Data Remanence

Data remanence is nothing more then the information left on a storage device once the file or other information has been deleted or moved to another location. The data in this case is classified or otherwise protected information subject to dissemination restrictions.

On DOS systems, deleting a file involves deleting the first character of an index pointing file. This indicates to the computer that the space (sectors) are again available for use. Moving a file to another location occurs in applications programs nearly every time the data is saved. This is because in most programs, the old file is deleted only after the new file is saved.

There is also a problem with unused sector space. If a new file is written to a sector previously used to store other data, the new data only overwrites the previous locations until it is fully stored. Any data taking up more space than the new file will remain on the disk, even though not available for use again.

The third problem involves computers which temporarily store data to a hard drive as part of an application program operation, or during automatic timed backup. Macintosh computers and some DOS programs exhibit this characteristic as a means of protecting work from accidental program failure.

The Remanence Threat

Threats to the hidden data can come from two sources. The first is a directed attack using special software programs that can view the contents of a disk sector by sector. One of the most common commercial programs available is the Norton Utilities. Included in the Norton package are applications that can be used to view, write to, or copy from virtually any sector or position of a storage disk.

The second form of threat requires direct access to the disk for laboratory investigations. When data is stored on a disk, a magnetic field is used to change the electromagnetic characteristics of the material in the disk. Once changed, the application of an opposite polarity field is used to again change these characteristics. Coercivity, measured in oersteds, is the property of magnetic material used as a measure of the amount of applied magnetic field (of opposite polarity) required to reduce magnetic induction to zero from its previous state.

In some cases, especially if data was left stored at a specific location on the disk for some length of time, simply re-writing new data over the old location does not fully change the electromagnetic characteristics (ones and zeros or charge and reverse charge) of the disk material. When investigated with sensitive equipment, the slight but consistent differences in charge strength makes reading the old data fairly simple. This is the primary reason for life cycle safeguards to fully destroy old disks.