Forensic Evaluation of Gutmann and DoD Secure Data Deletion Algorithms

With the widespread availability of data erasure tools, criminals can effortlessly erase evidence. As a result, data remnants become more difficult to retrieve and event reconstructing is more challenging. This study analyzed the extent of data remnants resulting from secure deletion on a solid-state drive and a thumb drive. Two data erasure tools were used, namely Eraser and WipeFile, as a case study. Accuracy was applied as the evaluation metric. The methodology started with dataset preparation and acquisition, followed by data analysis and evaluation. Accuracy evaluation was based on seven file attributes: file name, modified time, changed time, accessed time, created time, file size, and file format. From the finding, both Eraser and WipeFile showed different data remnant accuracy patterns. For example, Eraser yielded the lowest level of data remnants when using the Gutmann algorithm. However, WipeFile with the Gutmann algorithm recovered more data remnants than WipeFile with the US Department of Defense (DoD) 5220.22-M algorithm. It was observed that five attributes were recovered with accuracy rates ranging from 9.33% to 37.33% via WipeFile with the Gutmann algorithm, while only three attributes were recovered, each with 48.67% accuracy, via WipeFile with the DoD 5220.22-M algorithm. The result indicates that the selection of the erasure tool and algorithm impacts the accuracy rate of data deletion. Overall, this study can give insights into data remnants, which helps forensic examiners keep ahead of tech-savvy criminals.