4 ms·

>even though this had been formatted after his employment was terminated, the FBI was still able to gather data from the hard drive. Usual misinformation, the

by jaclaz 9y ago

>even though this had been formatted after his employment was terminated, the FBI was still able to gather data from the hard drive. Usual misinformation, the company only reinstalled the Windows Operating System (clearly without reformatting the volume(s)), as in the affidavit: regmedia.co.uk/2017/10/08/lin_complaint_pacer.pdf (point 37, page 16). Also, according to the affidavit, what actually comes out from PureVPN is only that the same user connected to them from two different IP's, corresponding to home/work of the suspect. (point 52, page 22) And that some traces of use of PureVPN were found in (the unallocated space of) the work computer. (point 58, page 24) Simplified, IMHO 99% (maybe 99.99%) of the case is based on non-PureVPN derived evidence.

roywiggins 9y ago
Are you sure reinstalling Windows doesn't involve reformatting? Reformatting doesn't usually mean you zero out the drive.
- Crosseye_Jack 9y ago
  If you try and install Windows onto a drive that Windows is already installed on and basically just click though next though the installation process then setup will tell you: > "If the partition you've chosen contains files from a previous Windows installation, these files will be moved to a folder named Windows.old" If you then click OK Setup will then create a Windows.old folder, move the old Windows dir, user dir to Windows.old and then install as normal. If you delete the existing partition during the setup (or its a fresh drive), Setup needs to create a new partition(s) and will do it automatically if you wish, after which it will do a quick format. EDIT: Reading the pdf they point too it states that the OS was reinstalled, leading to data deletion but they were able to find various artifacts in unallocated space. So they may or may not of formated the drive, but most likely at least delete the partition, but even a full format doesn't zero out the drive (unless you give format.exe the /p: argument).
  - jaclaz 9y ago
    >but even a full format doesn't zero out the drive (unless you give format.exe the /p: argument). A "normal", "full" format will wipe the volume, the /P command is implied unless /Q is specified (since Vista, but previous versions didn't have the /P at all), the /P:count parameter is to add (why?) to do it a number of times, using random characters: https://ss64.com/nt/format.html https://ss64.com/nt/format.html >/P:count Zero every sector on the volume. After that, the volume will be overwritten "count" times using a different random number each time. If "count" is zero, no additional overwrites are made after zeroing every sector. This switch is ignored when /Q is specified. More clear here: https://www.lifewire.com/format-command-2618091 https://www.lifewire.com/format-command-2618091 >/p:count = This format command option writes zeros to every sector of the drive: once. If you specify a count, a different random number will be written to the entire drive that many times after the zero writing is complete. You can not use the /p option with the /q option. Beginning in Windows Vista, /p is assumed unless you use /q [KB941961].
    - Crosseye_Jack 9y ago
      I stand corrected, I was going off https://technet.microsoft.com/en-us/library/cc730730(v=ws.11).aspx https://technet.microsoft.com/en-us/library/cc730730(v=ws.11... which doesn't state that /p is implied unless /q is given. But yeah that lifewire link gave the KB number to the change of behaviour notice https://support.microsoft.com/help/941961/ https://support.microsoft.com/help/941961/
      - jaclaz 9y ago
        Yep, no prob, I also posted a link to that kb above (but maybe it was posted after your post and went above your reply because it was a direct reply to roywiggins' post). Anyway, I wanted to also highlight how since the company where he worked was specifically a "software company" (I mean not a mom and pop shop around the corner or similar) the IT guys over there should have wiped the disk anyway, possibly using the SecureErase ATA command (that wipes also not normally accessible disk areas), it should be "standard" procedure.
- jaclaz 9y ago
  Reinstalling Windows in itself does not necessarily imply reformatting, for all that matters you can just delete files in the filesystem and reinstall, but my note was more about the behaviour of format, up to XP when you ran format on a volume there was no way to 00 it [0], while since Vista it is the default [1]. Unless the /q parameter is used (or the "Quick Format" option is chosen) the format command will 00 the volume. Of course if the task at hand is "reset a computer removing traces of what the old employee did and have a brand new OS" using a "Quick Format" is not particularly smart, I should have written "without reformatting properly". [0] http://support.microsoft.com/kb/302686/en-us http://support.microsoft.com/kb/302686/en-us [1] http://support.microsoft.com/kb/941961/en-us http://support.microsoft.com/kb/941961/en-us

by jaclaz 9y ago

roywiggins 9y ago

Are you sure reinstalling Windows doesn't involve reformatting? Reformatting doesn't usually mean you zero out the drive.

