From owner-freebsd-questions@FreeBSD.ORG Wed Feb 18 18:10:32 2015 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 3078169C for ; Wed, 18 Feb 2015 18:10:32 +0000 (UTC) Received: from nm7-vm5.bullet.mail.gq1.yahoo.com (nm7-vm5.bullet.mail.gq1.yahoo.com [98.136.218.212]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id E8F06ECD for ; Wed, 18 Feb 2015 18:10:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rocketmail.com; s=s2048; t=1424283025; bh=bJQw4uNQLKL+FAZzXwEB+3Ruz73yCFK3mj8tK0ECqTs=; h=Date:From:To:Cc:Subject:In-Reply-To:References:From:Subject; b=jlRmYqGOrF6IFgL8OZKLG3XSo5IqEzhpgQsQFOb+aOt9aOXzxpJCqEBFMuPbMFPNf81hGqeQwzgK+s/Q+6f/XAPLXe339/hSgwqManSMVv5xLnO1RXnH9LMXzTfnL23NkyhXbIC0c4D1xm0dpdiSAxcn6XWwMymnZyxIAcr7ati8lORu3WMMNYxzs6Au9ETPweBCRV9ez0w1WMrjuA6BP9KXG3NZLqygC3uyoyqlIlbQqOJtBu0z6T/fKsbtUPdT3jrDkHohRvQUGeyTuRlWP+e6GPv+fJM0fwG3xwO2B94bFH1jdfvfNmvaJoMz5pP+tPRiEiErl9fe3tPVE6HI+g== Received: from [98.137.12.190] by nm7.bullet.mail.gq1.yahoo.com with NNFMP; 18 Feb 2015 18:10:25 -0000 Received: from [46.228.39.80] by tm11.bullet.mail.gq1.yahoo.com with NNFMP; 18 Feb 2015 18:10:25 -0000 Received: from [127.0.0.1] by smtp117.mail.ir2.yahoo.com with NNFMP; 18 Feb 2015 18:10:25 -0000 X-Yahoo-Newman-Id: 609378.13231.bm@smtp117.mail.ir2.yahoo.com X-Yahoo-Newman-Property: ymail-3 X-YMail-OSG: Iji22uEVM1lwzjuXz9aGos8FiaEq.Yz6XfhQIgoxjM_da8C yFGPsTPAfTZO6sCJCNvW748xakt9dJX9eN5Aixj4tDrChlRaF9P9MEGUmm_a MIgr5wYvIanXJUU3R6O3wnAcY6TSM2wa5UKke61vdQLayOOiydgdQaekWM_1 .UuhI0n_Z4hfVGF6kCHMaHpulKyy0Ozx8SW.sDQ.O2i1MkvRjUpG41gzketa 6AXMJlaYQBSW9tpo9eq36e_3jPjJjLqiv.oDhcmbh_twVeo7GEqQEDSZPURb CquGr5NalXKlrb2GwHuJD5eDFdAdBBUHQ2HdlM45wYpqjzoIT9i9zqUoWYDO kUoyd2pt96L37OgVoMFZgyEJ59gs8x4oaa5WBmY3UVO8junnsG5Jg2phFmRU SGbUah1pHfSTmTy1bVESPr6aMfyD3ZsUu4wKz2i5bFvoRmzK2qyF4A1JRE5G URkge2qXPUkHhEBcX8BX.9xPLLcHbsm4vjVIiNQO4CBqLkiwLfvhwwKxWkoF uMjTaRcHgEbAatJY3EeZLsKDZMa.e_YIcYJY_52FjaEduy6UoSnwJRRDQ2OM iAzhsJcI- X-Yahoo-SMTP: BeMCPs2swBABTJ3kAeEiC_hE0mz8jRexLddJfD8pI2j32fOacjBmXg-- Date: Wed, 18 Feb 2015 19:10:24 +0100 From: Ralf Mardorf To: freebsd-questions@freebsd.org Subject: Re: [Bulk] Re: [Bulk] Re: What's in my hard drive? How can I get rid of it? Message-ID: <20150218191024.1c819e5d@archlinux> In-Reply-To: <20150218190012.d865cbdf.freebsd@edvax.de> References: <54E39F83.70002@gmail.com> <51803.128.135.70.2.1424219858.squirrel@cosmo.uchicago.edu> <20150218020243.366fe968@archlinux> <20150218190012.d865cbdf.freebsd@edvax.de> X-Mailer: Claws Mail 3.11.1-66-gd6ba813 (GTK+ 2.24.25; x86_64-arch-linux-gnu) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Cc: Polytropon X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 18 Feb 2015 18:10:32 -0000 On Wed, 18 Feb 2015 19:00:12 +0100, Polytropon wrote: >On Wed, 18 Feb 2015 02:02:43 +0100, Ralf Mardorf wrote: >> Actually criminal investigation departments seems to be unable to >> recover all the data that was deleted by a simple rm command, even on >> journaling file systems. Why is it recommended to mount read only, as >> soon as possible, if we lose data, to be able to recover that data? > >Because they use expensive and certified software, >highly recommended by qualified and certified >consultants, which are also expensive. The highly >sophisticated equipment is only accessed by a very >restricted set of professional officers who can >already distinguish the left mouse button from the >right mouse button and have been trained (by skilled >and certified educators) to click on little pictures. >This approach is safe, because there are procedures, >and those are certified. Nothing can go unnoticed, >as all involved parts are free of any imaginable >error or misbehaviour: the software is idiot-proof, >and the officers are... highly qualified experts. >Our tax money at work. So what do you expect? :-) Unfortunately I can't disagree :(. >> The NSA is able to recover all the data that was deleted all over the >> world even by a shred command on a non-journaling FS? If so, the NSA >> isn't willing to give hints against child molesters and other >> criminals, because the NSA is the watchdog of more important crimes? >> That's grotesque. > >Any organisation has to carefully define its priorities, >and when the NSA states: "We could undelete those files, >and a child molester has been arrested as a result", the >society would scream in fear because they would begin to >admit the thought that everything which is possible WILL >BE DONE (no matter if we are able to recognize it in the >first place). Also keep in mind: there's a difference >between "to protect" and "to investigate" - and put that >into context with defining priorities... > >In the end, anti-forensics is where the "real criminals" >are actually really good at. :-) Unfortunately I can't disagree with this too :(. Isn't it a shame?