Title

Assessing Trace Evidence Left By Secure Deletion Programs

Keywords

FAT12 file system; Secure deletion; Trace evidence; Windows XP

Abstract

Secure deletion programs purport to permanently erase files from digital media. These programs are used by businesses and individuals to remove sensitive information from media, and by criminals to remove evidence of the tools or fruits of illegal activities. This paper focuses on the trace evidence left by secure deletion programs. In particular, five Windows-based secure deletion programs are tested to determine if they leave identifiable signatures after deleting a file. The results show that the majority of the programs leave identifiable signatures. Moreover, some of the programs do not completely erase file metadata, which enables forensic investigators to extract the name, size, creation date and deletion date of the "deleted" files. © 2006 Springer-Verlag US.

Publication Date

12-1-2006

Publication Title

IFIP Advances in Information and Communication Technology

Volume

222

Number of Pages

185-195

Document Type

Article; Proceedings Paper

Personal Identifier

scopus

DOI Link

https://doi.org/10.1007/978-0-387-36891-7-15

Socpus ID

34047210955 (Scopus)

Source API URL

https://api.elsevier.com/content/abstract/scopus_id/34047210955

This document is currently not available here.

Share

COinS