LESSON 24

SHADOW DATA (PART 2) [1]

Task 1. Read and translate the text:

Задание 1. Прочитайте и переведите текст:

Finally, vertical... (computer data, shadow data, electronic data) may also exist in the material used to store the magnetic imprint. On some storage devices the material consists of iron oxide layers which have been sprayed on the platter of a... (hard disk drive, floppy disk, zip disk) or on plastic Mylar sheets used in the manufacture of floppy diskettes. In staying with the spray paint analogy, imagine that our road in the previous examples is porous. When the paint is sprayed onto the road, some of it may seep downward into the pours asphalt that makes up the surface of the road. Later, when another line of a different color is painted onto the road, the horizontal imperfections will also be manifested as differences in depth and the new paint will also seep into the porous layers of asphalt. If we were to slice off layers of the asphalt, the original painted line, in some places, will be overlapped with the new color. But remnants of the original paint will also exist. When this analogy is compared to writes made to a hard disk drive, the layering occurs due to physical flaws in the... (news media, storage media, hard disc media) and variances in the ability of the platters coating to hold a magnetic charge.

Since the write heads path will always vary slightly, within allowable tolerances, it is theoretically impossible to guarantee the secure wipe of a floppy diskette, hard disk drive or tape using a software solution. However, multiple overwrites can increase the effectiveness of a... (security scrub, removing program, write head). But strictly speaking, some data may still remain behind after a data scrub for discovery. You should be aware, however, that the recovery of shadow data is no easy task. Specialized and very expensive equipment is required to reliably recover shadow data. The costs of the necessary equipment and the expert staff required to perform the... (input process, data extraction process, printing process) puts the process beyond the reach of most private sector corporations. From a computer forensics standpoint, shadow data has yet to become a source of reliable computer evidence. This is, in part, because of the costs involved. Another factor pertains to the potentials of data bleed from one layer of shadow data to another. This problem taints the computer evidence and makes it difficult to differentiate one level of... (computer data, legacy data, shadow data) from another.

If you have an interest in researching and experimenting with shadow data, basic tools are available for free download over the Internet. However, we must stress that the reliability of these methods and techniques does not produce evidence grade results from a computer forensics standpoint. Software solutions provide... (strong results, limited success, viruses) because they rely upon the same mechanical flaws discussed above. But, such software solutions in the wrong hands could still create a security risk. We should also point out that the use of basic data recovery tools and techniques do not compare with the tools and techniques used by US government agencies in the identification and extraction of shadow data. They are the true experts in this area.

As an additional note, older encoding methods, e.g., MFM and RLL, make the recovery of shadow data a bit less difficulty. Newer hard disk drive technologies, however, make recovery of shadow data a bit less fruitful, because the drive densities require higher frequencies to write data to narrower tracks. This limits... (access, writing, erasion) to the shadow data, because the signal strength and write frequencies are not as strong as with older technologies. Furthermore, some of the "splatter" effect is reduced with the newer... (hard disk drive, floppy disk, zip disk) technologies because of tighter manufacturing tolerances. Finally, higher hard disk drive RPM's make the mechanical "wobble" much less pronounced than with older technologies. This does not Eliminate the threat shadow data poses; enough shadow data, still exists to provide some insight into the data on a given hard drive. Today's hard disk drive technology does, however, limit the potentials of security risks tied to shadow data somewhat.

... (floppy diskettes, zip disk, mass storage devices) pose a higher level of threat, as it relates to shadow data, than computer hard disk drives. Since floppy diskettes are encoded using older encoding formats, they are more "porous" (less dense), and floppy disk heads write much less efficiently than hard disk write heads. If you want to experiment with shadow data, floppy diskettes might be a good place to start.

Modern computer forensic search tools used in computer related investigations and in computer security risk reviews will not find search terms which may exist in the form of shadow data. This is because the controllers on the drive either incapable or not set to find shadow data. This should (bring a certain level of comfort to most private sector computer users. However you should still be aware that the risk exists and that someone may be willing to pay the price to "steal" corporate and government secrets stored in the form of... (computer data, shadow data, electronic data).

Task 2. Answer the following questions:

Задание 2. Ответьте на следующие вопросы:

1. Where else can shadow data exist?

2. What layers have been sprayed on the platter of a hard disk drive?

3. Which is the preferable variant to experiment with shadow data?

4. Why is it theoretically impossible to guarantee the secure wipe of a floppy diskette, hard disk drive or tape using a software solution.

5. What equipment is required to reliably recover shadow data?

6. What should bring a certain level of comfort to most private sector computer users?

Task 3. Are the sentences given below true or false:

Задание 2. Определите истинность или ложность следующих предложений:

1. It is theoretically impossible to guarantee the secure wipe of a floppy diskette, hard disk drive or tape using a software solution.

2. Some data may still remain behind after a data scrub for discovery.

3. Specialized and very expensive equipment is not required to reliably recover shadow data.

4. Reliability of some methods and techniques produce evidence grade results from a computer forensics standpoint.

5. The use of basic data recovery tools and techniques can be compared with the tools and techniques used by US government agencies in the identification and extraction of shadow data.

6. Newer hard disk drive technologies, however, make recovery of shadow data a bit less fruitful.

7. When the paint is sprayed onto the road, some of it may seep downward into the pours asphalt that makes up the surface of the road.

Task 4. Find the English equivalents of the words given below in the text and make up sentences with them:

Задание 4. Напишите определения следующих терминов и составьте с ними предложения:

extraction, encoding, shadow data, storage devices, write heads, recovery tools.

Task 5. Complete the sentences:

Задание 5. Закончите предложения:

1. When the paint is sprayed onto the road, some of it may....

2. When another line of a different color is painted onto the road, the horizontal imperfections will also be....

3. When this analogy is compared to writes made to a hard disk drive....

4. However, multiple overwrites can increase the effectiveness of....

5..... is required to reliably recover shadow data.

6. Another factor pertains to the potentials of data....

7..... a bit less fruitful, because the drive densities require higher frequencies to write data to narrower tracks.

8... and floppy disk heads write much less efficiently than hard disk write heads.

Task 6. Make the sentences negative and interrogative:

Задание 6. Преобразуйте следующие предложения в вопросительную и отрицательную форму:

1. When the paint is sprayed onto the road, some of it may seep downward into the pours asphalt that makes up the surface of the road.

2. If we were to slice off layers of the asphalt, the original painted line, in some places, will be overlapped with the new color.

3. It is theoretically impossible to guarantee the secure wipe of a floppy diskette, hard disk drive or tape using a software solution.

4. You should be aware, however, that the recovery of shadow data is no easy task.

5. From a computer forensics standpoint, shadow data has yet to become a source of reliable computer evidence.

6. As an additional note, older encoding methods, e.g., MFM and RLL, make the recovery of shadow data a bit less difficulty.