Chicago pediatrician arrested with child porn, knockout drugs, officials say

KCAL ^ | October 27, 2003 | Mike Robinson, AP

[wheelgunguru]

Sophisticated pervert, ain't he?

Yea, but how'd they recover 200,000 erased images if the doc had Evidence Eliminator?

How can they recover erased images, anyway? If it's erased and defragged, I mean.

[Dog Gone]

It's not clear whether they recovered the images or simply know that 200,000 more existed. Clearly, not all the evidence was eliminated.

[wheelgunguru]

It's not clear whether they recovered the images

I read it again. You're right. Still, how would they know there were 200,000 images?

[rmlew]

Take shotgun, load with birdshot, insert where sun don't shine on DR, shoot.
He should die of internal bleeding within a very painful hour.

[mvpel]

In DOS/Windows systems, when a file is erased the only write to the disk marking the file as deleted in the index, and clearing the bitmap bits indicating which disk clusters are in use by that file. The data on the disk drive is left as-is.

There is software available to reconstruct deleted files by looking for "unallocated" blocks containing file-content data and following the links within each of those blocks to reconstruct the file.

Those unused blocks don't get overwritten unless you use special software to do it, presumably the purpose of "Evidence Eliminator," or create files that fill up the unallocated blocks that used to belong to the deleted files.

[wheelgunguru]

Those unused blocks don't get overwritten unless you use special software to do it

I had no idea. A tech friend of mine, advising me how to get rid of credit card numbers on a hard drive (before dropping the computer off for servicing), said to simply erase, and defrag. Twice.

I understood defragging moved existing files into the spaces formerly occupied by deleted files. Was I wrong?

[Dimensio]

The laptop also contained software called "Evidence Eliminator,'' used to erase images from computers, prosecutors said.

No wonder he got caught. Evidence Eliminator is notorious spyware/malware. It's a shame to know that at least one person was suckered into buying that trash from the criminals that sell it, but it does give me an idea as to the type of people who get suckered into shelling out for it.

[NotJustAnotherPrettyFace]

Interesting - thanks for educating us non-techno-geeks.

[Dimensio]

Yea, but how'd they recover 200,000 erased images if the doc had Evidence Eliminator?

Simple. Evidence Eliminator is a fraudulent product sold by criminals.

How can they recover erased images, anyway? If it's erased and defragged, I mean.

Erased and defragged?

If the hard drive is defragmented, then it's going to be more difficult to recover anything, though not necessarily impossible depending on how the contents of the drive are rearranged. Simply deleting a file, however, doesn't do anything except remove a marker from the file allocation table. If the data isn't overwritten, it can easily be recovered.

[vikingchick]

Unfortunately, it seems this is just the beginning of the story.

[BossLady]

My thoughts exactly....one sick SOB!!!

[STONEWALLS]

.....any advice for us non-computer savy people who worry about what's retrievable in our machines?.....I'd like to get a new computer and donate my old one to charity, but I've got 6 years worth of financial records, credit card numbers ect in there that i don't want other people reading.......what should I do?......just destroy the old machine?

[Search4Truth]

I could find out everything about you with that computer. More than you may know about yourself. DO NOT give that computer to anyone until it has benn cleansed. Try this product http://www.acronis.com/products/drivecleanser/

This is the one I use
http://www.acronis.com/products/privacyexpert/features.html

[Dimensio]

Well, in Linux there's the 'wipe' command, which is used for thorough 'deletion' of individual files or directories. I'm not sure of an equivalent in Windows, though one way to help make files irretrevable is to delete them and then fill your hard drive up with junk until it's completely full. Delete the junk and do it again two or three more times, and chances are that any 'valuable' data will be totally gone.

[mvpel]

Yes, defragging does condense the filesystem, but depending on where the deleted files were located on the disk, their blocks may or may not be overwritten. If you create a new file that winds up at the high end of the block list, and delete it, defragging won't overwrite those blocks.

[GovernmentShrinker]

In large metropolitan areas, many doctors have "admitting privileges" at a number of hospitals simultaneously. I'd guess that's what was meant by saying he'd "worked at" all those hospitals. If not, then it IS suspicious that he was job-hopping like that.

[STONEWALLS]

......thanks for the information......I think this problem will only get worse in the future......the other day I hauled my old worn out Xerox copy machine to the county dump.....the attendant says...."put it over there with all the other electronics"......I looked and there was an enormous pile of computers......I remember thinking that a person who knew what he was doing could go thru that pile of computers and probably glean all kinds of information on previous owners......in my view a personal computer is just that.....PERSONAL

[mvpel]

If you're hauling a computer to a dump, your local computer store will likely have something called a "degausser" - it generates an oscillating magnetic field and is designed to completely wipe out any semblence of orderly data on magnetic media.

However, doing this to a disk drive being donated to a charity is somewhat problematic, since it also wipes out all the low-level formatting of the drive, making it considerably more time-consuming to convert to another use.

[Sabertooth]

Delete the junk and do it again two or three more times, and chances are that any 'valuable' data will be totally gone.

DoD standards are to overwrite five times. I recall a thread where someone posted something indicating there were recovery techniques dealing with magnetic "resonances" (that's the wrong term, but I'm not a tech-head) off the hard drive that could recover data overwritten as many as 32 times. Don't know the veracity of that.

[prairiebreeze]

Peoria, Rockford, Wichita, Kan., Philadelphia and in Maryland.

Five different cities. In addition to Naperville. I suppose it's conceivable that he commuted from Naperville to Peoria to Rockford (although I don't think so), but Wichita, Philly and Maryland aren't even in the same general neck of the woods.

Prairie