Local News

'Deleted' Data Can Be Used Against You

Posted February 26, 2008
Updated February 29, 2008

— When it comes to computers, nothing is really private or ever really gone.

From divorce to murder, computer forensic examiner Larry Daniel has seen it all working for the Raleigh-based YourTechnician.com.

"We recover e-mail," he said. "We recover tons of pornography that's on the computers – chat logs where you talk to other people."

Daniel says that what people don't realize is that it is practically impossible to permanently get rid of anything you do on a computer, cell phone, digital music player – or any electronic device that stores data, for that matter.

"Computers never actually delete anything. That's the first mistake most people make," he said. "So basically, even though you think you've cleaned it, you haven't."

And if you're not careful, the information can be used against you.

Scouring computers for information is the latest tool for the courtroom; investigators use what they find to support their cases.

"In some cases, we've done things that have allowed attorneys to establish or destroy alibis in cases," Daniel said.

YourTechnician.com has provided expert witness testimony for a number of high-profile criminal cases – including child pornography, murder and kidnapping – over the past few years.

The cases include those of: Michelle Theer, a military wife convicted in 2004 of conspiring with her lover to kill her husband and April Greer, a slain pregnant woman whose body was found by a farmer working his land in Mebane.

Recovered information is being used in civil suits, such as divorce, too.

"When it comes to computers and the Internet, nothing is sacred," Daniel said. "You're really not safe at all as far as getting information back."


This story is closed for comments.

Oldest First
View all
  • LambeauSouth Feb 27, 2008

    Maybe Mr. Cheney should be worried? I mean all of those missing e-mails and yet the authority's can not locate them.... HHHHMMMMM, maybe they are not using the correct retrievel company

  • MoroccoMole Feb 27, 2008

    And yes, I do wipe all the free space on ANY drive I buy before I place it in service, even one that is 'fresh from the factory' (too many stores have their own shrinkwrap machines).

    That is a situation where a good wiping program is necessary, since you don't want to render the drive inoperable.

    I'm not going to go to jail for someone else's child porn.

  • MoroccoMole Feb 27, 2008

    It's easy enough to address. Just using a program that does 1's and 0's back and forth a few times suffices for most matters. Just be sure you get one that also wipes the 'slacks' (unused sectors in the last cluster of each file - these are what simple wipers often miss). BC Wipe (mentioned here several times) will do this. So will others.

    If you really think they will disassemble the drive and surface scan the platters to recover data (ie - the NSA is after you), you can always use software that uses the Gutmann method. Though 7 or 8 random pattern overwrites would likely serve you just as well.

    If you are hyper-paranoid, remember that sectors deemed bad may have been made inaccessible by the drive firmware, and will thus be beyond any wiper. For these, generally only physical destruction will suffice, as you won't have access to the firmware-specific tools to give you access to the entire platter, including the bad ones and unused sectors still in the reallocation pool.

  • PikeMom4real Feb 27, 2008

    I run over my old cell phones (after taking battery out of course).

  • WXYZ Feb 27, 2008

    Soak hard drive in bucket of salt water for 3 days before you take computer to be recycled.
    McAfee antivirus has a multiple overwrite function for deleted files (see computer maintenance section). They say that 7 overwrites will make deleted files totally inaccessible. Microsoft's default delete file function does not have a multiple overwrite function for routine file deletion. Also, MC Internet Explorer does not have a multiple overwrite function--so it is best to use some other program to delete and overwrite your temp, cache and history data. Windows Vista has a lot of "security" functions, which seems mostly aimed at stopping or preventing virus, worm, spam, spyware etc from "infecting" your computer.

  • mrtwinturbo Feb 27, 2008

    Hammers work much better than any other tool, just pull the drive out and go crazy!!!!

  • Tacoma Feb 27, 2008

    There are tons of free programs out there that will overwrite a drive with zeros or random data, like DBAN. I'm sure some ultra sophisticated forensics team could still recover some of the data but it would probably cost a ton of money and I doubt they would bother unless it was a matter of national security or something.

  • blackdog Feb 27, 2008

    ...a degauze magnet will erase everything permantly....

  • winemaker81 Feb 27, 2008

    Norton SystemWorks has a WipeInfo utility that can perform a DOD-quality wipe on a drive. This repeatedly writes alternating 0's and 1's & then writes a repeating sequence (219?). On a large drive it may take a week to complete, but it's supposedly effective. This can be done to the entire disk, or just the free space.

    Just writing 0's once is not sufficient to securely wipe a drive. Someone with the right tools CAN recover files. I read an article on the subject a few years back but can't remember more than the basic facts.

    Twenty years ago the Air Force decommissioned classified drives by taking 'em out on the tarmac and having a couple of airmen flatten 'em with sledge hammers. I don't know if that's still what they do, but it *is* effective. :-)

    If I received a used HD I'd run WipeInfo on it before doing anything else. Then reformat.

  • Harrison Bergeron Feb 27, 2008

    "Does a powerful magnet erase data- I heard that somewhere? How about reformatting say from Fat32 to ntfs??? Maybe someone can answer that?"

    Obfuscating all data traces from magnetic media by overwriting it SEVERAL times with random data is actually no longer considered acceptable, only degaussing or physical destruction can ensure "erasure".