[ale] Need an iso to wipe hard drives.

[Greg Freemyer]

fyi: I whole heartedly agree, the mac wipe failure sounds like a
process failure, not a technology failure.

As to:  $1/MB ????????  for recovery

You must not be telling the whole story.  Or maybe you meant $1/GB.

That most expensive I'm aware of is a raid array failure.  That can be
$5K/drive or so, but that is still way below $1/MB.

Or maybe you just needed a few relatively small files recovered.  It
is still a lot of work to search the whole drive for a few fragments
and try to rebuild things.

I could see us charging $1K or even $2K to recover a specific deleted
file that was a real challenge to rebuild.  And if it was only 50 MB
or so, you might say that worked out to $20/MB, but that's not really
a fair to describe the price.

Greg

On Fri, Apr 16, 2010 at 12:44 PM, Jim Kinney <jim.kinney at gmail.com> wrote:
> sounds like the wipe tool on that Mac was crap and just did a delete. Drive
> recovery is $$$$$$$$$!!!!
> The last one I ran for a client was $1/MB.
>
> On Fri, Apr 16, 2010 at 12:24 PM, scott boss <scott at sboss.net> wrote:
>>
>> A friend of mines wife wiped her mac laptop HD.  Not the govt 35pass
>> but a single pass wipe.  He sent it off to one of those disk recovery
>> companies and he got 99% of the disk back and the HD was much larger
>> than 20g.  She had over 20g of photos alone.
>>
>> Ymwv!!
>>
>> Sent from my mobile...
>>
>> On Apr 16, 2010, at 12:04, Brian Pitts <brian at polibyte.com> wrote:
>>
>> > On 04/16/2010 11:31 AM, Greg Freemyer wrote:
>> >>
>> >> NIST has a sanitation paper that says disk drives of 20GB or larger
>> >> capacity are not recoverable even via laboratory means after a single
>> >> wipe with zero's.
>> >>
>> >> So your just wasting cpu cycles using /dev/urandom.  Just use
>> >> /dev/zero.  And just do it once.
>> >
>> > The link you shared to a discussion of that paper a while back is
>> > dead.
>> > Do you know of any more sources? I'd really like to have something to
>> > wave at the "you must wipe it 27 times" people.
>> >
>> >> Also, ext2/3 reserves x% of the drive for root, so if your doing the
>> >> above as a normal user, your missing that x%.  I think x% is 5%,
>> >> but I
>> >> don't recall for sure.  And 5% of 1TB is 50GB, so it is a big deal.
>> >
>> > At Free IT Athens, we run sfill and sswap from the secure-delete suite
>> > of tools as a post-install action to securely erase all unused space
>> > on
>> > a system being refurbished. sfill sipes the disk space and inode
>> > space,
>> > and sswap takes care of the swap partition.
>> >
>> > --
>> > All the best,
>> > Brian Pitts
>> > _______________________________________________
>> > Ale mailing list
>> > Ale at ale.org
>> > http://mail.ale.org/mailman/listinfo/ale
>> > See JOBS, ANNOUNCE and SCHOOLS lists at
>> > http://mail.ale.org/mailman/listinfo
>> _______________________________________________
>> Ale mailing list
>> Ale at ale.org
>> http://mail.ale.org/mailman/listinfo/ale
>> See JOBS, ANNOUNCE and SCHOOLS lists at
>> http://mail.ale.org/mailman/listinfo
>
>
>
> --
> --
> James P. Kinney III
> Actively in pursuit of Life, Liberty and Happiness
>
>
> _______________________________________________
> Ale mailing list
> Ale at ale.org
> http://mail.ale.org/mailman/listinfo/ale
> See JOBS, ANNOUNCE and SCHOOLS lists at
> http://mail.ale.org/mailman/listinfo
>
>



-- 
Greg Freemyer
Head of EDD Tape Extraction and Processing team
Litigation Triage Solutions Specialist
http://www.linkedin.com/in/gregfreemyer
CNN/TruTV Aired Forensic Imaging Demo -
   http://insession.blogs.cnn.com/2010/03/23/how-computer-evidence-gets-retrieved/

The Norcross Group
The Intersection of Evidence & Technology
http://www.norcrossgroup.com