Eraser and file metadata

  • Thread starter Thread starter Neil Jones
  • Start date Start date
N

Neil Jones

I have been using Eraser software which overwrites the file with random
data several times to make it unrecoverable. Recently, I have attended
the Forensics class offered by SANS. When it came to the topic of
metadata, some of the classmates mentioned that Eraser works only at the
application level. This confused me a bit.

My question now is, does Eraser delete the data and metadata as well?
If not, then how do you delete metadata? How do you cleanup the
metadata at the file system level? I use Eraser on Vista and Linux.

Thank you in advance.

NJ
 
Contact the software vendor's support department.

My guess is that system level is needed to affect metadata.
 
I have been using Eraser software which overwrites the file with random
data several times to make it unrecoverable. Recently, I have attended
the Forensics class offered by SANS. When it came to the topic of
metadata, some of the classmates mentioned that Eraser works only at the
application level. This confused me a bit.

My question now is, does Eraser delete the data and metadata as well?
Click to expand...

What do you mean by "metadata"? (I know what /I/ mean, and it is crucial
that you first have an idea of what "metadata" consists of before you ask
whether or not Eraser deletes it.)
If not, then how do you delete metadata?
Click to expand...

It depends on the metadata.

For filesystem-related metadata (such as permission bits, access timestamps,
data locations on disk, etc.) you /delete/ the file (remove its entry from
the directory and free it's inode) at a minimum. You may also want to
manipulate the inode table so that the inode is completely blanked out, or
at least immediately reused, and you may want to manipulate any affected
directories so that the directory entry is blanked out or immediately
reused.

For other sorts of metadata (what sorts could there be?), you need to take
other steps.

How do you cleanup the metadata at the file system level?
I use Eraser on Vista and Linux.
Click to expand...

For the proper answers to these and other "Eraser"-related questions, you
really should contact the vendor of the "Eraser" package. That looks like
(e-mail address removed) to me.

--
Lew Pitcher

Master Codewright & JOAT-in-training | Registered Linux User #112576
http://pitcher.digitalfreehold.ca/ | GPG public key available by request
---------- Slackware - Because I know what I'm doing. ------
 
Neil said:
I have been using Eraser software which overwrites the file with
random
data several times to make it unrecoverable. Recently, I have
attended
the Forensics class offered by SANS. When it came to the topic of
metadata, some of the classmates mentioned that Eraser works only at
the
application level. This confused me a bit.

My question now is, does Eraser delete the data and metadata as well?
If not, then how do you delete metadata? How do you cleanup the
metadata at the file system level? I use Eraser on Vista and Linux.

Thank you in advance.

NJ
Click to expand...

I've never used (or heard of) it, but on Linux check out the shred
command.
 
Back
Top