Classified Data Identification
& Data Elimination Guidelines

---

Introduction

NTI developed and began to distribute state-of-the-art computer forensic software search utilities for use in security reviews by security specialists in classified government environments in 1997. NTI's TextSearch Plus and TextSearch NT forensic software search utilities are currently used in hundreds of classified U. S. government facilities, U. S. embassies and U. S. foreign outposts around the world to identify data leakage and potential breaches of computer security. These forensic text search utilities were developed based upon requirements provided by government computer security specialists. They have also been tested and certified by the U. S. Department of Defense.

NTI's TextSearch Plus and TextSearch NT programs have continually been updated by NTI's software engineers to meet identified security needs of classified government agencies. Both of these forensic software search utilities scan all areas of computer storage devices at a very high rate of speed when compared with other similar tools, e.g., D-Scan. These tools can scan all physical areas of a 40 gigabyte hard disk drive in under 2 hours depending upon the processing speed of the computer system involved. They have no realistic drive size limits and they can easily be operated from a single floppy diskette or USB storage device. These specialized search tools are accurate in identifying targeted strings of text in files, file slack, unallocated space, swap files, floppy drives and Zip disks. The programs are designed to operate from a single, system-formatted, floppy diskette and they are used to identify targeted strings of text on DOS, Windows, Windows 95, Windows 98, Windows NT, Windows 2000 and Windows XP-based computer systems.

NTI's founders have been leaders in the development of computer forensics search utilities since 1989. Continual improvements in forensic search utilities have been their trademark since that time and after the creation of NTI in 1996. Computer forensic software tools developed by NTI and its founders have helped hundreds of law enforcement agencies and classified government agencies over the years. NTI has also developed strong trust relationships with numerous government agencies and NTI's forensic search utilities are currently used to identify data leakage of sensitive and classified information in numerous government and military agencies around the world. NTI's Data Elimination Suite of Tools is also used by some of the same agencies to eliminate sensitive data when it has strayed onto unclassified storage devices. This suite of tools is also certified by the U. S. Department of Defense.

These guidelines have been provided primarily for use by our government clients and government contractors who deal with classified computer data.

Background - Personal Computer Security Issues:

The personal computer has become a powerful analysis and communications tool which is widely used in the private and public sectors around the world. Sensitive business and government documents are created on and printed from these small but powerful personal computers.

E-Mail is routed around the world via the Internet and over closed wide-area networks (WAN's). Database applications are used to store and access sensitive information and spreadsheet applications are used to track sensitive financial transactions and to make calculations. These wonderful tools are also used to conduct classified research and to store classified government reference materials.

Digital photography and the use of programs like Microsoft PowerPoint have also been widely adopted in both the private public sectors. The same can be said about popular data compression programs, e.g., PKZip. Unfortunately, graphics and compression-based files do not lend themselves to traditional text search and key word-based security searches. NTI has taken this into account concerning the development of its search tools and they automatically identify such files based upon file header identification. However, this methodology is not without its faults and limitations. The shortcomings of traditional text and keyword based searches are too numerous for inclusion in this paper. Individuals seeking more information about these critical security topics should consider attending one of NTI's training courses. Those courses are described in detail at http://www.secure-data.com/riskcrs.html and http://www.secure-data.com/forensic.html.

The popularity of the personal computer has come with mixed blessings because these small computers were not originally designed with computer security in mind. The creators of the original IBM PC never imagined that their computer design would eventually be used as a mainstay of worldwide commerce and as a critical component of classified government operations. The foundation for the original personal computers still exists today in computer systems which rely on DOS, i.e., Windows, Windows 95a, Windows 95b and Windows 98. The same is essentially true concerning Microsoft NTFS based systems, i.e., Windows NT, Windows 2000 and Windows XP.

No substantial security improvements were made until Microsoft released Windows NT and more recently Windows XP. Clearly, Windows NT and Windows XP provide better security features than prior Microsoft-based operating systems. The features include logon authentication, directory and file permissions and powerful auditing capabilities. However, Windows NT and Windows XP systems provide very little security at the data storage level. These advanced operating systems can create a false sense of security for the computer user concerning the storage of classified and sensitive data. The problem is compounded when portable notebook computers are used to process or analyze classified and sensitive data. These portable computers can easily be compromised and password and logon controls can easily be circumvented using basic computer forensic tools and methods. NTI's TextSearch Plus and TextSearch NT forensic search tools can completely evaluate and document all data storage areas on a Windows NTFS-based computer system. It does this operating from DOS on a single floppy diskette and no logons or passwords are required to circumvent the security afforded by Windows NT, Windows 2000 and/or Windows XP. Microsoft is addressing this problem with AES encryption in future releases of Windows XP, e.g., code name LongHorn, but realistically it will take Microsoft several years to adequately secure the Microsoft Windows NTFS-based operating system(s).

Most users of personal computers are unaware that data automatically migrates onto a computer's hard disk drive(s) as a normal process in the operation of the computer. They are unaware that all of their computer session work products or portions of them seep into temporary files, print files and ambient data storage areas of the computer's hard disk drive. These ambient data storage areas include file slack, the windows swap/page file and temporary application level files that are unsecurely deleted when a background process has been completed. These technical terms are defined on NTI's web site in more detail at http://www.secure-data.com/define.html.

Most computer users are also unaware that when files are "deleted" by the computer user or when hard disk drives are reformatted, the data remains behind to be easily identified and recovered through the use of computer forensic tools and processes. Even the access to files on floppy diskettes or network computers results in data seeping into ambient data storage areas on the work session computer and or the network server. This occurs even when the computer user has just viewed or read files. He or she need not intentionally save the information to disk during the work session. A similar situation exists when files are printed. The printing process involves the creation of a background file which the operating system relies upon in the printing process.

