Velocity Reviews

Velocity Reviews (http://www.velocityreviews.com/forums/index.php)
-   Computer Security (http://www.velocityreviews.com/forums/f38-computer-security.html)
-   -   Evidence Eliminator v Encase (http://www.velocityreviews.com/forums/t306152-evidence-eliminator-v-encase.html)

Silas 12-03-2004 09:05 PM

Evidence Eliminator v Encase
 
I got both these software and tested them out. I used the Safe Delete
option of Evidence Eliminator on a file to wipe 9 times, in effect an
attempt to shred the file. I then ran Encase and found that the file
still existed on my hard drive. Encase reported that the file was
deleted but the name, date, logical size of file, physical size of file,
and starting cluster still existed. My questions are:

1. Can such a file now be recovered using Encase?
2. Why has Evidence Eliminator failed to remove all traces of deleted
files it has claimed it can remove?
3. Is Evidence Eliminator on the above basis a total failure?

Comments would be appreciated.

Use.Netuser.de 12-03-2004 11:59 PM

Re: Evidence Eliminator v Encase
 
"Silas" <silas@sorry.nomail.com> wrote ...
> I got both these software and tested them out. I used the Safe Delete
> option of Evidence Eliminator on a file to wipe 9 times, in effect an
> attempt to shred the file. I then ran Encase and found that the file
> still existed on my hard drive. Encase reported that the file was
> deleted but the name, date, logical size of file, physical size of file,
> and starting cluster still existed. My questions are:
>
> 1. Can such a file now be recovered using Encase?
> 2. Why has Evidence Eliminator failed to remove all traces of deleted
> files it has claimed it can remove?
> 3. Is Evidence Eliminator on the above basis a total failure?


I have no working knowledge of either application however if one purports to
securely erase a file yet remnants remain regardless of which remnants then
I would be concerned. You would be the best one to test if Encase can
actually recover fragments and based on this be able decide if EE is a total
failure.



Ant 12-04-2004 12:23 AM

Re: Evidence Eliminator v Encase
 
"Silas" wrote:
> I got both these software and tested them out. I used the Safe Delete
> option of Evidence Eliminator on a file to wipe 9 times, in effect an
> attempt to shred the file. I then ran Encase and found that the file
> still existed on my hard drive. Encase reported that the file was
> deleted but the name, date, logical size of file, physical size of file,
> and starting cluster still existed.


It's reporting the contents of the deleted directory entry. However,
the file data may have been overwritten.

> My questions are:
>
> 1. Can such a file now be recovered using Encase?


Have you tried?

> 2. Why has Evidence Eliminator failed to remove all traces of deleted
> files it has claimed it can remove?


Because they are liars.

> 3. Is Evidence Eliminator on the above basis a total failure?


You're obviously unaware of the history of these people. I would not
trust their claims, or ever use their software.

Consumer Warning: Robin Hood Software and Evidence Eliminator:
http://www.discord.org/~lippard/evid...tor-sucks.com/

The Evidence Eliminator Documents:
http://www.radsoft.net/resources/software/reviews/ee/



donnie 12-04-2004 02:20 AM

Re: Evidence Eliminator v Encase
 
On Fri, 03 Dec 2004 21:05:47 +0000, Silas <silas@sorry.nomail.com>
wrote:

>I got both these software and tested them out. I used the Safe Delete
>option of Evidence Eliminator on a file to wipe 9 times, in effect an
>attempt to shred the file. I then ran Encase and found that the file
>still existed on my hard drive. Encase reported that the file was
>deleted but the name, date, logical size of file, physical size of file,
> and starting cluster still existed. My questions are:
>
>1. Can such a file now be recovered using Encase?
>2. Why has Evidence Eliminator failed to remove all traces of deleted
>files it has claimed it can remove?
>3. Is Evidence Eliminator on the above basis a total failure?
>
>Comments would be appreciated.

########################
Some years ago, there was a major argument about EE on usenet. Some
people said that it wiped their hard drives and that it was a terrible
program. Then someone from the company tried to defend the product
but every time he posted, he stuck his foot in his mouth and seemed to
make things worse. He really should have just let the thread die. I
never used any of those programs but after following that thread, I
wasn't about to try EE.
Anyway, if you say that the file is still there after using EE, I
would agree that it's a failure.
donnie

Pete 12-04-2004 06:24 AM

Re: Evidence Eliminator v Encase
 
On 2004-12-04, donnie <donnie@queyosepa.net> wrote:
> On Fri, 03 Dec 2004 21:05:47 +0000, Silas <silas@sorry.nomail.com>
> wrote:
>
>>I got both these software and tested them out. I used the Safe Delete
>>option of Evidence Eliminator on a file to wipe 9 times, in effect an
>>attempt to shred the file. I then ran Encase and found that the file
>>still existed on my hard drive. Encase reported that the file was
>>deleted but the name, date, logical size of file, physical size of file,
>> and starting cluster still existed. My questions are:


<snip>

>>3. Is Evidence Eliminator on the above basis a total failure?


<snip>

> Anyway, if you say that the file is still there after using EE, I
> would agree that it's a failure.


