Keylogger

[Xen]

Ralf Mardorf schreef op 03-12-2017 8:01:
> On Sun, 3 Dec 2017 08:49:22 +0900, Joel Rees wrote:
>> hardware itself tends to have the ability to move sectors, segments,
>> etc., for a variety of reasons without notification
> 
> I didn't verify if this is true, but it seems to be plausible enough to
> me, to believe that a HDD's integrated software does this for good
> reasons. I guess apart from Windows users nobody of us ever runs
> software to defragment a HDD, I suspect that it has to do with the file
> system we are using in combination with HDD firmware. While recovering
> overwritten data might be impossible or at least isn't worth the
> effort, I guess that there are indeed copies of data on a HDD
> available, that are easily to read, without time and cost intensive
> methods.

This is correct. It could be that software saves a different copy of a 
file before deleting the old.

This would leave all kinds of copies scattered across empty space.

For this reason the "sfill" program from the secure-delete package 
exists.

Sfill just creates a big, zero-filled file and then wipes it again.