Nothing Special   »   [go: up one dir, main page]
Skip to main content
Springer Nature Link
Log in

One Big File Is Not Enough: A Critical Evaluation of the Dominant Free-Space Sanitization Technique

  • Conference paper
Privacy Enhancing Technologies (PET 2006)

Part of the book series: Lecture Notes in Computer Science ((LNSC,volume 4258))

Included in the following conference series:

Abstract

Many of today’s privacy-preserving tools create a big file that fills up a hard drive or USB storage device in an effort to overwrite all of the “deleted files” that the media contain. But while this technique is widespread, it is largely unvalidated.

We evaluate the effectiveness of the “big file technique” using sector-by-sector disk imaging on file systems running under Windows, Mac OS, Linux, and FreeBSD. We find the big file is effective in overwriting file data on FAT32, NTFS, and HFS, but not on Ext2fs, Ext3fs, or Reiserfs. In one case, a total of 248 individual files consisting of 1.75MB of disk space could be recovered in their entirety. Also, file metadata such as filenames are rarely overwritten. We present a theoretical analysis of the file sanitization problem and evaluate the effectiveness of a commercial implementation that implements an improved strategy.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution

Institutional subscriptions

Preview

Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.

Similar content being viewed by others

References

  1. Redacting with confidence: How to safely publish sanitized reports converted from word to pdf. Technical Report I333-015R-2005, Architectures and Applications Division of the Systems and Network Attack Center (SNAC), Information Assurance Directorate, National Security Agency (2005)

    Google Scholar 

  2. Acronis, Inc., http://www.acronis.com/

  3. Apple Computer, Inc. Apple Disk Utility (2006)

    Google Scholar 

  4. Bauer, S., Priyantha, N.B.: Secure data deletion for Linux file systems. In: Proc. 10th Usenix Security Symposium, San Antonio, Texas, Usenix, pp. 153–164 (2001)

    Google Scholar 

  5. Burke, P.K., Craiger, P.: Digital Trace Evidence from Secure Deletion Programs. In: Proceedings of the Second Annual IFIP WG 11.9 International Conference on Digital Forensics, Orlando, Florida (January 2006)

    Google Scholar 

  6. Carrier, B.: The Sleuth Kit & Autopsy: Forensics tools for Linux and other Unixes (2005)

    Google Scholar 

  7. Chow, J., Pfaff, B., Garfinkel, T., Christopher, K., Rosenblum, M.: Understanding data lifetime via whole system simulation. In: Proc. of the 13th Usenix Security Symposium, Usenix (August 9–13, 2004)

    Google Scholar 

  8. Microsoft Corporation. How To Use Cipher.exe to Overwrite Deleted Data in Windows (July 2004)

    Google Scholar 

  9. Microsoft Corporation. Windows 2000 Security Tool: New Cipher.exe Tool (March 2004), http://www.microsoft.com/downloads/release.asp?releaseid=30925

  10. Di Crescenzo, G., Fergurson, N., Impagliazzo, R., Jakobsson, M.: How to forget a secret. In: Meinel, C., Tison, S. (eds.) STACS 1999. LNCS, vol. 1563, pp. 500–509. Springer, Heidelberg (1999)

    Chapter  Google Scholar 

  11. CyberScrub LLC, http://www.cyberscrub.com/

  12. Cleaning and sanitization matrix, ch.8 (January 1995)

    Google Scholar 

  13. EAST Technologies, http://www.east-tec.com/

  14. Garfinkel, S.L.: Design Principles and Patterns for Computer Systems that are Simultaneously Secure and Usable. PhD thesis, MIT, Cambridge, MA (April 26, 2005)

    Google Scholar 

  15. Garfinkel, S.L., Malan, D.J., Dubec, K.-A., Stevens, C.C., Pham, C.: Disk imaging with the advanced forensic format, library and tools. In: Research Advances in Digital Forensics (Second Annual IFIP WG 11.9 International Conference on Digital Forensics), Springer, Heidelberg (2006)

