Federal Charges Against Stanford University Researcher Expanded
1–10 of 97 posts
Re: Federal Charges Against Stanford University Researcher Expanded
#2Grand Jury Adds Obstruction, Alteration of Records, and False Statements to Visa Fraud Charges Against Visiting Researcher Alleged to Be Member of China’s People’s Liberation Army
Re: Federal Charges Against Stanford University Researcher Expanded
#3The superseding indictment alleges that she then attempted to delete a digital folder of documents on an external hard drive that she possessed containing records relating to her military service and visa fraud, including:
- A digital version of a letter from Song, written in Chinese and addressed to the People’s Republic of China consulate in New York, in which Song explained that her stated employer, “Beijing Xi Diaoyutai Hospital” was a false front, and that because relevant approval documents were classified, she had attempted to mail them;
- An image of Song’s PLA credentials, with a photograph of her in military dress uniform, covering the time period from July 2016 to July 2020; and
- A digital version of a resume for Song, written in Chinese, again with a photograph of her in military dress uniform and listing her employer as the Air Force General Hospital.
Yikes, that sounds pretty damning. I’m not an expert in digital forensics but I wonder why she wouldn’t destroy the hard drive after. Or is that not enough?
Re: Federal Charges Against Stanford University Researcher Expanded
#4The superseding indictment alleges that she then attempted to delete a digital folder of documents on an external hard drive that she possessed containing records relating to her military service and visa fraud, including: - A digital version of a letter from Song, written in Chinese and addressed to the People’s Republic of China consulate in New York, in which Song explained that her stated employer, “Beijing Xi Di…
Follow up question, as someone who knows even less about forensics, what kind of traces stay on a hard drive if you just delete a file?
Re: Federal Charges Against Stanford University Researcher Expanded
#5How widespread are cases like this? I'm not an expert on this topic but from reading this it feels like such an investigation is expensive and time consuming. I imagine for every person identified there must be many more whose secret affiliations with the foreign powers won't be uncovered.
Re: Federal Charges Against Stanford University Researcher Expanded
#6Was she out of her mind keeping this kind of stuff? Can't believe the stupidity.
Re: Federal Charges Against Stanford University Researcher Expanded
#7The superseding indictment alleges that she then attempted to delete a digital folder of documents on an external hard drive that she possessed containing records relating to her military service and visa fraud, including: - A digital version of a letter from Song, written in Chinese and addressed to the People’s Republic of China consulate in New York, in which Song explained that her stated employer, “Beijing Xi Di…
Follow up question, as someone who knows even less about forensics, what kind of traces stay on a hard drive if you just delete a file?
Generally when you just delete a file, its contents are marked as "unused", but not actually erased. This is why deleting a large file takes the same time as deleting a small file. Then, whenever a new file is created, it might be put (partially) on top of the old file, overwriting the old contents for good.
Re: Federal Charges Against Stanford University Researcher Expanded
#8The superseding indictment alleges that she then attempted to delete a digital folder of documents on an external hard drive that she possessed containing records relating to her military service and visa fraud, including: - A digital version of a letter from Song, written in Chinese and addressed to the People’s Republic of China consulate in New York, in which Song explained that her stated employer, “Beijing Xi Di…
Follow up question, as someone who knows even less about forensics, what kind of traces stay on a hard drive if you just delete a file?
the whole file is still there until it gets overwritten by new data
Re: Federal Charges Against Stanford University Researcher Expanded
#9The superseding indictment alleges that she then attempted to delete a digital folder of documents on an external hard drive that she possessed containing records relating to her military service and visa fraud, including: - A digital version of a letter from Song, written in Chinese and addressed to the People’s Republic of China consulate in New York, in which Song explained that her stated employer, “Beijing Xi Di…
Follow up question, as someone who knows even less about forensics, what kind of traces stay on a hard drive if you just delete a file?
A lot.
You need to write a drive with zeros(minimum)/random data(preferably) at least once to make forensic recovery difficult. I know all about the "5 times" rule, but I've never heard of anyone recovering a drive after even a single overwrite.
Personally, I just hammer a screwdriver through the platter. It generally converts it into glass shards--the drive sounds like a maraca afterward.
Flash, of course, is different. I suspect that writing zeros/random once is probably enough. However, I tend to just use diagonal cutters and slice through the chips.
If someone wants to reconstruct my drive after I've physically destroyed it, they've probably got enough money to just fabricate the evidence against me anyway.
Re: Federal Charges Against Stanford University Researcher Expanded
#10The superseding indictment alleges that she then attempted to delete a digital folder of documents on an external hard drive that she possessed containing records relating to her military service and visa fraud, including: - A digital version of a letter from Song, written in Chinese and addressed to the People’s Republic of China consulate in New York, in which Song explained that her stated employer, “Beijing Xi Di…
Follow up question, as someone who knows even less about forensics, what kind of traces stay on a hard drive if you just delete a file?
https://en.wikipedia.org/wiki/Data_remanence
That link has a bit more, but the main issue is what the others wrote. Deleting a file from your disk may not actually delete it. It can leave an entry in the file system that marks it as deleted (for undeletion later) or it may just remove the entry, in which case the data is still on the disk and recoverable.