Disk wipers and their forensic function

By Muthoga Kioni

It is undisputable that our modern day lives have become inexorably intertwined with technology. Be it the mobile phone, the home PC, the micro-chips in our cars or the computers in medical life support systems, technology has become indispensable.

A by-product of this dependency is the high value digital data/information stored in these devices. Laptops have been lost that contain thousands of employee’s records. Trade secrets have been stolen and transported in flash disks.

Disk wiping or data erasing has as a result become increasingly crucial in the protection of confidential and private information for the law-abiding computer user. Before disposing of your old computer, it is important to know a few basics about disk wiping.

Deleting files

Your procedure should begin by using Windows to delete all files and directories. A disk wiping utility to obliterate empty space and examination for residue should then be conducted.

Windows and other operating systems do not delete files when you ‘trash’ them. It simply removes the file headers and marks the physical space that the files occupied as unallocated and therefore available for reuse.

Disk wiping utilities typically erase this unallocated space. They basically involve the creation of a new file that contains a wiping pattern. So instead of the original zero ones, it creates all zeros or random zeroes and ones. This pattern is applied to all available free disk space including, most crucially, space left behind by deleted files. Therefore, a disk wiping utility should obliterate all of the space formerly occupied by deleted files.

Post-erasure analysis

After this free space has been wiped, it is advisable to conduct a post-erasure disk analysis using software tools such as WinHex or Access Data’s FTK. These tools allow you to determine whether any disk residue exists.

Most disk wipers, however, leave behind information that may have proprietary or security implications. Despite their advertised claims, disk erasers may leave enough metadata (data about data) residue that would provide enough clues about your files.

There are various Disk Wiping tools, for example Cipher.exe, Cyberscrub, PGP Wipe, Wincleaner and many others. Evidence Eliminator is one of the best Disk Wipers around.

Another interesting category of products are the so-called disk sanitisers or disk purgers. These are tools that are marketed to vendors who recycle computers.

—The writer ([email protected]) is an ICT Security and Forensic Specialist.