'Deleted' Data Can Be Used Against You

Raleigh, N.C. — When it comes to computers, nothing is really private or ever really gone.

From divorce to murder, computer forensic examiner Larry Daniel has seen it all working for the Raleigh-based YourTechnician.com.

"We recover e-mail," he said. "We recover tons of pornography that's on the computers – chat logs where you talk to other people."

Daniel says that what people don't realize is that it is practically impossible to permanently get rid of anything you do on a computer, cell phone, digital music player – or any electronic device that stores data, for that matter.

"Computers never actually delete anything. That's the first mistake most people make," he said. "So basically, even though you think you've cleaned it, you haven't."

And if you're not careful, the information can be used against you.

Scouring computers for information is the latest tool for the courtroom; investigators use what they find to support their cases.

"In some cases, we've done things that have allowed attorneys to establish or destroy alibis in cases," Daniel said.

YourTechnician.com has provided expert witness testimony for a number of high-profile criminal cases – including child pornography, murder and kidnapping – over the past few years.

The cases include those of: Michelle Theer, a military wife convicted in 2004 of conspiring with her lover to kill her husband and April Greer, a slain pregnant woman whose body was found by a farmer working his land in Mebane.

Recovered information is being used in civil suits, such as divorce, too.

"When it comes to computers and the Internet, nothing is sacred," Daniel said. "You're really not safe at all as far as getting information back."

22 Comments

WRAL.com welcomes your comments on this story. All comments are moderated prior to publication based on our posting guidelines. Please review them prior to posting and if your message is not approved.

VIEW ALL 22 COMMENTS

This story is closed for comments. Comments on WRAL.com news stories are accepted and moderated between the hours of 8 a.m. and 8 p.m. Monday through Friday.

Latest Comments

Maybe Mr. Cheney should be worried? I mean all of those missing e-mails and yet the authority's can not locate them.... HHHHMMMMM, maybe they are not using the correct retrievel company

LambeauSouth
February 27, 2008 3:16 p.m.

And yes, I do wipe all the free space on ANY drive I buy before I place it in service, even one that is 'fresh from the factory' (too many stores have their own shrinkwrap machines).

That is a situation where a good wiping program is necessary, since you don't want to render the drive inoperable.

I'm not going to go to jail for someone else's child porn.

MoroccoMole
February 27, 2008 12:28 p.m.

It's easy enough to address. Just using a program that does 1's and 0's back and forth a few times suffices for most matters. Just be sure you get one that also wipes the 'slacks' (unused sectors in the last cluster of each file - these are what simple wipers often miss). BC Wipe (mentioned here several times) will do this. So will others.

If you really think they will disassemble the drive and surface scan the platters to recover data (ie - the NSA is after you), you can always use software that uses the Gutmann method. Though 7 or 8 random pattern overwrites would likely serve you just as well.

If you are hyper-paranoid, remember that sectors deemed bad may have been made inaccessible by the drive firmware, and will thus be beyond any wiper. For these, generally only physical destruction will suffice, as you won't have access to the firmware-specific tools to give you access to the entire platter, including the bad ones and unused sectors still in the reallocation pool.

MoroccoMole
February 27, 2008 12:24 p.m.

I run over my old cell phones (after taking battery out of course).

PikeMom4real
February 27, 2008 12:20 p.m.

Soak hard drive in bucket of salt water for 3 days before you take computer to be recycled. McAfee antivirus has a multiple overwrite function for deleted files (see computer maintenance section). They say that 7 overwrites will make deleted files totally inaccessible. Microsoft's default delete file function does not have a multiple overwrite function for routine file deletion. Also, MC Internet Explorer does not have a multiple overwrite function--so it is best to use some other program to delete and overwrite your temp, cache and history data. Windows Vista has a lot of "security" functions, which seems mostly aimed at stopping or preventing virus, worm, spam, spyware etc from "infecting" your computer.