The actual files downloaded and the torrent file itself which pointed to the downloaded files was also not erased (Figure 1).
The Internet files which contained links leading to the download site were deleted, but this was recoverable with Autopsy. This program did not remove any traces of orrent activity from the test machine. By altering settings from the default, the level of knowledge of the researcher would influence what activities the erasure tools removed. The reason for this was that the aim of this research was to determine what the programs themselves would erase. All erasure software was run with its default settings. Repeat Step 2 using the image containing torrent software and torrent activity that was created in Step 1, but with a different erasure program. The registry of the source machine was also examined to determine whether there were traces of BitTorrent activity still remaining. If necessary, this image file was then examined using Autopsy (Sleuthkit 2005) to determine whether information had actually been permanently erased. Following this, the drive was imaged using dd on the Helix 1.6 Linux bootable CDROM, and MD5 hashes of both the source drive and image files were created and compared for consistency. next step was to install one of the erasure programs, use it to erase Internet and downloading activities with its default settings.
0 kommentar(er)
