Is there any timestamp after erasing?

B

bitdefender

New Member
Hello,
i erased an external hardisk, connected via USB, first all files, then additional empty space.
Will there be any type of timestamp left for forensic tools to figure out when the disk has been erased?

thanks for any answer in advance
bitdefender
 
Possibly. Hard disk space is erased by overwriting it with files containing random data, then deleting those files and overwriting the unused entries in the MFT. File recovery tools can recover the files created by Eraser, and, depending on the circumstances, may be able to recover the original date stamps as well. If the disk in question contains the Eraser Task List, that too will often have a date/time when a task was run.

David
 
While Eraser tries to avoid adding to this problem through the use of lower-level system calls, the metadata is scattered all over the drive and it is not possible to fully prevent this problem from happening. I currently lack documentation for the NTFS file system so it is rather difficult to help solve this problem.
 
Joel said:
I currently lack documentation for the NTFS file system ...
Click to expand...
That's not surprising. I don't think that Microsoft has ever documented it publicly. But the Linux world has put a lot of effort into reverse engineering. Here's a summary you may find useful

David
 
I think I have something similar. The problem is, it's not good enough to use that to implement NTFS support, the risk of implementing NTFS wrongly is too great in my opinion.
 
Thanks to you guys for that quick an professional response.
For me in this case it was only relevant if or if not.
And this question is answered well.
bitdefender
 
You must log in or register to reply here.
Back
Top