    Google Scholar 

  16. Trant, G.: Eraser, http://www.heidi.ie/eraser/

  17. Geiger, M.: Evaluating Commercial Counter-Forensic Tools. In: Proceedings of the 5th Annual Digital Forensic Research Workshop, New Orleans, Louisiana (August 2005)

    Google Scholar 

  18. Guidance Software, Inc. EnCase Forensic

    Google Scholar 

  19. Gutmann, P.: Secure deletion of data from magnetic and solid-state memory. In: Sixth USENIX Security Symposium Proceedings, San Jose, California, July 22-25, Usenix (1996) (Online paper has been updated since presentation in 1996)

    Google Scholar 

  20. IDM Computer Solutions, Inc., http://www.ultrasentry.com/

  21. Mark Russinovich. SDelete (2003)

    Google Scholar 

  22. Russinovich, M., Cogswell, B.: Filemon for Windows

    Google Scholar 

  23. Microsoft. Cipher.exe security tool for the encrypting file system (January 31, 2006)

    Google Scholar 

  24. NeoImagic Computing, Inc., http://www.neoimagic.com/

  25. Onley, D.S.: Pdf user slip-up gives dod lesson in protecting classified information. Government Computer News 24 (April 16, 2005)

    Google Scholar 

  26. Poulsen, K.: Justice e-censorship gaffe sparks controversy. In: SecurityFocus (October 23, 2003)

    Google Scholar 

  27. Robin Hood Software Ltd., http://www.evidence-eliminator.com/

  28. Rowe, N.C.: Automatic detection of fake file systems. In: International Conference on Intelligence Analysis Methods and Tools (May 2005)

    Google Scholar 

  29. Shankland, S., Ard, S.: Document shows SCO prepped lawsuit against BofA. In: News.Com (March 4, 2004)

    Google Scholar 

  30. Stone, K., Keightley, R.: Can Computer Investigations Survive Windows XP? Technical report, Guidance Software, Pasadena, California (December 2001)

    Google Scholar 

  31. Webroot Software, Inc., http://www.webroot.com/

  32. WhiteCanyon, Inc., http://www.whitecanyon.com/

  33. Young, W.D., Boebeit, W.E., Kain, R.Y.: Proving a computer system secure. The Scientific Honeyweller 6(2), 18–27 (1985); Reprinted in Abrams, M.D., Podell, H. J.(eds.): Computer and Network Security, IEEE Computer Security Press, New York (1986)

    Google Scholar 

  34. Zorn, B.: Comparing mark-and sweep and stop-and-copy garbage collection. In: LFP 1990: Proceedings of the 1990 ACM conference on LISP and functional programming, pp. 87–98. ACM Press, New York (1990)

    Chapter  Google Scholar 

Download references

Author information

Authors and Affiliations

  1. Center for Research on Computation and Society, Harvard University,  

    Simson L. Garfinkel

  2. Division of Engineering and Applied Sciences, Harvard University,  

    David J. Malan

Authors
  1. Simson L. Garfinkel
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. David J. Malan
    View author publications

    You can also search for this author in PubMed Google Scholar

Editor information

Editors and Affiliations

  1. Microsoft Research, Cambridge, UK

    George Danezis

  2. Palo Alto Research Center, 3333 Coyote Hill Rd, 94304, Palo Alto, CA, USA

    Philippe Golle

Rights and permissions

Reprints and permissions

Copyright information

© 2006 Springer-Verlag Berlin Heidelberg

About this paper

Cite this paper

Garfinkel, S.L., Malan, D.J. (2006). One Big File Is Not Enough: A Critical Evaluation of the Dominant Free-Space Sanitization Technique. In: Danezis, G., Golle, P. (eds) Privacy Enhancing Technologies. PET 2006. Lecture Notes in Computer Science, vol 4258. Springer, Berlin, Heidelberg. https://doi.org/10.1007/11957454_8

Download citation

  • DOI: https://doi.org/10.1007/11957454_8

  • Publisher Name: Springer, Berlin, Heidelberg

  • Print ISBN: 978-3-540-68790-0

  • Online ISBN: 978-3-540-68793-1

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation