A statistical method for detecting on-disk wiped areas

Data-wiping tools are meant to securely erase data. Malicious users may resort to such tools to eliminate traces of a crime they have committed. State-of-the-art wiping detection techniques rely on artifacts left by the use of such tools. However, in certain cases such artifacts can be obfuscated and the investigator is left with almost no clues that could point to a digital crime. Indeed, in this paper we would like to present a scenario involving an ideal data-wiping case (i.e. a method that does not leave any usual exploitable artifacts). In addition, we demonstrate an efficient statistical technique which allows the detection of on-disk wiped areas, both filled with random and periodic data. The performance and usability of the proposed techniques are discussed as well.

► We present a general methodology to delete information without leaving any tangible artifacts. ► The study presents a linear binary classifier which discriminates between random wiped and standard data fragments. ► We illustrate a statistical method based on Discrete Fourier Transform (DFT), which recognizes wiped areas filled with periodic data.