24 on: September 08, 2008, 10:31:03 PM » |
|
@Enki Doesn't Derek's Boot and Nuke take hours? That's what I've heard. It seems like you could do a quick wipe and/or just remove the hard drive cage and hide it or bug out of there depending on the situation and destroy it on the way or at a secure location if need be. I'm not talking about situations of file sharing, just data destruction here. Removing a hard drive cage on case with thumb screws would probably take a minute or less, I haven't timed myself.
|
|
|
|
« Last Edit: September 08, 2008, 10:33:15 PM by avagdu »
|
Logged
|
"It takes a special sort of man to understand and enjoy liberty, and he is usually an outlaw in democratic societies" - HL Mencken
agorism.info | r4nger5blog.tk |
|
|
|
Nophix
Ranter Level 2

Karma: 3
Posts: 25
|
 |
« Reply #25 on: September 09, 2008, 08:54:43 AM » |
|
@Enki Doesn't Derek's Boot and Nuke take hours? That's what I've heard. It seems like you could do a quick wipe and/or just remove the hard drive cage and hide it or bug out of there depending on the situation and destroy it on the way or at a secure location if need be. I'm not talking about situations of file sharing, just data destruction here. Removing a hard drive cage on case with thumb screws would probably take a minute or less, I haven't timed myself. DBAN will depend on the machine and the method of destruction. A standard DoD simple, the default setting, on a p4 with 512mb, and an average of 100gb drive, will take about 15 minutes, maybe less. On a flip side, I just DBAN'd a bunch of PIII''s, with 128mb and under 20gb drives(most were 6), and it was averaging over 1.5 hours each. We use DBAN at work regularly. My personal solution to this is 2 fold. 1) use an external harddrive for everything I download. I actually don't DL anything copyrighted anyhow, mostly Linux iso's and episodes of my favorite IPTV shows, but what I DL is none of their business. 2) Whatever machine you are using, I would build a clean install with everything you would normally use, except the file sharing software. Image that to an identical hard drive and have it s a backup. Once a month or so, back up all your file shares to an external drive, wipe, and repeat. Then, if anything happens, swap out to the imaged drive and play dumb.
|
|
|
|
|
Logged
|
|
|
|
avagdu
Ranter Level 5
   
Karma: 67
Posts: 1335
Son Of Liberty
|
 |
« Reply #26 on: September 09, 2008, 09:07:05 AM » |
|
Image that to an identical hard drive and have it s a backup. What do you guys use to image your hard drives? Is the software cross-platform?
|
|
|
|
|
Logged
|
"It takes a special sort of man to understand and enjoy liberty, and he is usually an outlaw in democratic societies" - HL Mencken
agorism.info | r4nger5blog.tk |
|
|
|
Nophix
Ranter Level 2

Karma: 3
Posts: 25
|
 |
« Reply #27 on: September 09, 2008, 10:14:01 AM » |
|
Image that to an identical hard drive and have it s a backup. What do you guys use to image your hard drives? Is the software cross-platform? At work we use Altiris. It doesn't care what is on the drives, it runs as it's own bootable. It takes the snapshot, and sticks it on a server, and we pull it down from there. It can be set up to pull down to a backup drive.
|
|
|
|
|
Logged
|
|
|
|
Tych0
Ranter Level 3
 
Karma: 6
Posts: 191
There is no spoon.
|
 |
« Reply #28 on: September 16, 2008, 10:20:47 PM » |
|
|
|
|
|
|
Logged
|
" 'Round here dey call dat' da gillateen'. Welcome to Checahgo!" -Anonymous passenger in O'hare airport
|
|
|
Loopy
Ranter Level 5
   
Karma: 43
Posts: 870
Son Of Liberty
|
 |
« Reply #29 on: September 18, 2008, 03:07:37 PM » |
|
DBAN took hours when I ran it. It also has start up options that you have to select so you can't just put it in and boot.
Degaussing is a fairly good idea but I have never tried it and I'm not sure how good of a job it does.
|
|
|
|
|
Logged
|
~I shall ask the Congress for the one remaining instrument to meet the crisis--broad Executive power to wage a war against the emergency, as great as the power that would be given to me if we were in fact invaded by a foreign foe ...In the spirit of this gift I shall take it. -FDR
|
|
|
|