Windows 7: Criminal Forensics

bobland · 18 Mar 2011

I watch a lot of reality crime shows. The main suspect's computer is always taken and scrubbed for data. The investigators always find search strings like "how to murder someone," "how to strangle," "how to avoid child support," etc.

So, where is all of this data stored?

smarteyeball · 18 Mar 2011

When you delete something, it's not actually 'deleted'. It's merely flagged by the OS as re-usable blocks, so until that data is written over, it is still recoverable.

For search strings, such as browser searches etc, they simply recover those files.

profdlp · 18 Mar 2011

Are you a happily married man, bobland?

mickey megabyte · 19 Mar 2011

well that's great, i've just read the op, and now the words "how to strangle" are on my computer!

oh noes - now they are on it twice!

how do i get rid of them? would putting my ssd in the microwave work?

Bare Foot Kid · 19 Mar 2011

Have a go at the #7 clean all in this tutorial at the link below to do a secure erase of an entire HDD though if you need to do an OS HDD you will have to boot to diskpart and run the wipe from there, see the second tutorial.

Be advised: any of these methods make the data completely unrecoverable.

Disk - Clean and Clean All with Diskpart Command

SSD / HDD : Optimize for Windows Reinstallation

DISKPART : At PC Startup

Edit: If you prefer a partition-specific wipe of a single partition, instead of the entire HDD; the program will also do 2 flavors of the military DoD secure erase, have a look at Option Three of this tutorial.

Partition Wizard : Use the Bootable CD

Note

Contrary to popular belief, doing a full format with Windows 7 does not remove any data at all, it just checks for sector errors and marks the space to be over-written as needed, all the data is still there including all the code from previous, failed installation attempts.

bassfisher6522 · 19 Mar 2011

So the real questions are: How do you rewrite what data's there and what data's not there? What software to use to do so?

Well I just wasn't fast enough...lol. Thanks BFK

richnrockville · 19 Mar 2011

There are secure erase programs that will write hundreds of times zero's and ones to every block of your
hard disk, especially if your paranoid and afraid of what the forensic investigators will find.

Dang, now I have to do that to protect my game passwords

Rich

sygnus21 · 19 Mar 2011

Quote: Originally Posted by bobland

I watch a lot of reality crime shows. The main suspect's computer is always taken and scrubbed for data. The investigators always find search strings like "how to murder someone," "how to strangle," "how to avoid child support," etc.

So, where is all of this data stored?

Quote: Originally Posted by richnrockville

There are secure erase programs that will write hundreds of times zero's and ones to every block of your
hard disk, especially if your paranoid and afraid of what the forensic investigators will find.

Dang, now I have to do that to protect my game passwords

Rich

Like piracy this is a give and take world - there are those who make software to recover data, and there are those who make software to delete it. Most of us mere mortals probably don't have access to either of those very sophisticated software packages.... or even know about them

Bare Foot Kid · 19 Mar 2011

I have just edited my post #5 above to include additional information.

bobland · 19 Mar 2011

No one has answered my question. Where are search data strings stored? I can erase anything on my disks. That is not a problem. My question is out of curiosity. In most reality crime shows, what you see is what you get. On shows like CSI, the misinformation is so stupendous, it is laughable.

Windows 7: Criminal Forensics

Criminal Forensics problems?