erase download evidence

O

octohunter

Guest
Hypothetically Speaking-

If someone was too have downloaded a bunch of stuff off of a file share and wants to erase 100% of the evidence, what would be the best way to do so?
 
Joined
Jun 11, 2003
Messages
4,915
Reaction score
68
Points
48
Location
Mount Vernon, WA
Your Mac's Specs
MacBook Pro 2.6 GHz Core 2 Duo 4GB RAM OS 10.5.2
Dump it into the trash and do a Secure Empty Trash, I think that should do it...
 
OP
O

octohunter

Guest
Thanks. That was fast. Any idea how many times the data is overwritten?
 
OP
O

octohunter

Guest
Also, can this secure empty trash be done for items deleted earlier or is it only for what is in the trash currently?
 
Joined
Mar 9, 2004
Messages
2,860
Reaction score
21
Points
38
Location
Miami FL
Your Mac's Specs
G4 1Ghz OS X 10.4.7
Secure can't be redone for stuff already deleted, just current
 
Joined
Mar 9, 2004
Messages
2,860
Reaction score
21
Points
38
Location
Miami FL
Your Mac's Specs
G4 1Ghz OS X 10.4.7
If they were trashed and trash empied, they are gone
 
OP
O

octohunter

Guest
It's incerdible it's that easy. What is the point of apps such as CleanSweep?
 

rman


Retired Staff
Joined
Dec 24, 2002
Messages
12,637
Reaction score
168
Points
63
Location
Los Angeles, California
Your Mac's Specs
14in MacBook Pro M1 Max 32GB 2TB
You do have one small concern thou. If this is a file server you are using for temporary storage. Make sure IT is not backing up the server, during the time of usage. Because if there is a back up, you know what that means.

I have worked at major aerospace company in the past. Where an employee was downloading porn onto the company file server. Since I don't regular look for files of that nature. I was surprise to find how many back up tape that contained the downloaded files.
 
OP
O

octohunter

Guest
Great story. No, I'm only on a network. There's no fileserver and the folder in question was not made available.

Thanks rman.
 
Joined
Jun 11, 2003
Messages
4,915
Reaction score
68
Points
48
Location
Mount Vernon, WA
Your Mac's Specs
MacBook Pro 2.6 GHz Core 2 Duo 4GB RAM OS 10.5.2
Yikes and Im pretty sure that if you deleted just a regular delete it is still there somewhere, but Im not real sure on that one. Otherwise there would be no reason for secure empty trash....
 

rman


Retired Staff
Joined
Dec 24, 2002
Messages
12,637
Reaction score
168
Points
63
Location
Los Angeles, California
Your Mac's Specs
14in MacBook Pro M1 Max 32GB 2TB
I believe that Apple, added another level of security to meet the government standards. With the security problem with M$, Apple is working to obtain more government business.
 

rman


Retired Staff
Joined
Dec 24, 2002
Messages
12,637
Reaction score
168
Points
63
Location
Los Angeles, California
Your Mac's Specs
14in MacBook Pro M1 Max 32GB 2TB
I am sorry, that is why the secure erase option was added.
 
Joined
Mar 9, 2004
Messages
2,860
Reaction score
21
Points
38
Location
Miami FL
Your Mac's Specs
G4 1Ghz OS X 10.4.7
That doesn't mean much to you. This is how delete from trash works. Delete doesn't remove the file data. Empty trash: It marks that physical hard drive area for over write. Secure empty trash: marks the area for sooner over write. Skilled analysts can read back 6 over writes on a PC hard drive. I don't know on Mac but last I heard only the Royal Canadian Mounted Police knew how to analyze a Mac drive
 
Joined
Nov 4, 2003
Messages
654
Reaction score
11
Points
18
Location
Southern Indiana
Your Mac's Specs
Mac Pro Quad Xeon 2.66GHz 3GB RAM, G4 Quicksilver w/Sonnet 1GHz Encore ST, 1ghz G4 Powerbook
Yes, if you just did an "Empty Trash" the file "could" (if it hasn't been overwritten) still be there.

To totally clean the drive you need to backup the data and then reformat the drive using Disk Utility.

Back up your data (I'm sure you already have a backup, don't you?)

Open Disk Utility
Select your drive
Click on the "erase" button
Click on the "Options" button.
Select "8 way Random Write Format"
Click "OK" button
Click "Erase" button

That will remove all evidence of prior data.
 

rman


Retired Staff
Joined
Dec 24, 2002
Messages
12,637
Reaction score
168
Points
63
Location
Los Angeles, California
Your Mac's Specs
14in MacBook Pro M1 Max 32GB 2TB
I believe that is what secure erase does. I have notice, when I use it. It takes a long time before the files are erased.
 
OP
A

Animatronica

Guest
Actually the totally cleaning the hard drive may NOT get rid of the files aswell. I had my one backup hard drive(120gb) that I used for music stroage that I erased, formated and wrote over 10 different times and when I went to "recover some information EVERYTHING got recovered even the stuff that I put on it from the very first day I got it. About 90% of all the files that were ever on it were recovered. I think the best way to make sure the information is gone would be said in two words...sledge hammer :)
C-ya
 
OP
O

octohunter

Guest
Isn't there a program (for pc I believe it to be Eraser) that writes over 35x?
 

Shop Amazon


Shop for your Apple, Mac, iPhone and other computer products on Amazon.
We are a participant in the Amazon Services LLC Associates Program, an affiliate program designed to provide a means for us to earn fees by linking to Amazon and affiliated sites.
Top