Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Federal Charges Against Stanford University Researcher Expanded

justice.gov

Post reply on HN
Print view View original

21–30 of 97 posts

Re: Federal Charges Against Stanford University Researcher Expanded

#21

Post by astrange »

bsder wrote: post #9
lopatin wrote: post #4

Earlier quoted context omitted.

Follow up question, as someone who knows even less about forensics, what kind of traces stay on a hard drive if you just delete a file?

A lot. You need to write a drive with zeros(minimum)/random data(preferably) at least once to make forensic recovery difficult. I know all about the "5 times" rule, but I've never heard of anyone recovering a drive after even a single overwrite. Personally, I just hammer a screwdriver through the platter. It generally converts it into glass shards--the drive sounds like a maraca afterward. Flash, of course, is differ…

> Flash, of course, is different. I suspect that writing zeros/random once is probably enough.

SSDs won't necessarily actually erase a block when you tell them to, due to wear-leveling and weird internal RAID setups they could be doing anything in there.

Re: Federal Charges Against Stanford University Researcher Expanded

#22

Post by desine »

astrange wrote: post #18
desine wrote: post #13

Earlier quoted context omitted.

The file is still there. A regular delete just tells the disk that the segments of memory are available to be overwritten. Zeroing out (or /dev/urandom) the memory is an option, but even that is not 100% safe, especially when it comes to forensic labs with the ability to read and analyze platters removed from a complete, sealed disk. Really safe deleters will overwrite the segments of memory multiple times to scrambl…

> but even that is not 100% safe, especially when it comes to forensic labs with the ability to read and analyze platters removed from a complete, sealed disk. No, this is completely impossible and noone has ever done it. (An exception would be HDDs with bad block mapping because they might not actually erase some sector.) SSDs don't even have platters and you could probably recover things from the flash, but you can…

>No, this is completely impossible and noone has ever done it.

Pedantic devil's advocate - nobody has claimed to do it. When dealing with international espionage and possibly the DoD or DHS examining the drive, I wouldn't bet on that assumption.

Re: Federal Charges Against Stanford University Researcher Expanded

#23

Post by nradov »

Jtsummers wrote: post #16
crb002 wrote: post #11

Seems a bit racist. Israel/Finland/Germany all have universal conscription so they don't get harassed like the Chinese.

As I understand it, the issue is the false claims in the visa application more than the military service. If they'd known she was an (apparently) active member of the Chinese military, she wouldn't have gotten the visa in the first place. In her visa application she admitted to prior military service and still received the visa so military service itself is not a fundamental blocker for Chinese visa applicants.

This is one reason why US visa application forms include a question which basically asks "Are you a spy?". Which might seem silly because obviously a real spy would never answer yes. But the real point of the question is that if the government finds later that someone lied on the form it becomes easier to charge them with a crime or deport them.

Edit: some of you take comments way too literally so for your benefit here is the exact question on form DS-160.

"Do you seek to engage in espionage, sabotage, export control violations, or any other illegal activity while in the United States?"

Re: Federal Charges Against Stanford University Researcher Expanded

#24

Post by [deleted] »

desine wrote: post #15
bsder wrote: post #9

Earlier quoted context omitted.

A lot. You need to write a drive with zeros(minimum)/random data(preferably) at least once to make forensic recovery difficult. I know all about the "5 times" rule, but I've never heard of anyone recovering a drive after even a single overwrite. Personally, I just hammer a screwdriver through the platter. It generally converts it into glass shards--the drive sounds like a maraca afterward. Flash, of course, is differ…

I have a few HDs with bullet holes in them, and the platters are still intact. I've messed around with a lot of drives and never shattered a disk like glass. I've heard that there's labs that specialize in reading disks without even needing to spin them, but information seems to be tightly guarded about the processes.

[deleted]

Re: Federal Charges Against Stanford University Researcher Expanded

#25

Post by finiteseries »

crb002 wrote: post #11

Seems a bit racist. Israel/Finland/Germany all have universal conscription so they don't get harassed like the Chinese.

The relationship between the United States and Israeli, Finnish, and German militaries is slightly different to the one with the Chinese.

Re: Federal Charges Against Stanford University Researcher Expanded

#26

Post by astrange »

desine wrote: post #22
astrange wrote: post #18

Earlier quoted context omitted.

> but even that is not 100% safe, especially when it comes to forensic labs with the ability to read and analyze platters removed from a complete, sealed disk. No, this is completely impossible and noone has ever done it. (An exception would be HDDs with bad block mapping because they might not actually erase some sector.) SSDs don't even have platters and you could probably recover things from the flash, but you can…

>No, this is completely impossible and noone has ever done it. Pedantic devil's advocate - nobody has claimed to do it. When dealing with international espionage and possibly the DoD or DHS examining the drive, I wouldn't bet on that assumption.

We do know that stuff too, there were HD firmware implants and such in the Snowden leaks and there wasn't anything about recovering things from a zeroed hard drive.

I believe the government outsources to the same data recovery firms as everyone else; they can get things off drives with dead electronics or platters that haven't actually been erased, but that's it.

Re: Federal Charges Against Stanford University Researcher Expanded

#27

Post by president »

For every one of these cases, there are likely tons more that have gone undetected. Our open institutions don't work in a world filled with rich nation states with bad intentions and a populace and politicians totally misinformed about the current threat and/or unwilling to do anything about it. China has bested the US and we should at least be honest about it.

Re: Federal Charges Against Stanford University Researcher Expanded

#28

Post by thaumasiotes »

nradov wrote: post #23
Jtsummers wrote: post #16

Earlier quoted context omitted.

As I understand it, the issue is the false claims in the visa application more than the military service. If they'd known she was an (apparently) active member of the Chinese military, she wouldn't have gotten the visa in the first place. In her visa application she admitted to prior military service and still received the visa so military service itself is not a fundamental blocker for Chinese visa applicants.

This is one reason why US visa application forms include a question which basically asks "Are you a spy?". Which might seem silly because obviously a real spy would never answer yes. But the real point of the question is that if the government finds later that someone lied on the form it becomes easier to charge them with a crime or deport them. Edit: some of you take comments way too literally so for your benefit he…

The system described sounds like a terrible idea. In order to prove someone lied on the form when they said "No" to "Are you a spy?", you have to prove they're a spy. At that point, you're free to deport them; the form is irrelevant.
Post reply on HN