Evaluation of registry data removal by shredder programs

Abstract

Shredder programs attempt to overcome Window's inherent inability to erase data completely. A shredder is useful when one needs to transfer ownership or dispose of a computer, but it can be exploited by a suspect for the purpose of wiping incriminating evidence. Most shredder programs claim to remove all traces of data. This paper examines these claims by conducting forensic examinations of computers on which shredder programs were used. © 2008 International Federation for Information Processing.