Velocity Reviews - Computer Hardware Reviews

Velocity Reviews > Newsgroups > Computing > Computer Security > Evidence Eliminator v Encase

Reply
Thread Tools

Evidence Eliminator v Encase

 
 
Ant
Guest
Posts: n/a
 
      12-04-2004
"A Morris" wrote:

> BTW, the two links above claiming to offer criticizms of EE are
> closely linked to EE's competition (in fact one, RADSOFT is itself a
> direct competitor). The theory behind such sites seems to be, that if
> one pens a site containing enough ridiculous lies about a product,
> then the uninitiated or those with simply nothing better to do, will
> post the links all over USENET and lead to sales of one's own product
> instead.


Are you new to Usenet? This is exactly what the pushers of EE have
done. If you were around when EE affiliates were spamming it in every
group you'd know why the company is so loathed. Their marketing
practices stink. Scaremongering and spamming are the key words here.

While Radsoft is a competitor, they give a good analysis of EE, not
all of it bad. Read all the links from that page. It is quite obvious
that EE cannot do a proper job of securely erasing information on an
NT based operating system. In fact I doubt that any software could,
while the OS is running, given that it would have to deal with NTFS
at sub-driver level, and also the swap file.

I have nothing to do with either link, and am far from uninitiated.
I've been programming computers at both a low and high level since the
mid 1970s. I know snake oil when I see it.


 
Reply With Quote
 
 
 
 
Jeffrey Silverman
Guest
Posts: n/a
 
      12-07-2004
On Sat, 04 Dec 2004 02:20:41 +0000, donnie wrote:

> Some years ago, there was a major argument about EE on usenet. Some


<http://evidence-eliminator-sucks.com/>

--
Jeffrey D. Silverman | http://www.velocityreviews.com/forums/(E-Mail Removed)
Website | http://www.newtnotes.com

Drop "PANTS" to reply by email

 
Reply With Quote
 
 
 
 
Jeffrey Silverman
Guest
Posts: n/a
 
      12-07-2004
On Tue, 07 Dec 2004 11:30:28 -0500, Jeffrey Silverman wrote:

> On Sat, 04 Dec 2004 02:20:41 +0000, donnie wrote:
>
>> Some years ago, there was a major argument about EE on usenet. Some

>
> <http://evidence-eliminator-sucks.com/>


Ooops, better version:
<http://ee-sucks.tripod.com/>

--
Jeffrey D. Silverman | (E-Mail Removed)
Website | http://www.newtnotes.com

Drop "PANTS" to reply by email

 
Reply With Quote
 
spamme2@mailinator.com
Guest
Posts: n/a
 
      12-10-2004
Evidence Eliminator has overwritten all the data in the file, so the
file contents are unrecoverable. When EE safely deletes a file on a
FAT partition, the filename is not eliminated, only the file body. To
delete the filenames, you need to enable 'High performance mode'
and perform a safe shutdown or safe restart.
On NTFS volumes, EE does erase filenames by renaming them to
'EE---Temp.tmp'.

 
Reply With Quote
 
winged
Guest
Posts: n/a
 
      12-10-2004
donnie wrote:
> On Sat, 04 Dec 2004 16:20:35 GMT, cacophony <(E-Mail Removed)>
> wrote:
>
>
>>1. Use a different program. PGP has a good file wiper, and a nuumber of
>>other seful utilities, too
>>
>>2. Wipe 27 times. That's the max number of times, IIRC, that it will
>>actually make a difference.

>
> ########################
> 27 times? Doesn't the DOD recommend 7?
> donnie.


DOD recommends grinding the HDD platters into dust, placing dust in a
trash can (metal), spraying dust with alcohol or gasoline then lighting
the combination to release magnetic orientation of the particles. That
pretty much prevents data compromise from disk source. It depends on
the level of surety desired.
Winged
 
Reply With Quote
 
Jason Bosaw
Guest
Posts: n/a
 
      12-10-2004
I'm currently using EnCase 4.20. During the training I attended in
Sterling, VA, Evidence Eliminator was mentioned by Guidance Software
personnel. According to the training staff, EE is rarely effective for
novice users. They explained that more advanced users, who now how to adjust
the configuration of the application, could get EE to make things difficult
on an EnCase investigator.[<---Answer to Question #2] I checked out the
Evidence Eliminator site and found the software to run $149. The EnCase
software runs $2,495.00 not including some optional hardware and training.
At first, I can't see why one would spend in the range of $2600 to see if EE
actually works. Regardless of my own wonderings, EnCase works differently
than Windows in that it reads data bit-for-bit on the media being analyzed.
If it's there it's there and it will read it.[<---Answer to Question #1]
According to EE's site, it's supposed to overwrite written bits with 00 or
FF to wipe. I haven't used or experimented with EE. I am yet to run into it
as an obstacle in an investigation. EnCase also has a wipe tool and it's
found to be not totally effective too.
Regards,
Jason

