E mail question

[HOUSE DETECTIVE]

Where is E mail stored on a computer....and can you retrieve deleted e
mail...and how to police agency's read deleted e mail?

Thanks

 

[David W. Hodgins]

Where is E mail stored on a computer....and can you retrieve deleted e
mail...and how to police agency's read deleted e mail?

Rather off topic for an anti virus newsgroup, however, from your article's headers...

X-Newsreader: Microsoft Outlook Express 5.00.3018.1300

This ancient version of lookout distress will automatically execute many viruses, that
you're likely encounter in usenet.

If you must use M$ malware, please apply all of the updates!!!!!!!!

If that's your real address you're using to post to usenet, you'll soon find a bunch
of 140-155kb messages in your inbox, that contain the "swen" email worm. It
harvests email addresses, from usenet, among other places.

If you open one of those messages, using OE 5, your computer will become infected,
and will start spewing out more copies of the virus.

Please read http://www.claymania.com/safe-hex.html

As to your question about where email is stored, it depends on which software you're
using to read it. Anything written to your hard drive, stays there, until it's overwritten.
See http://www.pcworlddownload.com/system-utilities/system-repair/Directory-Snoop.htm
for a sample of software used to view "deleted" files.

Regards, Dave Hodgins

 

[GSV Three Minds in a Can]

Bitstring <opr52ongj3qz8bjc@nntp>, from the wonderful person David W.

. Anything written to your hard drive, stays there, until it's
overwritten.

Worse than that - until it's over-written ~7+ times (depending on how
desperate the security folks are to recover the data).

That's why 'secure' agencies crush, burn, or otherwise physically
destroy disks .. there is =no= guaranteed safe way to completely
eliminate all traces of the original data merely by re-writing.

 

[kurt wismer]

Bitstring <opr52ongj3qz8bjc@nntp>, from the wonderful person David W.
Hodgins <[email protected]> said



Worse than that - until it's over-written ~7+ times (depending on how
desperate the security folks are to recover the data).

7? the DOD standard only specifies 3... it indicates that in cases
where the risk of exposure after 3 overwrites is still too great the
only other option is physical destruction of the media...

That's why 'secure' agencies crush, burn, or otherwise physically
destroy disks ..

if it only took ~7+ overwrites to get rid of the data then that's all
that should need doing...

there is =no= guaranteed safe way to completely
eliminate all traces of the original data merely by re-writing.

this much is true...

 

[GSV Three Minds in a Can]

Bitstring <[email protected]>, from the

if it only took ~7+ overwrites to get rid of the data then that's all
that should need doing...

~7+ means '7 or more'. 3 will usually work. 7 will nearly always work,
however there is a small, but non-zero, risk that some tracking error
change means that even 9999 won't work. Which is why NATO/DoD 'secret'
and above required (last time I was involved) physical destruction of
the magnetic media.

<snip>

 

[FromTheRafters]

Bitstring <opr52ongj3qz8bjc@nntp>, from the wonderful person David W.


Worse than that - until it's over-written ~7+ times (depending on how
desperate the security folks are to recover the data).

That's why 'secure' agencies crush, burn, or otherwise physically
destroy disks .. there is =no= guaranteed safe way to completely
eliminate all traces of the original data merely by re-writing.

Once harddrive manufacturers add support for halftracking then
this may be different, but I bet real security policies will still have
the destroy method recommended.

 

[David W. Hodgins]

I"ve often seen quotes of DOD specs saying 3 times, or lately 7 times. When specified,
the DOD document being quoted is 5220.22-M. There's a copy online at
http://www.dtic.mil/whs/directives/corres/html/522022m.htm
but it's dated 1995. I haven't found any more recent versions.

In chapter 8 http://www.dtic.mil/whs/directives/corres/pdf/522022m_0195/cp8.pdf
section 8-3-5, (page 14 of the pdf document), is the "Clearing and Sanitization Matrix".

According to that, the procedures for sanatization of hard drives requires procedures
a,b,d, or m. For optical devices, procedures m (for rewritable), or n (for read only),
are required.

On the next page, it defines those procedures...
a. Degauss with a Type I degausser
b. Degauss with a Type II degausser.
d. Overwrite all addressable locations with a character, its complement, then a random character and verify. THIS METHOD IS NOT APPROVED OR SANITIZING MEDIA THAT CONTAINS TOP SECRET INFORMA-
TION.
m. Destroy - Disintegrate, incinerate, pulverize, shred, or smelt.
n. Destruction required only if classified information is contained.

Given that overwriting would be impossible after degaussing (no timing marks), I assume
they mean, procedures a, OR b, OR d, OR m. Note their emphasis, that overwriting is not
acceptable for top secret info, only degaussing, or destruction.

Does anyone here have a link to a more recent version, or to a DOD document that specifies
the 7 times rewrite?

Regards, Dave Hodgins

 

[Conny]

Where is E mail stored on a computer....and can you retrieve deleted e
mail...and how to police agency's read deleted e mail?

Thanks

Depends what mailer you use....

 

[kurt wismer]

Bitstring <[email protected]>, from the
wonderful person kurt wismer <[email protected]> said



~7+ means '7 or more'.

which really means that the number of overwrites required to actually
get rid of the data is unspecified and undetermined...

3 will usually work. 7 will nearly always work,

7 is a magic number and from what i've read of this thread so far i'm
not the only one who thinks so or wonders where you got it...

however there is a small, but non-zero, risk that some tracking error
change means that even 9999 won't work. Which is why NATO/DoD 'secret'
and above required (last time I was involved) physical destruction of
the magnetic media.

if the DOD can't be bothered to overwrite it more than 3 times i can't
see why anybody else would do it..

 

[FromTheRafters]

which really means that the number of overwrites required to actually
get rid of the data is unspecified and undetermined...

Right, it doesn't matter how many times you overwrite the data
if the overwrites are all misplaced to the left or right of the track
of the original data. The protruding edges of the original data will
have to be stomped on too.