Velocity Reviews - Computer Hardware Reviews

Velocity Reviews > Newsgroups > Computing > Computer Security > Evidence Eliminator v Encase

Reply
Thread Tools

Evidence Eliminator v Encase

 
 
Silas
Guest
Posts: n/a
 
      12-03-2004
I got both these software and tested them out. I used the Safe Delete
option of Evidence Eliminator on a file to wipe 9 times, in effect an
attempt to shred the file. I then ran Encase and found that the file
still existed on my hard drive. Encase reported that the file was
deleted but the name, date, logical size of file, physical size of file,
and starting cluster still existed. My questions are:

1. Can such a file now be recovered using Encase?
2. Why has Evidence Eliminator failed to remove all traces of deleted
files it has claimed it can remove?
3. Is Evidence Eliminator on the above basis a total failure?

Comments would be appreciated.
 
Reply With Quote
 
 
 
 
Use.Netuser.de
Guest
Posts: n/a
 
      12-03-2004
"Silas" <(E-Mail Removed)> wrote ...
> I got both these software and tested them out. I used the Safe Delete
> option of Evidence Eliminator on a file to wipe 9 times, in effect an
> attempt to shred the file. I then ran Encase and found that the file
> still existed on my hard drive. Encase reported that the file was
> deleted but the name, date, logical size of file, physical size of file,
> and starting cluster still existed. My questions are:
>
> 1. Can such a file now be recovered using Encase?
> 2. Why has Evidence Eliminator failed to remove all traces of deleted
> files it has claimed it can remove?
> 3. Is Evidence Eliminator on the above basis a total failure?


I have no working knowledge of either application however if one purports to
securely erase a file yet remnants remain regardless of which remnants then
I would be concerned. You would be the best one to test if Encase can
actually recover fragments and based on this be able decide if EE is a total
failure.


 
Reply With Quote
 
 
 
 
Ant
Guest
Posts: n/a
 
      12-04-2004
"Silas" wrote:
> I got both these software and tested them out. I used the Safe Delete
> option of Evidence Eliminator on a file to wipe 9 times, in effect an
> attempt to shred the file. I then ran Encase and found that the file
> still existed on my hard drive. Encase reported that the file was
> deleted but the name, date, logical size of file, physical size of file,
> and starting cluster still existed.


It's reporting the contents of the deleted directory entry. However,
the file data may have been overwritten.

> My questions are:
>
> 1. Can such a file now be recovered using Encase?


Have you tried?

> 2. Why has Evidence Eliminator failed to remove all traces of deleted
> files it has claimed it can remove?


Because they are liars.

> 3. Is Evidence Eliminator on the above basis a total failure?


You're obviously unaware of the history of these people. I would not
trust their claims, or ever use their software.

Consumer Warning: Robin Hood Software and Evidence Eliminator:
http://www.discord.org/~lippard/evid...tor-sucks.com/

The Evidence Eliminator Documents:
http://www.radsoft.net/resources/software/reviews/ee/


 
Reply With Quote
 
donnie
Guest
Posts: n/a
 
      12-04-2004
On Fri, 03 Dec 2004 21:05:47 +0000, Silas <(E-Mail Removed)>
wrote:

>I got both these software and tested them out. I used the Safe Delete
>option of Evidence Eliminator on a file to wipe 9 times, in effect an
>attempt to shred the file. I then ran Encase and found that the file
>still existed on my hard drive. Encase reported that the file was
>deleted but the name, date, logical size of file, physical size of file,
> and starting cluster still existed. My questions are:
>
>1. Can such a file now be recovered using Encase?
>2. Why has Evidence Eliminator failed to remove all traces of deleted
>files it has claimed it can remove?
>3. Is Evidence Eliminator on the above basis a total failure?
>
>Comments would be appreciated.

########################
Some years ago, there was a major argument about EE on usenet. Some
people said that it wiped their hard drives and that it was a terrible
program. Then someone from the company tried to defend the product
but every time he posted, he stuck his foot in his mouth and seemed to
make things worse. He really should have just let the thread die. I
never used any of those programs but after following that thread, I
wasn't about to try EE.
Anyway, if you say that the file is still there after using EE, I
would agree that it's a failure.
donnie
 
Reply With Quote
 
Pete
Guest
Posts: n/a
 
      12-04-2004
On 2004-12-04, donnie <(E-Mail Removed)> wrote:
> On Fri, 03 Dec 2004 21:05:47 +0000, Silas <(E-Mail Removed)>
> wrote:
>
>>I got both these software and tested them out. I used the Safe Delete
>>option of Evidence Eliminator on a file to wipe 9 times, in effect an
>>attempt to shred the file. I then ran Encase and found that the file
>>still existed on my hard drive. Encase reported that the file was
>>deleted but the name, date, logical size of file, physical size of file,
>> and starting cluster still existed. My questions are:


<snip>

>>3. Is Evidence Eliminator on the above basis a total failure?


<snip>

> Anyway, if you say that the file is still there after using EE, I
> would agree that it's a failure.


There was talk, IIRC, in that 'debate' about EE only pretending to
wipe files if the program wasn't registered. I can't be certain from the
OP's post if the program was registered or not, as 'got both these software'
(sic) is a bit ambiguous to say the least.

Regards,

Pete.

--
I do not trouble myself to be understood. I see that the elementary laws never apologise.
 