There was talk, IIRC, in that 'debate' about EE only pretending to
wipe files if the program wasn't registered. I can't be certain from the
OP's post if the program was registered or not, as 'got both these software'
(sic) is a bit ambiguous to say the least.

Regards,

Pete.

--
I do not trouble myself to be understood. I see that the elementary laws never apologise.

cacophony 12-04-2004 04:20 PM

Re: Evidence Eliminator v Encase
 
Silas wrote:

> I got both these software and tested them out. I used the Safe Delete
> option of Evidence Eliminator on a file to wipe 9 times, in effect an
> attempt to shred the file. I then ran Encase and found that the file
> still existed on my hard drive. Encase reported that the file was
> deleted but the name, date, logical size of file, physical size of file,
> and starting cluster still existed. My questions are:
>
> 1. Can such a file now be recovered using Encase?
> 2. Why has Evidence Eliminator failed to remove all traces of deleted
> files it has claimed it can remove?
> 3. Is Evidence Eliminator on the above basis a total failure?
>
> Comments would be appreciated.


1. Use a different program. PGP has a good file wiper, and a nuumber of
other seful utilities, too

2. Wipe 27 times. That's the max number of times, IIRC, that it will
actually make a difference.

A Morris 12-04-2004 08:08 PM

Re: Evidence Eliminator v Encase
 
Pete <pete@lotech.co.uk> wrote in message news:<LKcsd.15$z15.4@newsfe4-win.ntli.net>...
> On 2004-12-04, donnie <donnie@queyosepa.net> wrote:
> > On Fri, 03 Dec 2004 21:05:47 +0000, Silas <silas@sorry.nomail.com>
> > wrote:
> >
> >>I got both these software and tested them out. I used the Safe Delete
> >>option of Evidence Eliminator on a file to wipe 9 times, in effect an
> >>attempt to shred the file. I then ran Encase and found that the file
> >>still existed on my hard drive. Encase reported that the file was
> >>deleted but the name, date, logical size of file, physical size of file,
> >> and starting cluster still existed. My questions are:

>
> <snip>
>
> >>3. Is Evidence Eliminator on the above basis a total failure?


Rather the opposite.

You have wiped a files contents, but have not cleared the directory
entries associated with it.

I would suggest consulting the manual of the software for instructions
on how to complete the deletion process.

BTW, the two links above claiming to offer criticizms of EE are
closely linked to EE's competition (in fact one, RADSOFT is itself a
direct competitor). The theory behind such sites seems to be, that if
one pens a site containing enough ridiculous lies about a product,
then the uninitiated or those with simply nothing better to do, will
post the links all over USENET and lead to sales of one's own product
instead.

Pete 12-04-2004 09:18 PM

Re: Evidence Eliminator v Encase
 
On 2004-12-04, cacophony <cacophony@syncreate.org> wrote:
> Silas wrote:
>
>> 1. Can such a file now be recovered using Encase?
>> 2. Why has Evidence Eliminator failed to remove all traces of deleted
>> files it has claimed it can remove?
>> 3. Is Evidence Eliminator on the above basis a total failure?
>>
>> Comments would be appreciated.

>
> 1. Use a different program. PGP has a good file wiper, and a nuumber of
> other seful utilities, too
>
> 2. Wipe 27 times. That's the max number of times, IIRC, that it will
> actually make a difference.


Nice to see the PGP flag being waved again. It's a great application. But 27
wipes *all* the time is going to put a lot of stress on the drive heads
isn't it ? Maybe reduce the overall life span of the drive ?

I'd save that for the shopping list you *really* didn't want anyone to see.

I just can't get over why someone would buy a product called 'Evidence
Eliminator' (I'm not referring to you cacophony).

What kind of 'evidence' are these people trying to eliminate ffs ?

Confidential company data, ok. Password or other security information, ok.
Personal emails, ok. Is there anything else I missed ?

PGP or 'shred' on many Gnu/Linux systems can do that, totally for free. Why
buy off spammers ?

Regards,

Pete.

--
"Dammit Jim, I'm a sig file not an actor !"

donnie 12-04-2004 11:05 PM

Re: Evidence Eliminator v Encase
 
On Sat, 04 Dec 2004 06:24:43 GMT, Pete <pete@lotech.co.uk> wrote:

>There was talk, IIRC, in that 'debate' about EE only pretending to
>wipe files if the program wasn't registered. I can't be certain from the
>OP's post if the program was registered or not, as 'got both these software'
>(sic) is a bit ambiguous to say the least.
>
>Regards,
>
>Pete.

##########################
Yes. I remember that too but I can't confirm that to be the case.
donnie.

donnie 12-04-2004 11:06 PM

Re: Evidence Eliminator v Encase
 
On Sat, 04 Dec 2004 16:20:35 GMT, cacophony <cacophony@syncreate.org>
wrote:

>1. Use a different program. PGP has a good file wiper, and a nuumber of
>other seful utilities, too
>
>2. Wipe 27 times. That's the max number of times, IIRC, that it will
>actually make a difference.

########################
27 times? Doesn't the DOD recommend 7?
donnie.


All times are GMT. The time now is 03:13 AM.

Powered by vBulletin®. Copyright ©2000 - 2014, vBulletin Solutions, Inc.
SEO by vBSEO ©2010, Crawlability, Inc.