"Silas" <(E-Mail Removed)> wrote in message
news:41b0d52c$(E-Mail Removed)...
> I got both these software and tested them out. I used the Safe Delete
> option of Evidence Eliminator on a file to wipe 9 times, in effect an
> attempt to shred the file. I then ran Encase and found that the file
> still existed on my hard drive. Encase reported that the file was
> deleted but the name, date, logical size of file, physical size of file,
> and starting cluster still existed. My questions are:
>
> 1. Can such a file now be recovered using Encase?
> 2. Why has Evidence Eliminator failed to remove all traces of deleted
> files it has claimed it can remove?
> 3. Is Evidence Eliminator on the above basis a total failure?
>
> Comments would be appreciated.




 
Reply With Quote
 
nemo outis
Guest
Posts: n/a
 
      12-10-2004
In article <o_aud.16$(E-Mail Removed)>, "Jason Bosaw" <(E-Mail Removed)> wrote:
>I'm currently using EnCase 4.20. During the training I attended in
>Sterling, VA, Evidence Eliminator was mentioned by Guidance Software
>personnel. According to the training staff, EE is rarely effective for
>novice users. They explained that more advanced users, who now how to adjust
>the configuration of the application, could get EE to make things difficult
>on an EnCase investigator.[<---Answer to Question #2] I checked out the
>Evidence Eliminator site and found the software to run $149. The EnCase
>software runs $2,495.00 not including some optional hardware and training.
>At first, I can't see why one would spend in the range of $2600 to see if EE
>actually works. Regardless of my own wonderings, EnCase works differently
>than Windows in that it reads data bit-for-bit on the media being analyzed.
>If it's there it's there and it will read it.[<---Answer to Question #1]
>According to EE's site, it's supposed to overwrite written bits with 00 or
>FF to wipe. I haven't used or experimented with EE. I am yet to run into it
>as an obstacle in an investigation. EnCase also has a wipe tool and it's
>found to be not totally effective too.
>Regards,
>Jason



Version 4.17b of Encase is widely available as warez.

Regards,

 
Reply With Quote
 
nemo outis
Guest
Posts: n/a
 
      12-11-2004
In article , nemo (E-Mail Removed) (nemo outis) wrote:
>In article <o_aud.16$(E-Mail Removed)>, "Jason Bosaw"
> <(E-Mail Removed)> wrote:
>>I'm currently using EnCase 4.20. During the training I attended in
>>Sterling, VA, Evidence Eliminator was mentioned by Guidance Software
>>personnel. According to the training staff, EE is rarely effective for
>>novice users. They explained that more advanced users, who now how to adjust
>>the configuration of the application, could get EE to make things difficult
>>on an EnCase investigator.[<---Answer to Question #2] I checked out the
>>Evidence Eliminator site and found the software to run $149. The EnCase
>>software runs $2,495.00 not including some optional hardware and training.
>>At first, I can't see why one would spend in the range of $2600 to see if EE
>>actually works. Regardless of my own wonderings, EnCase works differently
>>than Windows in that it reads data bit-for-bit on the media being analyzed.
>>If it's there it's there and it will read it.[<---Answer to Question #1]
>>According to EE's site, it's supposed to overwrite written bits with 00 or
>>FF to wipe. I haven't used or experimented with EE. I am yet to run into it
>>as an obstacle in an investigation. EnCase also has a wipe tool and it's
>>found to be not totally effective too.
>>Regards,
>>Jason

>
>
>Version 4.17b of Encase is widely available as warez.
>
>Regards,
>



Encase 4.20 just now posted in alt.binaries.warez.win95-apps

Regards,

 
Reply With Quote
 
 
 
Reply

Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
A alternative to Evidence Eliminator ? StaLaG Computer Security 9 12-18-2006 10:33 AM
Evidence Eliminator Great Program Insulting Constomer Serrvice stamfordbhu@hotmail.com Computer Security 1 10-05-2006 04:29 PM
Evidence Eliminator and 407 DFX warning David Pinzone Computer Support 13 12-14-2005 11:43 AM
Evidence Eliminator v's Encase Silas Computer Information 1 12-04-2004 12:50 AM
Re: Evidence Eliminator... NOT AN AD, I promise Bill Crocker Computer Security 2 06-30-2003 03:03 PM



Advertisments