Using a File Erasure Tool Considered Suspicious
By a California court:
The designer, Carter Bryant, has been accused by Mattel of using Evidence Eliminator on his laptop computer just two days before investigators were due to copy its hard drive.
Carter hasn’t denied that the program was run on his computer, but he said it wasn’t to destroy evidence. He said he had legitimate reasons to use the software.
[…]
But the wiper programs don’t ensure a clean getaway. They leave behind a kind of digital calling card.
“Not only do these programs leave a trace that they were used, they each have a distinctive fingerprint,” Kessler said. “Evidence Eliminator leaves one that’s different from Window Washer, and so on.”
It’s the kind of information that can be brought up in court. And if the digital calling card was left by Evidence Eliminator, it could raise some eyebrows, even if the wiper was used for the most innocent of reasons.
I have often recommended that people use file erasure tools regularly, especially when crossing international borders with their computers. Now we have one more reason to use them regularly: plausible deniability if you’re accused of erasing data to keep it from the police.
1915b0nd • July 15, 2008 1:56 PM
“Now we have one more reason to use them regularly: plausible deniability if you’re accused of erasing data to keep it from the police.”
So why not just store the data in a hidden volume in TrueCrypt?
Even when the outer volume is mounted, it is impossible to prove
whether there is a hidden volume within it or not, because free space on any TrueCrypt volume is
always filled with random data when the volume is created and no part of the (dismounted) hidden
volume can be distinguished from random data.
No need to erase anything.