Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
?
Solved

Detecting if someone used a disk wipe / secure erase program

Posted on 2008-09-30
4
Medium Priority
?
523 Views
Last Modified: 2012-06-27
I was recently on a tech call to try and recover some missing files from a small office that had a laptop returned to them from an employee that recently left, but apparently deleted all of their work files. I was unable to find any ms office documents and was wondering if there were any programs that can detect if a disk wiper was used? As this is a small office, they won't be sending the drive away for any expensive file recovery services (they'll live without the files), but they were curious to see if the employee had used a disk wipe program.

Any ideas?
0
Comment
Question by:mrbayne
  • 2
4 Comments
 
LVL 97

Expert Comment

by:Lee W, MVP
ID: 22610024
I can not imagine a situation where you would know unless you could find the actual disk wipe program installed.  
0
 
LVL 97

Expert Comment

by:Lee W, MVP
ID: 22610028
I suppose you can "guess" based on the configuration of the laptop when it was returned... but there are plenty of programs that can do a "file wipe"
0
 
LVL 38

Accepted Solution

by:
Rich Rumble earned 500 total points
ID: 22627597
No, most wipe utilities do a combination of things, all 1's all 0's alternating 1's and 0's and random... so you couldn't tell one from the other. Windows also has it's own wipe utility, cipher.exe which will over-write once with random data. You can run it as much as you like to get multiple wipes. Doesn't matter if they did really, you could never actually tell, maybe they just hit the delete button, and then defrag'd the HD, that would likely over-write the empty places those files used to be, especially if the HD was very fragmented. You can run recovery software, but you should never boot or install programs to the drive you want to recover data from, things will get overwritten that way. Take the HD out, use something like: http://www.newegg.com/Product/Product.aspx?Item=N82E16812119152 that adapter to read the HD. use a program like: http://tokiwa.qee.jp/EN/dr.html to scan the HD to see if you can recover the data.
Again, unless as stated above, you find the utility they used using software like I linked to, you will never know if they used a utility or if they simply hit shift+delete (by passes recycle bin) and then defragged the HD.
-rich
0
 
LVL 1

Expert Comment

by:Brese
ID: 22663427
Although you could use a tool like FTK, it appears you are looking for a quick fix. I would suggest removing the drive, loading it onto another machine as an external drive, then run a tool like PC Inspector File Recovery. That app in particular can recover "lost files" and you can see deleted applications.

IF they used a wipe program that they installed, like cCleaner for example, they had to uninstall it and therefore couldn't wipe it, which would leave it potentially available for recovery.

You could perform this inside an hour and get an answer to your client.
0

Featured Post

Become an Android App Developer

Ready to kick start your career in 2018? Learn how to build an Android app in January’s Course of the Month and open the door to new opportunities.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

We look at whether swapping a controller board on a failed hard drive is likely to solve the problem.
It all started with a phone call.  The then acting director of the Office of Research Computing, called to ask me to remotely shutdown my computer, it was Yom Kippur, Wednesday October 12, 2016.
This video Micro Tutorial explains how to clone a hard drive using a commercial software product for Windows systems called Casper from Future Systems Solutions (FSS). Cloning makes an exact, complete copy of one hard disk drive (HDD) onto another d…
Look below the covers at a subform control , and the form that is inside it. Explore properties and see how easy it is to aggregate, get statistics, and synchronize results for your data. A Microsoft Access subform is used to show relevant calcul…
Suggested Courses
Course of the Month15 days, 10 hours left to enroll

580 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question