Eraser and file metadata

Posted: 12-02-2008, 11:19 AM
I have been using Eraser software which overwrites the file with random
data several times to make it unrecoverable. Recently, I have attended
the Forensics class offered by SANS. When it came to the topic of
metadata, some of the classmates mentioned that Eraser works only at the
application level. This confused me a bit.

My question now is, does Eraser delete the data and metadata as well?
If not, then how do you delete metadata? How do you cleanup the
metadata at the file system level? I use Eraser on Vista and Linux.

Thank you in advance.

NJ

Eraser and file metadata


Responses to "Eraser and file metadata"

FromTheRafters
Guest
Posts: n/a
 
Re: Eraser and file metadata
Posted: 12-02-2008, 03:24 PM
Contact the software vendor's support department.

My guess is that system level is needed to affect metadata.

"Neil Jones" <castellan2004-nschap@remove-this.yahoo.com> wrote in message
news:BR8Zk.24466$Jl5.1217@newsfe19.iad...
>I have been using Eraser software which overwrites the file with random
> data several times to make it unrecoverable. Recently, I have attended
> the Forensics class offered by SANS. When it came to the topic of
> metadata, some of the classmates mentioned that Eraser works only at the
> application level. This confused me a bit.
>
> My question now is, does Eraser delete the data and metadata as well?
> If not, then how do you delete metadata? How do you cleanup the
> metadata at the file system level? I use Eraser on Vista and Linux.
>
> Thank you in advance.
>
> NJ

Lew Pitcher
Guest
Posts: n/a
 
Re: Eraser and file metadata
Posted: 12-02-2008, 03:39 PM
On December 2, 2008 06:19, in comp.os.linux.security, Neil Jones
(castellan2004-nschap@remove-this.yahoo.com) wrote:
> I have been using Eraser software which overwrites the file with random
> data several times to make it unrecoverable. Recently, I have attended
> the Forensics class offered by SANS. When it came to the topic of
> metadata, some of the classmates mentioned that Eraser works only at the
> application level. This confused me a bit.
>
> My question now is, does Eraser delete the data and metadata as well?
What do you mean by "metadata"? (I know what /I/ mean, and it is crucial
that you first have an idea of what "metadata" consists of before you ask
whether or not Eraser deletes it.)
> If not, then how do you delete metadata?
It depends on the metadata.

For filesystem-related metadata (such as permission bits, access timestamps,
data locations on disk, etc.) you /delete/ the file (remove its entry from
the directory and free it's inode) at a minimum. You may also want to
manipulate the inode table so that the inode is completely blanked out, or
at least immediately reused, and you may want to manipulate any affected
directories so that the directory entry is blanked out or immediately
reused.

For other sorts of metadata (what sorts could there be?), you need to take
other steps.

> How do you cleanup the metadata at the file system level?
> I use Eraser on Vista and Linux.
For the proper answers to these and other "Eraser"-related questions, you
really should contact the vendor of the "Eraser" package. That looks like
support@east-tec.com to me.

--
Lew Pitcher

Master Codewright & JOAT-in-training | Registered Linux User #112576
http://pitcher.digitalfreehold.ca/ | GPG public key available by request
---------- Slackware - Because I know what I'm doing. ------


Tim Greer
Guest
Posts: n/a
 
Re: Eraser and file metadata
Posted: 12-02-2008, 05:59 PM
Neil Jones wrote:
> I have been using Eraser software which overwrites the file with
> random
> data several times to make it unrecoverable. Recently, I have
> attended
> the Forensics class offered by SANS. When it came to the topic of
> metadata, some of the classmates mentioned that Eraser works only at
> the
> application level. This confused me a bit.
>
> My question now is, does Eraser delete the data and metadata as well?
> If not, then how do you delete metadata? How do you cleanup the
> metadata at the file system level? I use Eraser on Vista and Linux.
>
> Thank you in advance.
>
> NJ
I've never used (or heard of) it, but on Linux check out the shred
command.
--
Tim Greer, CEO/Founder/CTO, BurlyHost.com, Inc.
Shared Hosting, Reseller Hosting, Dedicated & Semi-Dedicated servers
and Custom Hosting. 24/7 support, 30 day guarantee, secure servers.
Industry's most experienced staff! -- Web Hosting With Muscle!
 
LinkBack Thread Tools Display Modes
 


Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On
Forum Jump


Similar Threads
Thread Thread Starter Forum Replies Last Post
getting MP3 metadata into file pop up descriptions in explorer bobfnospam@duxsysnospam.com Windows XP Music 1 07-20-2008 08:00 AM
Metadata, Oh Metadata! JPEG comments, IPTC, Exif DaveC Windows XP Photos 6 12-17-2005 04:57 PM
Is adding IPTC metadata to JPEG using file Browser lossey? David_Strait@adobeforums.com Mac Photoshop 2 08-06-2004 10:58 PM
"Append Metadata" with Photoshop CS file browser Henrik_Meier@adobeforums.com Mac Photoshop 2 07-19-2004 08:22 AM
Photoshop CS: "Append Metadata" with file browser Henrik2000 Mac Photoshop 0 07-18-2004 05:26 PM