|
Brought to you by:
Suppliers of:
|
|
|
| |
| Shred is a utility that is supposed to overwrite a file with several passes of different bit patterns followed by one random pattern. The tool has been found to be vulnerable to an attack that makes the sole purpose of Shred meaningless: Using another tool to recover the "deleted" content (Dan Farmer and Wietze Venema's TCT Toolkit). |
| |
Credit:
The information has been provided by Jeff Harlan.
|
| |
Vulnerable systems:
Shred v1.0
Using the icat utility from Dan Farmer and Wietze Venema's TCT Toolkit it appears that the data is not totally lost and unrecoverable, but rather quite easily made available.
Example:
# ls -il shred.me
1298547 -rw-rw-r-- 1 jharlan jharlan 17 Oct 10 08:25 shred.me
# icat /dev/hda5 1298547
shred this puppy
# shred shred.me
Are you sure you want to delete shred.me? y
1000 bytes have been overwritten.
The file shred.me has been destroyed!
# icat /dev/hda5 1298547
shred this puppy
Solution:
Do not use the shred utility since it is no longer supported, and many techniques exist for recovering deleted content (such as swap data search, memory dumping, etc.), making such utilities good for hiding your tracks, but far from being complete.
|
|
|
|
|
