Ghosts

    Ghosts are real at least in computer hard drives. "Ghosts", residual traces of data that was over written by other data, result from a simple law of physics: opposite electrical charges attract like charges repel. The hard drive on a computer stores information as binary data either as a one (translated to the magnetic hard drive media as a "+" charge) or as a zero (translated as a "-" charge) . When a positive charge is written next to a negative charge the width of that band is greater than if it had been written next to another positive band (opposites attract). Using this fact computer forensic specialists can reconstruct data on a drive even after it has been over written. This has obvious security implications.

    The simplified illustration below demonstrates how this could be done.

    This example starts off (for simplicity) looking at a section of the HD with a seven digit NULL value (ie no information written here). Blue colored squares will be used to represent zero values and Red squares will be used to represent one Values

    A user saves a document containing the letter capital U. The computer translates the letter capital U to a numeric code whose base ten value is 85 [ASCII value] This is eventually translated to a <base two (binary) value 1010101> and saved to either a hard drive or floppy disk.

    Assumptions:

    • The binary value is assumed to be surrounded by zeros on either end [grey areas].
    • Every five squares make up one binary digit [either a one or zero]
    • The width of each binary digit is three squares with each attraction adding one square, thus a one surrounded by zeros on either side would be five squares wide [opposites attract] while a one with ones on either side would be only three squares wide
    • The binary digits are being written from left to right

    Position ....................0...............1...............2.............. 3...............4................5...............6..............7...............8

    NULL (0000000)

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

    The original space contains all zeros. In place of this we are going to write 1010101 [binary for the letter U]

    The value being written to position 1 is a one this occupies the middle three sections (see below)

    U = 1010101

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

    Because the value of position 0 is zero the band is wider in the direction of position 0 [opposites attract] (see below)

    U = 1010101

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

    Because the value of position 2 is also zero the band is wider in the direction of position 2 hence position 1 is five squares wide (below)

    U = 1010101

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

    Similarly zero being written in the second position is adjacent to a one on the left so it is wider in this direction and is repelled by the zero in position 3

    U = 1010101

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

    Following this same logic position 3 yields the diagram below

    U = 1010101< /td>

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

    Similarly the remainder of the positions would be filled in

    U = 1010101

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

    Similarly given such data we can work backwards to reveal the data previously written beneath it.







    security.tao.ca index.



maintained by securitysite at tao dot ca
Comments and additions always welcome, our feedack form.