X hits on this document

82 views

0 shares

0 downloads

0 comments

24 / 30

Security Risk: Ambient Data

Bottom Line: The deletion of a file or the Reformat of a hard disk provides essentially no level of security.  Left behind: Ambient data is a forensic term which describes, in general terms, data stored in non-traditional computer storage areas and formats:

                                   - Windows Swap/Page File

These are "scratch pad" files to write data when additional random access memory is needed. (100MB to over 1GB. They contain remnants of any work that may have occurred.

                                   - Unallocated File Space

When files are erased or deleted the file is not actually erased. Data from the 'erased file' remains behind in an area called unallocated storage space.

                                    - File Slack

Files are stored in fixed length blocks of data called clusters.  Rarely do file sizes exactly match the size of one or multiple clusters perfectly. The extra data storage space that is assigned to a file is called "file slack". File slack contains padded data from memory and remains undeleted.

                                    - Shadow Data

Shadow data contains the remnants of computer data that was written previously to a track and it is located slightly outside the track's last write path.

Document info
Document views82
Page views82
Page last viewedSat Dec 10 07:04:59 UTC 2016
Pages30
Paragraphs305
Words2761

Comments