Slashdot Mirror
Salon On Computer Forensics
splorf writes "Salon has a
good new article on computer forensics, focusing on Lee Tydalska, a guy in Southern California who started collecting old computers and peripherals as a hobby, and now has a nice business doing data recovery from weird and obsolete media for investigators (or normal users who just need media conversion). "It hardly needs saying why this craft has grown in importance",
the article says, "but if one word sums it up, it's 'Enron-itis'". Oh yes, the #1 outfit in the field is apparently a UK firm called Vogon International. You've got to love this stuff."
I was suprised to see an @Stake employee bring a Mac to a presentation, but he explained that they used Mac because the greater FireWire support meant they could do forensic imaging onto external disks a hell of alot faster.
"we can recover any data, even punch cards from a planet blown to pieces to make a path for a new hyperspace bypass"
--- sig moved for great justice.
Anyone know what they might be and how I could go about reading them them?
sPh
Here's an interesting site about old computers. It has pictures of most of models. Brings back memories...
"Awareness of computer security as a whole is kind of on the upswing," says Laura Koetzle, an analyst with Forrester Research. "As mainstream companies get more interested in computer security and realize that they don't know very much about it, there's more of a market for it."
You would think that watching their software products get constantly infected by viruses would have brought this about?
Oh well, maybe with a heightened sense of security they might get their software patched more often or perhaps switch to an operating system that isn't such a target to script kiddies.
Data recovery is one of the most expensive search results on Overture that I've seen.
Now that we know that companies like this exist, how do you as a person who is responible for dumping old equipment ensure that your company erases sensitive data so that it cannot be recovered by anyone. You have to believe that there have to be one or two people out there who are looking to do something "bad" with the data they find on disposed computers.
This is my opinion. To make sure you don't steal it, it's covered by the DMCA.
I'd be interested to hear what the Lee Tydalska has to say about secure deletion of data (i.e. how can you be sure you have destroyed data on a harddrive/cd-rom/floppy/etc). Peter Gutmann wrote a paper on how to destroy data. In the paper, he argues that by overwriting your harddrive multiple times with highly sophisticated patterns, it will be almost impossible to recover the data. I wonder if industry people agree with him.
Can these guys help me recover a term paper I made on my old Coleco ADAM computer? Its on the a cassette tape. My paper was due July 1984 perhaps I can still get partial credit!
And I love him for it. Geek hobby success -- truly, qualities to aspire to...
- (Second page, first paragraph)
I've got it, you need it, now pay up! Ha!Tydlaska is prone to gloating about his sometimes invaluable skill. "People go into audit a company and they need to see its 'hysterical data,' as I like to call it -- 'hysterical' because of the prices they pay me to see it. They say, 'But there's nothing wrong with the tape! If I had the equipment I could restore the data myself.' And I say, you're right! If you had it, you could! But you can't buy it, and you can't reproduce it, so it's either worth my exorbitant fee or not. I mean, let the IRS believe you've got the data!"
I've got some old tape drives... an Exabyte 8mm, a few DAT (Wang, I think...) drives, a couple circa-1995 pre-Travan QIC plugs-into-the-floppy-controller anachronisms. I even have a one-piece combo 5¼- and 3½-inch floppy drive! Perhaps I ought to start "Joe's Cut-Rate Data Recovery and Money Removal Service."
Hmmm....
"...America's great minds of today, teaching America's great minds of tomorrow. Poor bastards." -- A Beautiful Min
I once had to retire a Mac LC II was the building fileserver. This thing had financials, the private records of students; you name it. I low-leveled the drive and wrote 0's to it. Once that was done, I drilled several holes through the platters. I broke the bit off the drill in the process. The drive with drill bit stub stuck in it looks like Count Datatula with a spike through his heart. We keep the spiked carcass around to show people how to make sure that sensitive data gets destroyed.
It's just a USB flash ram drive. Take a Zio! USB reader ($25 at buy.com) and plug in a CF card (512M = $180 at newegg.com), and you have the equivalent. The thumb drive just rearranges things a bit to make it physically smaller. Also I think the thumb drive uses the USB mass storage standard so no special drivers are necessary for Linux, Win ME/2k/XP, or Mac. The Zio! does need special drivers, I wish they'd fix that.
What all these companies who have time delayed deletion of historical email seem to fail to catch onto is that they usually have a long term backup methodology in place.
I've raised this issue with one operation who have a 60 day deletion policy for company security reasons only to be looked at blankly by the HR manager and board directors and then asked, "does anyone doing data recovery ever ask for that sort of thing?".
At that point I nearly cracked up in hysterics myself.
--- This meme is memory intensive
Riksarkivet (National Archives of Sweden) is by law required to obtain, store and display for the public all documents and other entities produced by governmental agencies in Sweden, as well as committees and such since 1618 (some older, as well) for all future time. As the latest 30 years or so has seen a large surge in computerized documents/-ation this gives quite a few spectacular and very interesting examples of deliveries from agencies present or extinct with odd hardware requirements and zillions of different software solutions originally used, many homegrown.
Not only is the archive responsible for 'old' data, its is also responsible for migrating non-computerized material onto a computerized from for future public display, which is no easy process since there is a goal of course not to lock the information onto media, hardware or software designs that are extremely short-term.
In short, it's an area of a heck of a many problems, lots of questions, few people and little interest from the field (I mean, how interesting can it be to design excel spreadsheets for bank applications? Really?)
