Abstracts - 2006
The Drives Project: New Directions in Complete Delete and Computer Forensics
Simson L. Garfinkel
In 2005 more than 210 million hard drives were retired from primary service. Although many of these drives were destroyed, many are repurposed within organizations, donated to charities, or sold on the secondary market.
We are purchasing a statistically-significant quantity of used hard drives on the secondary market and analyzing the content of these drives. Many of the drives contain remnant information from their previous users --- in many cases no effort whatsoever has been made to purge this data from the drives. To date we have purchased more than 1000 hard drives on the secondary market and have created a unique resource with more than a terabyte of compressed disk images.
We have used this unique resource for a variety of purposes:
As part of developing this resource, we have developed a new file format for storing disk images, and we are developing a new technique for mapping social networks among individuals whose data is on captured hard drives. These approaches could be used, for example, to allow the rapid and automated analysis of disk drives seized during the course of a police investigation or obtained as part of military operations.
 S. Garfinkel. and A. Shelat. "Remembrance of Data Passed: A Study of Disk Sanitization Practices," IEEE Security and Privacy, January/February 2003.
 US Congress. Fair and Accurate Credit Transactions Act of 2003
 Seagate Technology. Momentus Family Overview, 2006.
 Decru. DataFort Security Appliances, 2005.
 S. Garfinkel. "Design Principles and Patterns for Computer Systems that are Simultaneously Secure and Usable," PhD Thesis, Massachusetts Institute of Technology, June 2005.
S. Garfinkel. "AFF: A New Format for Storing Hard Drive Iamges," Communications of the ACM, February, 2006.
S. Garfinkel and D. Malan and K. Dubec and C. Stevens and C. Pham. "Disk Imaging with the Advanced Forensics Format, Library and Tools," The Second Annual IFIP WG 11.9 International Conference on Digital Forensics, National Center for Forensic Science, Orlando, Florida, USA January 29 - February 1 2006.