Posted 8/26/2009 10:47 am
Get truecrypt. Make a truecrypt encrypted file. Name it something like an accounting file. Alway mount it manually. Save everything to it.
I WILL search the entire drive for jpg files over 50k.
I WILL use an administrator account to access other users personal data.
I WILL investigate any folder with interesting images.
I WILL copy them to a thumb drive.
I WILL post good photos on 4chan.
I WILL use a Web Form password recovery tool to access your FaceBook, MySpace and other web pages.
Don't forget to run a good utility which scans the entire drive including deleted areas for jpegs.
Don't forget to dump all the thumbs from Thumbs.db :)
I remember setting up a system for a (extremely paranoid) friend of mine - it had the entire disk except for the boot track encrypted so you had to type in a (long) passphrase every time you booted it.
It also had modifed HDD firmware that responded to the standard ATA or ATAPI "Identify unit" comment (0xEC/0xA1, IIRC) by returning reasonable looking data, but setting a flag that resulted in all subsequent reads returning all zeros - with the real identify command mapped to some other normally unused value. Making the system work was real fun, since _everthing_ that hit the drive from the BIOS upwards had to be patched to use the new value.
Once it was all patched, the drive firmware was further modified so that when the flag was set it also triggered the same processing that the SECURITY:ERASE_UNIT command carried out. I hope nobody ever tried to use it in some other machine, since it would have been extremely frustrating...
I had given away my daughter's computer to some people taht worked at my neighbor's store. But I forgot that I had a keylogger in there to monitor my daughter's chats and emails.
So I kept getting email reports of thei activities. It was funny as sh-t. The husband apparently loved the "Black on Blonde" pron sites and the wife was trying to hook up with some dude I'm guessing she met on Facebook.
I remember setting up a system for a (extremely paranoid) friend of mine - it had the entire disk except for the boot track encrypted so you had to type in a (long) passphrase every time you booted it.
It also had modifed HDD firmware that responded to the standard ATA or ATAPI "Identify unit" comment (0xEC/0xA1, IIRC) by returning reasonable looking data, but setting a flag that resulted in all subsequent reads returning all zeros - with the real identify command mapped to some other normally unused value. Making the system work was real fun, since _everthing_ that hit the drive from the BIOS upwards had to be patched to use the new value.
Once it was all patched, the drive firmware was further modified so that when the flag was set it also triggered the same processing that the SECURITY:ERASE_UNIT command carried out. I hope nobody ever tried to use it in some other machine, since it would have been extremely frustrating...