Eraser and file metadata

[Guest Neil Jones]

I have been using Eraser software which overwrites the file with random

data several times to make it unrecoverable. Recently, I have attended

the Forensics class offered by SANS. When it came to the topic of

metadata, some of the classmates mentioned that Eraser works only at the

application level. This confused me a bit.

 

My question now is, does Eraser delete the data and metadata as well?

If not, then how do you delete metadata? How do you cleanup the

metadata at the file system level? I use Eraser on Vista and Linux.

 

Thank you in advance.

 

NJ

[Guest Lew Pitcher]

On December 2, 2008 06:19, in comp.os.linux.security, Neil Jones

(castellan2004-nschap@remove-this.yahoo.com) wrote:

<span style="color:blue">

> I have been using Eraser software which overwrites the file with random

> data several times to make it unrecoverable. Recently, I have attended

> the Forensics class offered by SANS. When it came to the topic of

> metadata, some of the classmates mentioned that Eraser works only at the

> application level. This confused me a bit.

>

> My question now is, does Eraser delete the data and metadata as well?</span>

 

What do you mean by "metadata"? (I know what /I/ mean, and it is crucial

that you first have an idea of what "metadata" consists of before you ask

whether or not Eraser deletes it.)

<span style="color:blue">

> If not, then how do you delete metadata?</span>

 

It depends on the metadata.

 

For filesystem-related metadata (such as permission bits, access timestamps,

data locations on disk, etc.) you /delete/ the file (remove its entry from

the directory and free it's inode) at a minimum. You may also want to

manipulate the inode table so that the inode is completely blanked out, or

at least immediately reused, and you may want to manipulate any affected

directories so that the directory entry is blanked out or immediately

reused.

 

For other sorts of metadata (what sorts could there be?), you need to take

other steps.

 

<span style="color:blue">

> How do you cleanup the metadata at the file system level?

> I use Eraser on Vista and Linux. </span>

 

For the proper answers to these and other "Eraser"-related questions, you

really should contact the vendor of the "Eraser" package. That looks like

support@east-tec.com to me.

 

--

Lew Pitcher

 

Master Codewright & JOAT-in-training | Registered Linux User #112576

http://pitcher.digitalfreehold.ca/ | GPG public key available by request

---------- Slackware - Because I know what I'm doing. ------

[Guest Tim Greer]

Neil Jones wrote:

<span style="color:blue">

> I have been using Eraser software which overwrites the file with

> random

> data several times to make it unrecoverable. Recently, I have

> attended

> the Forensics class offered by SANS. When it came to the topic of

> metadata, some of the classmates mentioned that Eraser works only at

> the

> application level. This confused me a bit.

>

> My question now is, does Eraser delete the data and metadata as well?

> If not, then how do you delete metadata? How do you cleanup the

> metadata at the file system level? I use Eraser on Vista and Linux.

>

> Thank you in advance.

>

> NJ</span>

 

I've never used (or heard of) it, but on Linux check out the shred

command.

--

Tim Greer, CEO/Founder/CTO, BurlyHost.com, Inc.

Shared Hosting, Reseller Hosting, Dedicated & Semi-Dedicated servers

and Custom Hosting. 24/7 support, 30 day guarantee, secure servers.

Industry's most experienced staff! -- Web Hosting With Muscle!