Crosseye_Jack 9y ago
If you try and install Windows onto a drive that Windows is already installed on and basically just click though next though the installation process then setup will tell you: > "If the partition you've chosen contains files from a previous Windows installation, these files will be moved to a folder named Windows.old" If you then click OK Setup will then create a Windows.old folder, move the old Windows dir, user dir to Windows.old and then install as normal. If you delete the existing partition during the setup (or its a fresh drive), Setup needs to create a new partition(s) and will do it automatically if you wish, after which it will do a quick format. EDIT: Reading the pdf they point too it states that the OS was reinstalled, leading to data deletion but they were able to find various artifacts in unallocated space. So they may or may not of formated the drive, but most likely at least delete the partition, but even a full format doesn't zero out the drive (unless you give format.exe the /p: argument).
- jaclaz 9y ago
  >but even a full format doesn't zero out the drive (unless you give format.exe the /p: argument). A "normal", "full" format will wipe the volume, the /P command is implied unless /Q is specified (since Vista, but previous versions didn't have the /P at all), the /P:count parameter is to add (why?) to do it a number of times, using random characters: https://ss64.com/nt/format.html https://ss64.com/nt/format.html >/P:count Zero every sector on the volume. After that, the volume will be overwritten "count" times using a different random number each time. If "count" is zero, no additional overwrites are made after zeroing every sector. This switch is ignored when /Q is specified. More clear here: https://www.lifewire.com/format-command-2618091 https://www.lifewire.com/format-command-2618091 >/p:count = This format command option writes zeros to every sector of the drive: once. If you specify a count, a different random number will be written to the entire drive that many times after the zero writing is complete. You can not use the /p option with the /q option. Beginning in Windows Vista, /p is assumed unless you use /q [KB941961].
  - Crosseye_Jack 9y ago
    I stand corrected, I was going off https://technet.microsoft.com/en-us/library/cc730730(v=ws.11).aspx https://technet.microsoft.com/en-us/library/cc730730(v=ws.11... which doesn't state that /p is implied unless /q is given. But yeah that lifewire link gave the KB number to the change of behaviour notice https://support.microsoft.com/help/941961/ https://support.microsoft.com/help/941961/
    - jaclaz 9y ago
      Yep, no prob, I also posted a link to that kb above (but maybe it was posted after your post and went above your reply because it was a direct reply to roywiggins' post). Anyway, I wanted to also highlight how since the company where he worked was specifically a "software company" (I mean not a mom and pop shop around the corner or similar) the IT guys over there should have wiped the disk anyway, possibly using the SecureErase ATA command (that wipes also not normally accessible disk areas), it should be "standard" procedure.
jaclaz 9y ago
Reinstalling Windows in itself does not necessarily imply reformatting, for all that matters you can just delete files in the filesystem and reinstall, but my note was more about the behaviour of format, up to XP when you ran format on a volume there was no way to 00 it [0], while since Vista it is the default [1]. Unless the /q parameter is used (or the "Quick Format" option is chosen) the format command will 00 the volume. Of course if the task at hand is "reset a computer removing traces of what the old employee did and have a brand new OS" using a "Quick Format" is not particularly smart, I should have written "without reformatting properly". [0] http://support.microsoft.com/kb/302686/en-us http://support.microsoft.com/kb/302686/en-us [1] http://support.microsoft.com/kb/941961/en-us http://support.microsoft.com/kb/941961/en-us