The Persistence of Data Paradox

• Deleted files are difficult to recover.

• Deleted data is difficult to get rid of!

  • Some deleted data may be present on a system months after being deleted.

• File meta data can persist after the data is gone.

  • File meta data can determine attack timelines even in the absence of the actual data.

• Systems may even retain data from past systems!

  • A Linux honeypot was found with data from a past Solaris install.
  • The same system was found with data from an even more ancient Windows install.

• Wipe (initialize) all drives before installation!

Notes: