Cover-up? Special investigator "cures" virus with 7-stage hard drive wipe

[Az]

http://arstechnica.com/news.ars/post/20071202-cover-up-special-investigator-cures-virus-with-7-stage-hard-drive-wipe.html

Its a few hours too late to be considered breaking news so here it is in GD.

Excerpts:

The head of the Office of Special Counsel who is currently leading an investigation into allegations against Karl Rove is taking fire over allegations that he improperly and illegally disposed of documents and files. Since this is the sort of nonsense that only makes sense if you live inside the Ultimate RDF generator (i.e., inside the Beltway), I'll take a moment and break things down.

-------------

On April 23, 2007, Scott Bloch, the head of the OSC, launched a wide investigation into the political activities of Karl Rove. Allegedly, Rove, as well as other White House aides, had violated federal law by giving partisan political presentations to government employees that explicitly encouraged them to find ways to support Republican candidates. The investigation is ongoing.

-------------

Where things get interesting from a technical standpoint is when Bloch contacted an outside company, Geeks on Call, for help with a technical issue nearly a year ago. Bloch claims that he believed his computer was infected with a virus that was corrupting or deleting his files. According to the Geeks on Call receipt, technicians visited Bloch and performed various services—including what the company refers to as a seven-level hard drive wipe.

A seven-level wipe? As you may know, simply deleting data off a drive or performing a high-level format does very little to prevent data from being recovered off the drive in question by experts. There are programs and utilities that overwrite data on the drive with random patterns, making it more difficult to recover—but not necessarily impossible.

A seven-level wipe program (such as the one used on Bloch's system) would overwrite an entire hard drive with randomized ones and zeros, but would go through the entire process seven times, thus theoretically eliminating any hope of restoring the original data. Paying for such a procedure doesn't exactly jive with virus removal, and the Washington Post states that Bloch also scrubbed the laptops of two of his aides in a similar fashion.

-------------
End of Excerpts


You don't do a seven level wipe unless you are trying to utterly destroy some data that you don't want a techie to find. A single pass format is enough to obliterate any virus. Period. From a functionality stand point nothing survives a format. Any action taken after that is to destroy forensic evidence.

Something fishy here.

[caligirl]

1. coveri ng for crimes by the administration isn't new, but Bloch should be disbarred and jailed.

[L. Coyote]

19. Scott Bloch, WH Special Counsel Says He Won't Provide Files to WH OPM. Showdown time!

From: Scott Bloch, WH Special Counsel Says He Won't Provide Files to WH OPM. Showdown time!
Fri Nov-30-07 = http://www.democraticunderground.com/discuss/duboard.php?az=view_all&address=389x2378221

A couple of Bush cowboys are facing off in the not-so-O.K. Corral.
One is armed with a flash drive of secret files on his key chain.
The other is reputed to have a fishing reel in hand....
Where's the boss of this gang of crooks anyway? Who's in charge?

It's a real case of the bad guys facing off against the bad guys :rofl:

================================================
U.S. Special Counsel Says He Won't Provide Files
Official Calls Personal Records Not Relevant to OPM Probe
By Elizabeth Williamson - Staff Writer - Nov 30, 2007; Page A03
http://www.washingtonpost.com/wp-dyn/content/article/2007/11/29/AR2007112902401.html?nav=rss_politics


A U.S. official overseeing a probe of potential White House misconduct declared through a spokesman yesterday that he will not give federal investigators copies of personal files that he deleted from his office computer.

The decision by Special Counsel Scott J. Bloch escalates the confrontation between the Bush appointee and the White House, each of which is investigating the other.

Bloch's office is tasked with upholding laws against whistle-blower retaliation and partisan politicking in federal agencies. Earlier this year, Bloch directed lawyers in his office to look into charges that former Bush adviser Karl Rove inappropriately deployed government employees in Republican political campaigns.

Bloch had previously been targeted by the White House, which in 2005 asked the Office of Personnel Management (OPM) to investigate allegations that Bloch had retaliated against whistle-blowers among his own staff members and improperly dismissed whistle-blower cases brought to the agency by others.

Bloch said in a written statement that the personal computer records requested by the OPM are not relevant to its investigation, which he earlier called a "fishing expedition."

...........

[aquart]

2. I believe you.

[The_Casual_Observer]

3. Since you are destroying evidence anyway, wouldn't it be cheaper

to simply hit the drive with a hammer & then throw it away & replace it with a new one?

[Cronus Protagonist]

6. That could be recovered

Blunt instrument trauma is not enough to remove data from hard drives. If they unscrewed the drives, removed the casing, and hammered the platters with a hammer, there would still be recoverable data. They would have to remove the spindle, take the platters off and grind the platters to make it unrecoverable with physical force.

[The_Casual_Observer]

9. How about an oven @ cleaner setting for an hour or two?

No hammer needed.

[Az]

13. Not sure that would do it

Hard drives are built to survive some pretty extreme environments. And when a techie goes at the drive to reconstruct the data they are using an electron microscope. So if there is anything left of it then they are likely to be able to rebuild it. Multiple wipes tends to be the only way to assure any degree of destruction short of obliteration.

[tridim]

15. Big magnets work too.

Nothing is more destructive than to aligning all the bits to 0. I'm surprised the WH didn't go that route..

I guess it'd leave more of a paper trail with receipts to "Bob's Big-Ass Magnetic Erasing Service" and all that.

[Az]

23. Even a magnet won't do it in one pass

It needs to be a large electric magnet left on it for a prolonged period of time.

The most efficient and sure way of destroying data is a multi pass format and erasure of the drive.

[Cronus Protagonist]

Maybe hydrochloric acid for a week might do it

You would need to dissolve all the iron for that to work.

[Union Thug]

4. well, drawing from my tech support days... most viruses don't require a format/reinstall..

The eight years that have passed since I was on the phones may have dated me in this regards, but I never walked a customer through a reinstall because of a virus. Between file deletion and regedit, you were good.

[Cronus Protagonist]

5. I don't think fish smell like so much shit, but there is something rotten in Denmark

A 7-stage wipe is never needed in virus removal. I've been in the business since the first personal computer and before. A 7-stage wipe is the preferred way to wipe a hard drive clean of forensically recoverable data. Period. This is the equivalent of using a paper shredder on paper documents that turns the paper into pure dust, in order to clean off a coffee stain. This is the smoking gun. A crime was committed and covered up, that's clear. What was the crime, who was involved, what happened, when did it happen and who knew about it? (oh dear, there I go acting like a journalist in a world breft of such)

[tridim]

10. "A crime was committed and covered up"

Got any admissable proof?

We all know these guys are covering up massive crimes, but the courts still need proof. I admit I have no idea if a wiped hard drive is evidence of anything except an empty hard drive.

[Prophet 451]

22. Maybe

A 7-level wipe is proof that the techie was asked to make sure something couldn't be retrieved. No techie would ever do a 7-level wipe for simple virus removal (and I work in IT) and a non-techie wouldn't know how to do on.

It's fairly simple. If the techie was asked to remove a virus, he'd do a single pass format (at most). The only reason to do a level 7 wipe is to ensure that something can't be recovered although even that's not certain (the NSA classifies "unretrievable" at 12 passes although it's mathemtically possible to recover data at up to 26 passes). When you have a service performed for which there is NO other purpose than concealment, you have to ask questions about what the user is trying to conceal.

[Cronus Protagonist]

32. IT's a smoking gun

Surely you will concede that. And smoking guns point to something, usually a crime, particularly when the smoking gun is part of a clear cover up during a criminal investigation. It's not rocket science.

[tridim]

36. Of course it's a massive smoking gun.. That's clear to all of us.

I don't need any more evidence of their criminality, but the courts do. I doubt the IT guy was informed why he was wiping the HD's.

If they can't recover the data, then what? It's like physical evidence that was incinerated, it's just gone.

[Prophet 451]

37. But the ashes

The ashes are evidence that something was incinerated.

