Search found 2 matches
Return to “Curious - Is this Forum Evidence?”
- Tue Dec 22, 2009 9:57 pm
- Forum: General Texas CHL Discussion
- Topic: Curious - Is this Forum Evidence?
- Replies: 54
- Views: 5918
Re: Curious - Is this Forum Evidence?
We could start typing in binary and then if pressed, we could say this is a zero tolerance forum.
- Tue Dec 22, 2009 5:30 pm
- Forum: General Texas CHL Discussion
- Topic: Curious - Is this Forum Evidence?
- Replies: 54
- Views: 5918
Re: Curious - Is this Forum Evidence?
It can be made more difficult for forensics if the "owner" of the site were to access their ISP server I.E. Cpanel and delete the tables and then the databases themselves, then remove the architecture of the forum...LarryH wrote:That probably wouldn't help. Just because you've "deleted" it doesn't mean it's really gone (although someone with experience in forum software would have to confirm that), especially if another member quoted your post, because YOU can't edit his/her post.USA1 wrote:Excuse me while I go and delete every post I've ever made.
For those who are old enough to remember the Iran-Contra hearings, one of the factors that gave Ollie North so much trouble was the fact that "deleted" emails were only deleted from his system, but were archived on the email server. I'd imagine the situation with the forum would be similar.
BUT anything that is written to and then deleted from a hard drive leaves file fragments, kind of like abbreviated indexes, that have enough information that can be re-constructed to the point where information (though not totally intact) can be accessed. This would take a great deal of effort and expertise so they would have to really want to get something on you. There have even been cases where a HD involved in a fire had data retrieved from it.
The only way to completely remove data to the point where the most advanced forensic data experts would be likely unable to retrieve anything is to write the disk to zeroes and then demagnetize it, making it unusable again. Most ISPs are cloud hosting now and have bits and pieces of your site's data written all over and in redundancy, at multiple physical machine locations. Even if you have an ISP where it's in a single location, they are RAID systems and there is redundancy that ALL disks would have to be destroyed beyond recovery. Even single site ISPs typically have an off site mirror.
You can make it extremely difficult, unlikely you could make it impossible to gather evidence.
A note about IPs, there are nefarious means by which a ne'er-do-well can utilize forwarding routines to make something look as if it came from another (possibly yours and mine) IP. So, IMO it would have to have a coherent link to your machine for an IP address to be relevant in evidence...does not mean they won't kick in your door though.
Added in Edit: These cautions should apply to blogs, Facebook, MySpace et al. Employers are by routine Googling the names of perspective employees. Anything you have authored with your first, last or (perish the thought) your whole name can destroy your hopes of gainful employment.