Eraser Forum
Here is what I did in a nushell. I went to the command line and typed this:
Note I was doing this on a flash drive formatted in NTFS
E:\>echo this is a test > test.txt
Then I hid show text in a alternate data stream of that file
E:\>echo top secret info > test.txt:secret.txt
So after I did this I used a program called HxD (A drive hexadecimal forensic tool) and found my secret text on the disk. I then used eraser and on the file test.txt. Then tried looking to make sure the alternate data stream was destroyed too but it wasn't, test.txt was destroyed. But the text "top secret info" was still intact. When developing Eraser was Alternate Data Streams ADS taken into account?
More info on Alternate Data Streams can be found here:
http://www.irongeek.com/i.php?page=security/altds
Note I was doing this on a flash drive formatted in NTFS
E:\>echo this is a test > test.txt
Then I hid show text in a alternate data stream of that file
E:\>echo top secret info > test.txt:secret.txt
So after I did this I used a program called HxD (A drive hexadecimal forensic tool) and found my secret text on the disk. I then used eraser and on the file test.txt. Then tried looking to make sure the alternate data stream was destroyed too but it wasn't, test.txt was destroyed. But the text "top secret info" was still intact. When developing Eraser was Alternate Data Streams ADS taken into account?
More info on Alternate Data Streams can be found here:
http://www.irongeek.com/i.php?page=security/altds