Which is the actual most gentle - but forensic bullet-proofed - tool to wipe an SSD/SSM? In a case we found that the flash memory cells were forensically no-finding wiped. Must be a free tool ou there which enables this. The gang is super high-level technical profound - and cares extremely about Clean & Save. They dont waste money.
Is there a unseen brandnew tool in the wild?
DFC! Please PM only.
Which is the actual most gentle - but forensic bullet-proofed - tool to wipe an SSD/SSM? In a case we found that the flash memory cells were forensically no-finding wiped. Must be a free tool ou there which enables this. The gang is super high-level technical profound - and cares extremely about Clean & Save. They dont waste money.
Is there a unseen brandnew tool in the wild?
Did you manage to find a SSD that doesn't properly implement the SafeErase ATA command? 😯
DFC! Please PM only.
Then please delete this thread and PM all members who you believe might be interested.
The concepts about the way a PUBLIC discussion forum works must be something that you really cannot or don't want to understand. (
As it was suggested to you before, please create your own private forum or ask jamie to have a private (by invitation only) subforum, but please, please, please stop this nonsense about attempting to make private a public resource.
jaclaz
@jaclaz if somebody asks for PM it means he/she got a sensitive case to work on, which at some point makes legit the PM only answers.
I know you don't worship RolfGutmann and you don't like his style, but please don't be mean to him.
I had recently a **** case where all the PM help I got from public places got a criminal behind the bars, so I can value the PM help I got from public queries.
@jaclaz if somebody asks for PM it means he/she got a sensitive case to work on, which at some point makes legit the PM only answers.
I know you don't worship RolfGutmann and you don't like his style, but please don't be mean to him.
I had recently a **** case where all the PM help I got from public places got a criminal behind the bars, so I can value the PM help I got from public queries.
Well, no, I am not at all being mean (to him or to anyone else).
I can well understand how some cases need some protection from public view, but this is not the case.
Rolf asked a "generic" question and asked for reply via PM, with one of his acronyms DFC (that stands for "Don't Feed the Crime").
He didn't ask for assistance via PM, he deliberately (and as you well know it is not the first time) asked that other members do not post the "generic" information they may have in public.
This is not - as I see it - a request for assistance on a specific matter, but rather an attempt to decide what other people post (or not post) on a public thread in a public discussion forum.
I asked - I believe very kindly - to stop these attempts[1].
I am as free to ask him to refrain from this as he is to ask all members to not post generic info in order to "not feed the crime", without being in any way "mean" (to him or to anyone else).
jaclaz
[1] Here is a reference when the whole thing started, JFYI
https://www.forensicfocus.com/Forums/viewtopic/t=13920/
and you of course very well know about the qassam2222 episodes, however, just in case
https://www.forensicfocus.com/Forums/viewtopic/p=6587707/#6587707
https://www.forensicfocus.com/Forums/viewtopic/p=6588860/#6588860
I search for a tool criminals have in use and we don't know actually. See my initial question.
Maybe I missed something, but what evidence is there that there is a new tool?
There are dozens of software applications that will effectively wipe a hard drive (it isn't a secret). How to do know that one of the existing tools wasn't used?
Hello everyone,
First off I want to thank Jaclaz and RolfGuttman both for your public contributions here which have repeatedly been of great value to me.
I suggest a new thread to discuss the interesting topic of public versus private discourse.
I work primarily in civil litigation, not criminal cases (with some exceptions) so my perspective is basically that of a civilian forensic specialist. I am working on my fifth homicide case in support of law enforcement (writing search and seizure technical warrants and performing forensics), but I am a civilian, not sworn law enforcement.
I have recently signed up to take Cellebrite's Advanced JTAG Extraction (CAJE) course as I am running into screen locked phones on a regular basis in my civil practice.
Teel Technologies offers a competing class but will only provide that competing class to current sworn law enforcement professionals ("This class is for Law Enforcement Only (LEO) or LEO affiliates ONLY unless otherwise noted."). I was told I could not enroll in the Teel course directly by Teel Technologies themselves.
So, it appears that Teel Technologies follows the "Do not feed the criminals" philosophy even though I am clearly not a criminal, nor will I work for criminals.
I have been taught and mentored that I must be 100% independent, meaning my answers will always be the same no matter who is asking me the question. I have also been taught and mentored that all of my work must be 100% scientific such that all of my work can be 100% replicated by a qualified peer.
So, my personal opinion is that keeping knowledge and training to "law enforcement only" as is Teel Technologies' policy, potentially opens up a forensic specialist to attack at some point by a criminal defense attorney alleging lack of independence on the part of the forensic specialist.
Obviously there are areas of discussion such as ongoing cases, which must be kept secret lest the ongoing case be jeopardized (I assume as a civilian this is true).
Are law enforcement professionals taught rules and theories around public versus private discourse? If anyone can recommend a good book on this subject I would love to know as I have a strong interest in this area.
LEOs cannot talk directly about the 'real' issue they handle. So please tell me how to openly talk without revealing the secret you have to hold back? Don't expect from LEOs the default transparency and openness in collaboration. We cannot - but need collaboration globally.
Short in time but the discussion should go on.
@UnallocatedClusters
There is already a topic, we can reuse that one
https://www.forensicfocus.com/Forums/viewtopic/t=13920/
About the "disparities" between treatment of "sworn" LEO and "civil practitioners" it is a long standing debate, particularly in countries where - in least in theory - there is a right to "fair judgement" and "equal opportunities" for preosecution and defense.
As I see it (but I may well be wrong) there are so many different "levels" of LEO (depending on different countries Laws) that Teel Technologies (or whoever makes these "reserved" trainings) should make an additional distinction between "accredited Law Enforcement Organizatons" and the rest.
I mean, to make an US example, I believe that one thing is being a (say) FBI Special Agent and another thing is to be (still say) a "Special Deputy Sheriff" in Indiana.
Moreover in many countries being a "sworn" Law Officer is "temporary", not necessarily a "lifetime" job, and as a matter of fact still remaining in the US, I presume that a large number of licensed Private Investigators and security personnel are ex-LEO's.
So, nothing prevents a large number of people from qualifying (in a perfectly legal way) for these "allegedly secret or reserved" courses and next month become private, and it is not like they are forced to unlearn what they learned.
And of course - with all due respect to the good LEO's - there may well be among them a few bad apples, that may leak the contents of the courses so that "secrecy" is a very relative one.
Back to the topic at hand, as Passmark stated, there are tens or dozens of well known and publicly available, free and/or open source tools capable of wiping a SSD, including as hinted (it depends on the specific SSD make/model and firmware revision) the built-in (according to official ATA specifications) Safe Erase command, so the preamble assuming the existence of a new free tool may actually have no grounds.
And nothing prevents a suspected criminal to act criminal wink and use a pirated or leaked Commercial tool, by the way.
jaclaz
So please tell me how to openly talk without revealing the secret you have to hold back?
The thing is, this sort of open talk isn't what internet forums or their PM systems are made for. You count on contributors with very poor security management, if they give more information to an unvetted fellow forum user via an insecure PM than they write in public.