Because of a lack of technical understanding, mistakes happen in classified government environments and classified/sensitive data can and does migrate onto unclassified computers and storage devices. Programs like NTI's TextSearch Plus and TextSearch NT software utilities can be used to identify data leakage in the form of strings of text. Programs like NTI's GExtract can be used to identify and capture data associated with potentially sensitive graphic file images. As most government computer specialists know, graphic file images can be a significant source of classified data leakage and traditional text and keyword searches do not accurately identify such files. The same is true of compressed files, e.g., PKZip files but the threat is less significant however this is changing because Microsoft has integrated PKZip logic into its most current operating systems.

The Windows Swap/Page File:

Interestingly, the Windows swap/page file cannot be read and evaluated by the computer user using Windows applications and Windows system tools. For this reason, most users are unaware of this potential security risk. TextSearch Plus and TextSearch NT programs can effectively evaluate the contents of Windows swap/page files. NTI's M-Sweep Pro can be used to eliminate the data stored in Windows swap/page files and it has been tested and certified by the U. S. Department of Defense. Because of the potential for any Windows work session data to transparently seep into the Windows swap/page file, these files should be considered a significant source of concern when computers may have had access to sensitive and classified information. More detailed information about the Windows page/swap file can be found at http://www.secure-data.com/def7.html.

File Slack:

It is important for you to understand that file slack is created at the time a file is saved (closed) and the computer user has no control over the event. Most computer users are unaware of file slack and RAM slack and drive slack can potentially contain sensitive or classified data. File slack is therefore deemed to be a security risk. The good news is that Microsoft has partially eliminated the risks associated with drive slack in Windows NT/2000/XP. These operating systems automatically eliminate RAM slack risks because the storage space is automatically padded with uniform (non-data) characters. However, the risks associated with drive slack still exist in Windows NT/2000/XP.

Potentially millions of bytes of storage space are occupied by file slack on a well used computer and NTI's TextSearch Plus and TextSearch NT programs are designed to search these areas. NTI's M-Sweep software eliminates all data from file slack and NTI's GetSlack software can be used to validate that the file slack was securely cleared of data. All of these tools are U. S. DoD tested and certified.

More information about the technical terms mentioned above can be found at http://www.secure-data.com/def19.html, http://www.secure-data.com/def15.html and http://www.secure-data.com/def6.html.

Unallocated File Space:

Temporary Files:

Partition Boundary Leakage:

When partitions are changed and/or operating systems are upgraded, the potential exists for data to linger from prior work sessions in space previously assigned to a partition. This data can reside between the new partitions or it can reside beyond the last partition. This data storage area is called the partition gap and programs like NTI's DiskScrub are used to scrub logical drives before a physical disk drive's partitioning is changed. Programs like NTI's PTable can be used to identify the number of partitions (and related operating systems) that are contained on a physical hard disk drive. Programs like NTI's TextSearch Plus and TextSearch NT programs can be used to scan all areas of a physical hard disk drive. Other options available in both of these programs allow for the searching of individual logical disk drives. Both of these search tools have been tested and certified by the U. S. Department of Defense. For more information about partition gaps, please refer to http://www.secure-data.com/def9.html

Suspense Mode Files and Related Partitions:

Portable Computers:

Risks also increase when unclassified computer systems reside in the same proximity with classified computer systems. This is because the potential exists for the unclassified computer to be "quickly" used by an employee or contractor to view, print or edit classified computer files. Most computer users do not understand that personal computers can capture and store sensitive data even when files are not intentionally saved to or stored on the subject computer. They are typically unaware of the security risks associated with swap files, temporary files, file slack, unallocated storage space, partition gaps and suspense files. These security risks exist even if files are simply viewed from a floppy diskette. For this reason, unclassified computers located near classified computers should be given a high priority in security reviews. As with most things, education can make a difference and NTI has created a special one day Computer Security Risk Training Course. Information about that training can be found at http://www.secure-data.com/riskcrs.html.

Scanning Floppy Diskettes and Removable Storage:

Creation of Search Terms and Targeted Strings of Text:

Key word files can be created using DOS Edit, Windows Notepad and even a word processing program. The only requirement is that the listing of key word search terms be in pure ASCII form and that each line of text be terminated with a carriage feed/line feed sequence. DOS Edit and Windows Notepad generate this type of file format automatically and a word processor can be used to generate such a file using the File Save As option. When using a word processor, always save the list of terms in a file saved in an ASCII DOS Text file format

Ideally, individual words should not be included in the keyword file. This is because some relevant classified words, terms or markings may be found in common forms of data that will likely be stored on any computer. The following list of key words is an example of a flawed key word list that will likely generate hundreds or thousands of false hits in a security review:

An Example of a Poor Key Word Listing:

These key words may appear to be relevant for the purposes of scanning a computer storage device for classified terms. However, both of these terms potentially exist on non-classified computer systems. The word "secret" is included in the word secretary and the word "classified" will appear in numerous operating system files and standard computer data types.

An Example of a Good Key Word Listing:

This listing relies upon short strings of text rather that individual words. Therefore, the likelihood is that these strings of text will not appear in data that would likely be found on most computer systems. The only exception might be the name "Colorado Springs" because that city name may be contained internally within address look-up programs, unclassified communications and computer help files.

Key word lists, for use in security reviews, should be crafted with much thought and by someone who has knowledge of the targeted classified data. As indicated above, short strings of text work better than single words and long strings of text.

Data Types Not Identified by Text Searches:

Note: A more comprehensive article, targeted specifically at classified U. S. Government agencies, is available for NTI's U. S. Government clients and it can be downloaded from this site. However, a password is required to access the restricted article and the password can be obtained from NTI by U. S. Government computer security specialists once their identity has been verified. Click here to obtain the password protected article.