1

If a user on normal everyday-use computer wiped the unallocated space on a hard disk drive, how long would it take before analysis of the unallocated space would yield no evidence of a disk wipe? Lets say that there is 100 MB of disk writes per day on a 1 TB drive with 100GB used space (900GB unallocated). Is it simply (unallocated size) / (writes per day) or is there another variable at play here?

another_stack_user999
  • 29
  • 4
  • 1
    That is way too broad, because there are way too many variables. HDD? SSD? How big? What is "average usage"? Am I an average user? Is my dad an average user? This question is unanswerable. –  Nov 01 '19 at 15:47
  • @MechMK1 Lets say you're the average user – another_stack_user999 Nov 01 '19 at 15:49
  • 1
    This will vary wildly based on the methods, tools, and knowledge of the forensic examiner. Also, "average use" is meaningless because usage patterns will be an important factor. The specific details are essential and cannot be handwaved away. – DoubleD Nov 01 '19 at 16:46
  • @another_stack_user999 The problem is that my usage patterns may or may not be "average". What if I play a lot of videogames, and I often download new games? What if I am into photography and often copy a lot of pictures to my PC? There is no "average" use, and as DoubleD described, this question has *way* too many variables. –  Nov 01 '19 at 16:53
  • 2
    The answer is: extremely long. It certainly is not (unallocated size) / (writes per day). Operating systems reclaim space that is released by other applications Some form of write-distribution may be in place for f.e. SSD, but even then, there are chances that certain sectors are not used for a long time. – Ljm Dullaart Nov 02 '19 at 09:37

0 Answers0