Submitting Campus

Daytona Beach

Department

Security Studies & International Affairs

Document Type

Book Chapter

Publication/Presentation Date

2006

Abstract/Description

Secure deletion programs purport to permanently erase files from digital media. These programs are used by businesses and individuals to remove sensitive information from media, and by criminals to remove evidence of the tools or fruits of illegal activities. This paper focuses on the trace evidence left by secure deletion programs. In particular, five Windows-based secure deletion programs are tested to determine if they leave identifiable signatures after deleting a file. The results show that the majority of the programs leave identifiable signatures. Moreover, some of the programs do not completely erase file metadata, which enables forensic investigators to extract the name, size, creation date and deletion date of the “deleted” files.

Publication Title

Advances in Digital Forensics II

DOI

https://doi.org/10.1007/0-387-36891-4_15

Publisher

Springer Verlag

Additional Information

A paper from the 2nd IFIP International Conference on Digital Forensics held at the National Center for Forensic Science in Orlando, Florida, January 29-February 1, 2006.

Dr. Craiger was not affiliated with Embry-Riddle Aeronautical University at the time this paper was published.

Download

Share

COinS