[L. Coyote]

42. Scott Bloch knows what it was!

[immoderate]

46. It's evidence that documents were destroyed.

Can't cite the statute, but destroying records is illegal. This could apply here. It's a government computer. Why wouldn't he call IT department for the services he claims he needed?

--IMM

[tridim]

49. I understand that, but can it be proven that there was anything of interest..

on the drives in the first place? We can't just say, I think these drives used to have Rove's email on them. Even if we could, there's nothing to prove that the emails were criminal.

I really hate to be playing devil's advocate here, but I've watched how the courts work when it comes to BushCo crimes. Evidence needs to be air (bit) tight, like the Rove emails Palast has.

[Prophet 451]

50. No, but we can ask what he was trying to hide n/t

[tridim]

51. "I don't recall what was on those hard drives"

It's just that easy!

[Prophet 451]

52. Damn, you got me n/t

[lpbk2713]

7. If you have a stain on your carpet at home, burn the house down and rebuild.

Same logic comes in to play here. But then, when did logic ever apply to rethuglicans? This is so transparent it's not even funny.

[galileo3000]

8. 7-stage wipe? Seven?

That seems to be extremely excessive even for covering tracks.

[Prophet 451]

24. It might not be enough

The NSA claims it can recover data after up to 12 passes and it's mathematically possible at up to 25 (although no-one's ever managed it in practice).

[ThomWV]

11. Hard drives are dirt cheap and take 5 minutes to replace - why not drop the old one in the Potomic?

7-stage wipe my ass.

[Mnemosyne]

14. Serial numbers? n/t

[Prophet 451]

26. You assume he knew how

End users often have little idea how PCs work. Would he have known how to remove and replace the HDD, buy a new one (IDE or SATA or SCUSI? RAID? UDMA? Multi-platter or single-platter?) and then re-install his OS (and whatever additional software he was using)? I doubt it, plus doing so would mean having to pay for a new HDD, which would entail a receipt on a credit card (for example).

[Javaman]

30. Or just microwave it. nt

[TahitiNut]

35. "7-stage wipe my ass"???

Well, I only use a three-stage wipe on my ass ... but YMMV. :evilgrin:

[Manifestor_of_Light]

40. ---INSERT Larry Craig joke HERE----

Randi had lots of fun with the phrase "seven level wipe" on her show last week.

[immoderate]

47. Got me!

:spray: :rofl:

--IMM

[Odin2005]

12. Definetly something fishy.

SEVEN full-blown reformats of the hard-drive? That's definitely excessive for getting rid of a virus. I'm generally quite skeptical of such conspiracy claims on DU because of the usual "twoofer" craziness, but this just stinks to high heaven!

[flashl]

16. Only non-techs would believe that story. n/t

[Cronus Protagonist]

33. Maybe that's all they need

After all, most of the population thinks there is a being living in the clouds that can hear you think...

[flashl]

48. Denial is all they need. They never let facts get in their way. n/t

[flvegan]

17. Why would anyone with confidential data (like Roves) go to an outside third party tech source?

Geeks on Call doesn't sound like anyone with a govt contract to perform IT/data services.

Why wasn't someone internal used?

There's your smoking gun.

[Akoto]

18. Seven times is definitely excessive.

If I understand correctly, they overwrote the free space. That is not, in itself, an illegal act. As you delete something, the area it occupies on the hard drive becomes 'free' space. Later, stuff that you download or install fills that 'free' space and overwrites what was previously there. So, overwriting happens naturally in the life of a hard drive. It's the bane of many computer users who delete things they later want to recover, but can't. :)

Deliberately washing your free space is wise if you're doing something like selling your PC with the hard drive, because somebody can easily recover your deleted info at home with programs. In this case, however, it's possible (and likely, knowing Rove) that it was used to cover up questionable data. May be outright illegal if the law forbids them to conduct this procedure on computers used for government business. I don't know enough about that to say.

Seven times would leave almost no trace of information. I'm not an expert in this area, but I think you could picture your hard drive like this ...

