Criminal Forensics

[bobland]

I watch a lot of reality crime shows. The main suspect's computer is always taken and scrubbed for data. The investigators always find search strings like "how to murder someone," "how to strangle," "how to avoid child support," etc.

So, where is all of this data stored?

 

[smarteyeball]

When you delete something, it's not actually 'deleted'. It's merely flagged by the OS as re-usable blocks, so until that data is written over, it is still recoverable.


For search strings, such as browser searches etc, they simply recover those files.

 

[profdlp]

Are you a happily married man, bobland?

 

[mickey megabyte]

well that's great, i've just read the op, and now the words "how to strangle" are on my computer!

oh noes - now they are on it twice!

how do i get rid of them? would putting my ssd in the microwave work?

 

[Bare Foot Kid]

Have a go at the #7 clean all in this tutorial at the link below to do a secure erase of an entire HDD though if you need to do an OS HDD you will have to boot to diskpart and run the wipe from there, see the second tutorial.

Be advised: any of these methods make the data completely unrecoverable.


Disk - Clean and Clean All with Diskpart Command

SSD / HDD : Optimize for Windows Reinstallation

DISKPART : At PC Startup

Edit: If you prefer a partition-specific wipe of a single partition, instead of the entire HDD; the program will also do 2 flavors of the military DoD secure erase, have a look at Option Three of this tutorial.

Partition Wizard : Use the Bootable CD

   Note

Contrary to popular belief, doing a full format with Windows 7 does not remove any data at all, it just checks for sector errors and marks the space to be over-written as needed, all the data is still there including all the code from previous, failed installation attempts.

​

 

[bassfisher6522]

So the real questions are: How do you rewrite what data's there and what data's not there? What software to use to do so?

Well I just wasn't fast enough...lol. Thanks BFK

 

[richnrockville]

There are secure erase programs that will write hundreds of times zero's and ones to every block of your
hard disk, especially if your paranoid and afraid of what the forensic investigators will find.

Dang, now I have to do that to protect my game passwords

Rich

 

[sygnus21]

I watch a lot of reality crime shows. The main suspect's computer is always taken and scrubbed for data. The investigators always find search strings like "how to murder someone," "how to strangle," "how to avoid child support," etc.

So, where is all of this data stored?

There are secure erase programs that will write hundreds of times zero's and ones to every block of your
hard disk, especially if your paranoid and afraid of what the forensic investigators will find.

Dang, now I have to do that to protect my game passwords

Rich

Like piracy this is a give and take world - there are those who make software to recover data, and there are those who make software to delete it. Most of us mere mortals probably don't have access to either of those very sophisticated software packages.... or even know about them

 

[Bare Foot Kid]

I have just edited my post #5 above to include additional information.

 

[bobland]

No one has answered my question. Where are search data strings stored? I can erase anything on my disks. That is not a problem. My question is out of curiosity. In most reality crime shows, what you see is what you get. On shows like CSI, the misinformation is so stupendous, it is laughable.

 

[sygnus21]

No one has answered my question. Where are search data strings stored?

I myself can't answer that question. Also be aware that those "search data strings" may be something unique to law enforcement..... And something not publically published for obvious reasons

 

[Bare Foot Kid]

Just deleting data does not remove it.

I am always totally amazed that people think a format does something, it does not.

 

[sygnus21]

Just deleting data does not remove it.

I am always totally amazed that people think a format does something, it does not.

He clearly understands that - that's why he's asking about the technology law enforcement uses to recover it. Curiosity???

 

[gregrocker]

If you're signed into Google when you search from their webpage, toolbar or browser search box then the search is saved in their servers to be compiled and sold as marketing research which profiles you. Privacy is but one of the reasons Google is becoming less trustworthy.

I would imagine that police forensics use the latest data recovery technology so one could never be sure the data is not recoverable.

The full combination of disk wiping regimens including DOD standard are available on the Disk tab of free Partition Wizard boot CD.

