Technical, digital, computer question

[Alpo]

Every cop show out there will, at some point, have their forensics guy explain that you can't really delete a file. You think you deleted the file on the computer but they can get it back. You think you deleted the text on your phone but they can get it back.

 

So I'm watching NCIS, and the murdered Marine volunteered at this crisis center. The crisis center records all telephone calls. Somebody hacked the crisis center and erased all the recordings of the last day that the Marine worked.

 

That has me confused. If I cannot really delete a file from my computer, or delete a text from my phone, how can they erase the recordings?

 

Can they really recover the first two types of files, but can't recover the third type?

 

Or is the whole "you can't really delete a file" thing Hollyweird BS, or is it true, and the ability to actually remotely erase a recording is Hollyweird BS?

[Pat Riot, SASS #13748]

From what I understand remnants of deleted files remain but often they are corrupted and any retrieval is hit or miss. 

[Sedalia Dave]

Will not provide details but If you have the time and resources tapes as well as digital media like hard drives can be recovered even if the original data is over written. This also applies to flash memory like USB and solid state hard drives.

 

There are ways to prevent recovery of data from hard drives but it does take a lot of time unless you physically destroy the internal platters. 

 

BTW simply breaking the platters or smashing the drive itself is not enough to prevent recovery if you have the technology.

 

 

[Alpo]

I recall some forensic scientist - probably Abby - explaining that the military type file deleter overwrites the file seven times, and when it gets through doing that you can't tell what the original stuff was.

 

Quite possibly also Hollyweird BS.

[Dusty Devil Dale]

I've read that a printer has a scanned internal record of everything it has printed, scanned or photocopied, so you need to be careful about disposal. 

I don't know if it's true or not.   But there must be some kind of memory for the scanner to work.  Does anybody know?

[Marshal Mo Hare, SASS #45984]

It’s all very Murphyish. If YOU need it deleted, it can be recovered. If YOU need it recovered, it’s gone forever.

[Abilene Slim SASS 81783]

A lot of people throw old computers away with HD intact and unerased. Some have had problems like identity theft as a result. I remove the drives from mine and practice my Thor imitation with a 5lb hammer to complete the erasure. 

[Marshal Mo Hare, SASS #45984]

And putting a bullet through the hard drive will stop common criminals but will not stop someone with resources like an FBI lab or Abbie Sciuto.

 

I recall doing a few “corrupted drive” recoveries.

[Sedalia Dave]

50 minutes ago, Dusty Devil Dale said:

I've read that a printer has a scanned internal record of everything it has printed, scanned or photocopied, so you need to be careful about disposal. 

I don't know if it's true or not.   But there must be some kind of memory for the scanner to work.  Does anybody know?

 

Many commercial copier / scanner / printer machines have internal hard drives. Their software stores everything to the hard drive. For how long I do not know.

 

I am not aware of a home machine that has a hard drive. Most have some amount of internal RAM memory however it gets over written with every job. However the last job is often still intact and can be recovered.

 

Toner cartridges also store the last print job as am image on their drum. It can be recovered if you know how.

 

[Sedalia Dave]

3 hours ago, Alpo said:

I recall some forensic scientist - probably Abby - explaining that the military type file deleter overwrites the file seven times, and when it gets through doing that you can't tell what the original stuff was.

 

Quite possibly also Hollyweird BS.

 

IIRC, Seven write cycles is the current industry standard for most data to be considered un-recoverable.

 

Takes a long time to erase even a small hard drive when every bit has to be written as a logic zero and then a logic 1 for seven cycles.

[Mud Marine,SASS#54686 Life]

Remove the hard drive; smash it Into tiny bits. Scatter them in a very deep lake and wish yourself good luck.

 :-)

[Marshal Mo Hare, SASS #45984]

13 minutes ago, Mud Marine,SASS#54686 Life said:

Remove the hard drive; smash it Into tiny bits. Scatter them in a very deep lake and wish yourself good luck.

 :-)

The ocean, salt water is more corrosive.

[Sedalia Dave]

Anything sent electronically is impossible to completely erase. Emails, Texts and Voice mails are digitally stored on every server they touch. How long they exist out there in the cloud is impossible to determine.

 

Safe bet is to assume forever.

 

Using the Way Back Machine I can access snapshots of the SASS home page and forums all the way back to 1998. Many pages 

are not complete but others are.

 

For example here is a link to the July 1999 version of the Shooters Handbook.

 

SASS home page from the same year.

 

 

 

 

 

[bgavin]

I did computer forensic work for the local LEOs.
"Erasing" a file simply flips a bit that says "erased" but does not delete the data.

The DoD has an approved secure erase that does indeed work as described.
It writes a pattern of 00,FF,AA,55 to every byte of the file, then "erases" the file.
Ain't no way that data will ever be recovered.
 

[ edit ]
We love NCIS, and are binging the entire thing again (Season 15, Ep 20).
I laugh long and hard at the "computer" stuff they show on the screens.
But, it is all good fun even if sketchy for technical accuracy.

[Dusty Devil Dale]

19 hours ago, Marshal Mo Hare, SASS #45984 said:

The ocean, salt water is more corrosive.

2 min with a propane torch.

[Rip Snorter]

Format the C Drive?  Big Magnet?

[Eyesa Horg]

They make nice woods walk targets for muzzleloader. A 12ga. does a decent eraser as well

[Pat Riot, SASS #13748]

On 12/24/2022 at 4:32 PM, Marshal Mo Hare, SASS #45984 said:

It’s all very Murphyish. If YOU need it deleted, it can be recovered. If YOU need it recovered, it’s gone forever.

That is kind of what I figured.