1 1 1 0 1 1 0

0 1 0 0 1 0 1

1 1 0 1 0 1 1

The above represents how data looks. If you did one overwrite pass, that would be sufficient for most users unless you were holding really secure stuff. The Department of Defense standard is three passes. After you did a wipe, it'd be more like this ...

0 0 0 0 0 0 0

0 0 0 0 0 0 0

0 0 0 0 0 0 0

In other words, lots of nothing. A frequently used computer does not look like this, so unless the hard drive is brand new with nothing on it, it's pretty obvious that it has been washed. Each pass finds more and more refuse data, and makes it that much harder to recover. It comes down to who's looking and what tools they have.

If they were using an algorithm that randomly overwrote the free space, instead of overwriting it with zeroes, I'd call that even more suspicious. As I understand it from reading, that would make it appear as though there's data present, but it's really just gibberish. So, maybe trying to hide that they did it?

Seven times wouldn't just delete a virus in your free space. It would take plenty of other stuff with it. Theoretically, it could still be recovered, but it would be extremely difficult for anyone to do after a point.

[IDemo]

20. There are a brazillion freeware/shareware programs available

to perform a secure disk wipe, including up to DOD standards. Geeks on Call? :argh:

[Prophet 451]

27. He probably wouldn't have known how

Freeware/shareware would probably have taxed what he knew about computers.

[defendandprotect]

21. and then there's the van which visits Cheney's house every week --- ???

to shred documents ---

I guess it's too much to hope for that one of these information destroying services might
scoop up and save some of this stuff---??

Nah, never happen ---

[in_cog_ni_to]

25. That 7 stage "wipe" can be reversed, right?

:) Is the hard drive still there? Or did they fly it to Iraq and have it blown to bits by one of the Blackwater thugs?

[Prophet 451]

28. In theory, yes; in practice, no

According to mathematical theory, data can be recovered after up to 26 passes but no-one's ever been able to do so in practice. The NSA uses 12 passes, the DOD uses three.

[in_cog_ni_to]

29. Ah...is the hard drive still there? Do we know? This could be GOOD. n/t

[Prophet 451]

38. Well, I presume it must be

Otherwise, we wouldn't even know that a wipe had been done.

[Rex]

31. Low level format. Oopsie, nothing to cover up here.

Wow. Bye bye evidence. They probably ran a magnet over it afterward, just in case. Then peed on it and hit it with a sledge hammer - all in honest codes of the law to prevent breakage or such. :eyes:

[slackmaster]

34. I take the platters out and dissolve the recording media off with hydrochloric acid

That's a clean wipe.

[Prophet 451]

39. You win

That is the most through wipe I have ever heard of.

[slackmaster]

41. Yes, short of something involving extreme heat, explosives, or firearms

All of which I have used as well. The acid wipe makes the least noise and mess.

[Prophet 451]

45. I like the explosives idea

The idea of detonating my hdd is somehow satisfying: "BAD CLUSTER THIS!" BOOM

[Rex]

44. Dam, now that IS a clean wipe!

Just leave it in the acid, make them work for it!

[DadOf2LittleAngels]

43. They should have hired someone who knows what they are doing

"A seven-level wipe program (such as the one used on Bloch's system) would overwrite an entire hard drive with randomized ones and zeros, but would go through the entire process seven times, thus theoretically eliminating any hope of restoring the original data."

Thats not really true anymore I believe the last safe standard for data deletion was in the mid 30's. Seven times is generally what they tell people selling their computer as 99.9% of the world does not have access to the kind of equipment needed to recover the data but it is recoverable.

[blogslut]

53. Actually, the folks investigating Bloch don't want his hard drive

They want his pen drive. According to Bloch, he had the hard drive of his personal laptop wiped. According to Bloch there were absolutely, positively no DOJ files on his personal laptop. Before he had the Geek on Call tech perform the 7-level wipe, he had them put his personal files on a thumb drive.

Sounds reasonable, except when it comes to explaining why Bloch also ordered the Geeks on Call tech to wipe that hard drives of the computers belonging to his two assistants. Is Mr. Bloch trying to say that he and his assistants all contracted the same computer virus on machines, containing positively no DOJ-related data?

Hmmm?