As for Vogon International, I'm sure that it's a company full of geniuses, but I would prefer if they answered the calls we make for ordering and requesting features promised in the manual in their software, which we need ASAP! It's no fun being stuck in a dos/windows95 edition of software for the sole reason of not getting replies from a genius/vendor.
Forensics anyone?
I love old computers too, but I lean more in the direction of the home/hobbyist computers (old Macs, Atari 8/16 bit computers, Amigas and other Commodores, etc) I found something called "The Catweasle" a while back. It plugs into an ISA slot (remember those? of course you do :) and has floppy controller ports for two drives. This thing reads *everything*. Check out the link for the full specs. Think there's a market for getting data off an Amiga 1200 disk?
The other cool "recovery" project I've seen is CAPS, which is a project to preserve exact copies of Amiga games. It's a typical abandonware project, except they are going out of their way to keep all copy protection intact. They are even going so far as to reverse engineer the copy-protection so they can make an exact copy of the original disk!
Then takes the ashes and bits in an aircraft and scatter them over a 100 mile area.
So you think that data is gone forever? Let's assume there was no van across the street studying van-eck emissions and no keyboard loggers, etc...
Chances are your email was relayed through a few servers before it got to your destination. Those web pages made it through a proxy server, a few routers, and the logs of the GET and PUT requests may have been stored, backed up, and the tapes may have been sorted on a weekly rotation schedule.
Not to mention some tapes are retired and put on the back shelf. Not all these servers were in the same building. Just how many of these tapes are there and where could they all be? Say, a word of panic gets around the company, its partners, and providers as law enforcement gets around asking questions. Darnit, this stuff keeps showing up. Where do these tapes keep coming from? Its like cleaning a dirty house, killing a cockroach, and 10 more pop up.
Electronic evidence breeds and multiplies. A networked approach to data sharing encourages information to branch out be copied countless times.
The only way to be safe is to carefully consider the method of how information is being delivered.
Why people are so afraid of "dumb" workstations that use a single server for processing is interesting. These are not just black and white terminals any more, but now have mice and color monitors. All the maintenance and information is neatly on one server. Software upgrades and projects would not expand the distribution of sensitive information in a closed system like this.
I used to visit the obsoletecomputermuseum and it's a great site.
But recently i discovered http://www.old-computers.com and now i'm addicted.
This site is like a community. Everybody can add a piece to the museum, write reviews,... There are polls, links et. It's just a great site and it's al lot more updated and lively than the (olso great!) obsolutecomputermuseum.
I still have 2 working Bernulli drives a 9 track tape reader(and ISA card interface) a magneto-optical drive AND to top it off a 8 inch floppy drive with a standard floppy drive interface adapter scabbed onto it.
Why? because I have made over $1000.00 over the past year alone on them. (2 jobs, data recovery)
This is why I also have other older drives that were popular 15-20 years ago.
Yes 99.7% of the time it takes up space in my heated storage room.... but all it takes is ONE person to need it and then I get big $$$. The best part is data-recovery from working media is easier now cince linux supports most every filesystem and partition known to be in popular use..
Basically, if you can get working old-stuff like that for free, GRAB IT.. but dont pay for it, that would be silly.
Do not look at laser with remaining good eye.
Strong magnets don't erase floppies, zip disks, etc..
Radio Shack's Tape demagnetizer doesn't erase floppies and zip disks.
CRT Degaussing coils screw up zip disks but I can't tell whether everything is erased. So I don't trust it. I haven't tried hexdump. This coil didn't erase the floppy I tried so I don't have confidence that it will reliably erase media.
Wansu, th' chinese sailor
RESISTANCE IS USELESS!!!!
Bloody hell, I can't believe no-one said that yet...
"Information wants to be paid"
They will never make fun of my QIC-120 tape drive mounted below my 24x burner again ..
:)
Case in point:
Friend of mine used to run a very successful BBS (gasp?! A BBS?!) in this area I helped out with. At it's peak we had 48 telephone lines, an office, and 600 or some users.
Not to bore you with the details but a partnership was formed, dissolved, and eventually he basically ran out of money.
Fast forward 5 years later:
I'm at his house on an unrelated matter. We start talking about the BBS. He mentions how he's got backups of it somewhere but they're on old 120 meg tapes. So I convince him to ransack his room (and we literally do). Eventually we come up with 5 QIC-120 tapes. What to do? Nobody owns one of these drives anymore.
Ah - but I do! Being a geek who collects old obscure, out of date hardware pays off. I slap the tape drive into my system, collect it to the floppy interface (bleck!) and proceed to load the Coloraod Restore software.
Tape 1 - Bad
Tape 2 - Bad
Tape 3 - Bad
Tape 4 - Good
I restored the data to my hard drive, burned it onto a CD-R, copied the system to another computer, tweaked the broken backup until it worked, and brought it up.
Let's do the timewarp, again - a BBS from 1997 was up in the year 2002 via telnet. I was a god among the users
Moral of the story is data mediums age faster then you think! We're only talking 1997 technology here and no one around me had the capabilities to restore it!
For these purposes, you don't need a complete stream of cryptographically secure random data, you just need to make certain that the various passes are sufficiently different from each other.
/dev/urandom will do the trick, and you won't have to wait for your entropy pool to be rebuilt every few thousand bytes. Of course, it'll still take a long time (nothing can speed up that physical disk access), but you can also then let it run unattended on a machine that's disconnected from the rest of the world (and therefore isn't refilling its entropy pool through randomness)
For that,
Oh, and be certain that you do a "sync" between passes. That may not be an issue on a hard drive, but with smaller media (like, say, a zip disk), you want to make certain that the computer doesn't cache the writes.