±Forensic Focus Partners

±Your Account


Nickname
Password


Forgotten password/username?


Membership:
New Today: 7
New Yesterday: 2
Overall: 27509
Visitors: 59

±Follow Forensic Focus

Join our LinkedIn group

Subscribe to news

Subscribe to forums

Subscribe to blog

Subscribe to tweets

Deleted data and guilt?

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page 1, 2  Next 
  

Deleted data and guilt?

Post Posted: Wed Mar 19, 2014 4:54 pm

I’ve been thinking for the past hour or so whether or not this question is appropriate for the FF forum. I’m just wondering if anyone else has been thinking similarly?

I was just watching some of the Malaysian Air coverage and they say the Pilot deleted some data from his flight simulator. The tone in how the information was presented seemed to possess an aura that they guy was guilty of something because he deleted data. I was thinking the simulator may have limited memory capacity?

All of us that work with computers and cell phones love to capture deleted data, but is it possible that there is a tendency, barring additional facts, to assign some sort of guilt to someone just because something is deleted?

Some people do it to free up space. Others may because they want to try and keep systems running at optimum performance?

I know that what I am saying is very general, but does anyone think that occasionally too much emphasis is placed on things being deleted?
_________________
Ed

I'm not a cellular technology expert, but I did stay at a Holiday Inn Express last night. 

hcso1510
Senior Member
 
 
  

Re: Deleted data and guilt?

Post Posted: Wed Mar 19, 2014 6:09 pm

According to the WSJ there were in fact 3 different flight simulator games on the PC.
The deleted material was described as "data logs".
Without knowing a lot more detail I don't think too much can be read into the fact files were deleted. It might even be an automatic function of the game to only keep 1 month of logs, or the last 10 logs, etc..  

Passmark
Senior Member
 
 
  

Re: Deleted data and guilt?

Post Posted: Wed Mar 19, 2014 6:48 pm

On at least one news channel, the talking head made a remark, most likely overlooked by many. She said deleting could have been just freeing up space. Double deleting, and only that information would suggest something to hide. But, she closed, no one really knows because the information sources are inconsistent.

I presume she meant over-writing as "double delete", but it was refreshing.  

jhup
Senior Member
 
 
  

Re: Deleted data and guilt?

Post Posted: Wed Mar 19, 2014 7:43 pm

Anything printed/written/displayed in the media is always heavily slanted depending on what message they want to get across.

I have had so many dealings with the media in my LE days and it never ceased to amaze me how often they would print out right lies, full well knowing they were lies, knowing that they could do so with impunity.

Hence, I never believe anything I see in the media unless I can confirm it form other more reliable sources.  

Adam10541
Senior Member
 
 
  

Re: Deleted data and guilt?

Post Posted: Thu Mar 20, 2014 5:04 am

@hcso1510
I have a very similar feeling, see the issue about defragmenting for Anti-Forensics here:
www.forensicfocus.com/...ic/t=5410/

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 

jaclaz
Senior Member
 
 
  

Re: Deleted data and guilt?

Post Posted: Thu Mar 20, 2014 7:15 am

- hcso1510
All of us that work with computers and cell phones love to capture deleted data, but is it possible that there is a tendency, barring additional facts, to assign some sort of guilt to someone just because something is deleted?

Some people do it to free up space. Others may because they want to try and keep systems running at optimum performance?

I know that what I am saying is very general, but does anyone think that occasionally too much emphasis is placed on things being deleted?


I guess we should always keep an open mind on this sort of thing, as for all we know he may have deleted these logs for the exact purposes you have detailed and not to cover up things. Then again, these logs may detail crucial evidence, who knows!?

- Adam10541
Hence, I never believe anything I see in the media unless I can confirm it form other more reliable sources.


Exactly agree with this. Straight away people will just assume/jump to conclusions and it's completely wrong in my opinion. (nothing will ever stop the media doing this). I think the agencies involved should just be left to do their job rather than constantly being asked questions which could jeopardize the case. It must be a nightmare for the families - one minute hearing the plane landed somewhere and the next to hear it was someone on board etc...  

DCS1094
Senior Member
 
 
  

Re: Deleted data and guilt?

Post Posted: Thu Mar 20, 2014 11:11 am

I would like to know if he had a pattern of deleting logs - at a guess are they numbered, if so holes would be seen.

If he normally deleted everyone, nothing odd this time. If the last 6 months all exist, then this might be significant?

If there are lots of holes, then maybe he only keeps special ones.

Secure wiping I would as more significant. Not many people do this as routine. But again I would like to know if everything is always securely wiped.

For disk cleaning/space etc. How full is his disk?
_________________
Michael Cotgrove
www.cnwrecovery.com
cnwrecovery.blogspot.com/ 

mscotgrove
Senior Member
 
 
Reply to topicReply to topic

Share this forum topic to encourage more replies



Page 1 of 2
Go to page 1, 2  Next