Reply With Quote
 
cacophony
Guest
Posts: n/a
 
      12-04-2004
Silas wrote:

> I got both these software and tested them out. I used the Safe Delete
> option of Evidence Eliminator on a file to wipe 9 times, in effect an
> attempt to shred the file. I then ran Encase and found that the file
> still existed on my hard drive. Encase reported that the file was
> deleted but the name, date, logical size of file, physical size of file,
> and starting cluster still existed. My questions are:
>
> 1. Can such a file now be recovered using Encase?
> 2. Why has Evidence Eliminator failed to remove all traces of deleted
> files it has claimed it can remove?
> 3. Is Evidence Eliminator on the above basis a total failure?
>
> Comments would be appreciated.


1. Use a different program. PGP has a good file wiper, and a nuumber of
other seful utilities, too

2. Wipe 27 times. That's the max number of times, IIRC, that it will
actually make a difference.
 
Reply With Quote
 
A Morris
Guest
Posts: n/a
 
      12-04-2004
Pete <(E-Mail Removed)> wrote in message news:<LKcsd.15$(E-Mail Removed)>...
> On 2004-12-04, donnie <(E-Mail Removed)> wrote:
> > On Fri, 03 Dec 2004 21:05:47 +0000, Silas <(E-Mail Removed)>
> > wrote:
> >
> >>I got both these software and tested them out. I used the Safe Delete
> >>option of Evidence Eliminator on a file to wipe 9 times, in effect an
> >>attempt to shred the file. I then ran Encase and found that the file
> >>still existed on my hard drive. Encase reported that the file was
> >>deleted but the name, date, logical size of file, physical size of file,
> >> and starting cluster still existed. My questions are:

>
> <snip>
>
> >>3. Is Evidence Eliminator on the above basis a total failure?


Rather the opposite.

You have wiped a files contents, but have not cleared the directory
entries associated with it.

I would suggest consulting the manual of the software for instructions
on how to complete the deletion process.

BTW, the two links above claiming to offer criticizms of EE are
closely linked to EE's competition (in fact one, RADSOFT is itself a
direct competitor). The theory behind such sites seems to be, that if
one pens a site containing enough ridiculous lies about a product,
then the uninitiated or those with simply nothing better to do, will
post the links all over USENET and lead to sales of one's own product
instead.
 
Reply With Quote
 
Pete
Guest
Posts: n/a
 
      12-04-2004
On 2004-12-04, cacophony <(E-Mail Removed)> wrote:
> Silas wrote:
>
>> 1. Can such a file now be recovered using Encase?
>> 2. Why has Evidence Eliminator failed to remove all traces of deleted
>> files it has claimed it can remove?
>> 3. Is Evidence Eliminator on the above basis a total failure?
>>
>> Comments would be appreciated.

>
> 1. Use a different program. PGP has a good file wiper, and a nuumber of
> other seful utilities, too
>
> 2. Wipe 27 times. That's the max number of times, IIRC, that it will
> actually make a difference.


Nice to see the PGP flag being waved again. It's a great application. But 27
wipes *all* the time is going to put a lot of stress on the drive heads
isn't it ? Maybe reduce the overall life span of the drive ?

I'd save that for the shopping list you *really* didn't want anyone to see.

I just can't get over why someone would buy a product called 'Evidence
Eliminator' (I'm not referring to you cacophony).

What kind of 'evidence' are these people trying to eliminate ffs ?

Confidential company data, ok. Password or other security information, ok.
Personal emails, ok. Is there anything else I missed ?

PGP or 'shred' on many Gnu/Linux systems can do that, totally for free. Why
buy off spammers ?

Regards,

Pete.

--
"Dammit Jim, I'm a sig file not an actor !"
 
Reply With Quote
 
donnie
Guest
Posts: n/a
 
      12-04-2004
On Sat, 04 Dec 2004 06:24:43 GMT, Pete <(E-Mail Removed)> wrote:

>There was talk, IIRC, in that 'debate' about EE only pretending to
>wipe files if the program wasn't registered. I can't be certain from the
>OP's post if the program was registered or not, as 'got both these software'
>(sic) is a bit ambiguous to say the least.
>
>Regards,
>
>Pete.

##########################
Yes. I remember that too but I can't confirm that to be the case.
donnie.
 
Reply With Quote
 
donnie
Guest
Posts: n/a
 
      12-04-2004
On Sat, 04 Dec 2004 16:20:35 GMT, cacophony <(E-Mail Removed)>
wrote:

>1. Use a different program. PGP has a good file wiper, and a nuumber of
>other seful utilities, too
>
>2. Wipe 27 times. That's the max number of times, IIRC, that it will
>actually make a difference.

########################
27 times? Doesn't the DOD recommend 7?
donnie.
 
Reply With Quote
 
 
 
Reply

Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
A alternative to Evidence Eliminator ? StaLaG Computer Security 9 12-18-2006 10:33 AM
Evidence Eliminator Great Program Insulting Constomer Serrvice stamfordbhu@hotmail.com Computer Security 1 10-05-2006 04:29 PM
Evidence Eliminator and 407 DFX warning David Pinzone Computer Support 13 12-14-2005 11:43 AM
Evidence Eliminator v's Encase Silas Computer Information 1 12-04-2004 12:50 AM
Re: Evidence Eliminator... NOT AN AD, I promise Bill Crocker Computer Security 2 06-30-2003 03:03 PM



Advertisments