 

[ignatzatsonic]

The average person whose computer has been confiscated by law enforcement has not even attempted a format to erase anything.

Formatting is not the point of the OP's post.

Does law enforcement look in particular folders on the hard drive for search strings? If so, what folders?

Or, alternatively, does law enforcement just capture the computer's IP address and then contact the ISP in question and/or Google to find out what search terms may have been entered into Google from that IP address?

The confiscation of the computer implies the search terms are to be found on the computer, per se. If so, where, and can that location be cleared? If cleared, can that cleared space then be wiped (overwritten deliberately)?

From reading this thread, I don't see any answers on the point.

I periodically see apps designed to wipe ONLY unoccupied space--I think CCleaner has such a capability. But I have no idea how well it works.

 

[sygnus21]

If you're signed into Google when you search from their webpage, toolbar or browser search box then the search is saved in their servers to be compiled and sold as marketing research which profiles you. Privacy is but one of the reasons Google is becoming less trustworthy.

Not to be paranoid but I've been saying this for a while now. Google is becoming the premier information corporation worldwide. Information is power. Who controls it???

Anyway there are tons of ways for law enforcement to recover data you've created or searched for. Don't want them to find it.... don't use the internet, or computers

The confiscation of the computer implies the search terms are to be found on the computer, per se. If so, where?

From reading this thread, I don't see any answers on the point.

I don't think there is a simple answer, and certainly not one non-forensics people can answer.

 

[severedsolo]

This may be of interest: HowStuffWorks "How Computer Forensics Works" I've only given it a skim read, but it looks interesting, will have a proper look later.

 

[seekermeister]

Just deleting data does not remove it.

I am always totally amazed that people think a format does something, it does not.

I'm not certain that it is as thorough as other options, but a low level format does delete data. If course, that only works on a drive or partition, not specific data within them.

 

[ignatzatsonic]

This may be of interest: HowStuffWorks "How Computer Forensics Works" I've only given it a skim read, but it looks interesting, will have a proper look later.

I read through the above link and found nothing particularly revealing, other than the following quote, which implies data can be recovered from RAM, even after a shutdown. Not surprising, I guess.

"There are several programs designed to preserve the information in a computer's random access memory (RAM). Unlike information on a hard drive, the data in RAM ceases to exist once someone shuts off the computer. Without the right software, this information could be lost easily."


But I found nothing in the article regarding folders, locations, wiping, overwriting, etc. It does give a brief background on anti-forensics.

 

[Tepid]

If you're signed into Google when you search from their webpage, toolbar or browser search box then the search is saved in their servers to be compiled and sold as marketing research which profiles you. Privacy is but one of the reasons Google is becoming less trustworthy.

Not to be paranoid but I've been saying this for a while now. Google is becoming the premier information corporation worldwide. Information is power. Who controls it???

Anyway there are tons of ways for law enforcement to recover data you've created or searched for. Don't want them to find it.... don't use the internet, or computers

The confiscation of the computer implies the search terms are to be found on the computer, per se. If so, where?

From reading this thread, I don't see any answers on the point.

I don't think there is a simple answer, and certainly not one non-forensics people can answer.

Yeah, and with Android, people are not only collected as data, they are tracked by their movements. If one does not think so, then I say one is a fool.
Remember, google maps collected WIFI data all over the world. They would have kept doing it had they not been caught, and who is to say they have truly stopped?

I do not trust google, which is why everything I can block from them is blocked and I will never use Chrome.

I'm not certain that it is as thorough as other options, but a low level format does delete data. If course, that only works on a drive or partition, not specific data within them.

Not, it is not, low level format only writes Zero's to the drive one time, it's a single overwrite.

The most secure method of wiping a drive completely of all data is to use the Secure Erase function of the firmware on the drive itself. It's is not a quick method.

HDDErase is one of a very small number of applications that you can use to access the Secure Erase Function.