On Nov 5, 8:10 pm, Greywolf <
weki...@sympatico.ca> wrote:
> On 05/11/2011 6:33 PM, Fox on the run wrote:
> > I seriously doubt it was able to recoverdeleted, overwritten data.
> > Actually I am confident that it did not. No $69 program would succeed
> > in doing what programs costing thousands are incapable of doing.
>
> Erm, as I understand it, to ensure that overwritten data cannot be
> recovered requires multiple writes. Once is not enough. (Hey, that would
> make a good title for a book or movie, no?)
>
Take my word for it, one time overwrite is sufficient. If you don't
want to take my word for it, check out
http://en.wikipedia.org/wiki/Gutmann_method,
specifically "Companies specializing in recovery of damaged media
(e.g., media damaged by fire, water or otherwise) cannot recover
completely overwritten files. No private data recovery company
currently claims that it can reconstruct completely overwritten
data.", or check out
http://www.makeuseof.com/tag/impossible-recover-data-overwritten-hard-drive-technology-explained/,
specifically
"What Happens When Data Is Overwritten?
When data is overwritten, the magnetic domains on the HDD are re-
magnetized. This is an irreversible process that physically removes
information previously stored in this location. While some residual
physical traces of the changes (or none changes) in magnetization
potentially remain, which may theoretically allow a partial restore,
this would require the use of a magnetic force microscope or similar
technologies, none of which have been shown to recover data
successfully so far [although you never know what's going on in secret
government intelligence labs]. So in essence, there is no software or
other technical way known to the public that can restore overwritten
data."
One company claimed to be able to do this and they were going to demo
it at a big conference. From what I read, when the conference came
around they backed down and explained that they had recovered a
minuscule amount of overwritten data off a very large drive. It was
all exaggerated claims on their part.
> > Check any data recover/computer forensic site and you'll find the same
> > thing, in theory with the right equipment (very expensive) it "may" be
> > possible. In practice it's like Big Foot, people claim to have seen
> > it done but proof is elusive. A format & re-install overwrites parts
> > of the disk, but your data was still there in the later parts of the
> > disk not yet overwritten hence why it was recovered.
>
> > JB
>
> One of disks in question had been repartionend three times. It found all
> three sets of partitions. It found some data that was on the first
> partition, and most of data that was on the second partition, and all
> the data that had beendeletedon the most recent partition. It took all
> day (over 12 hours) to examine two disks (totalling 320GB) and create a
> database of usable data, so I think it is more than an undelete program.
> OTOH, I agree that was able to do so because, as you say, the data was
> stored on parts of the disk that not been overwritten, or overwritten
> only once or twice.
>
> Have good one,
> Wolf K.
It was stored on parts of the disk that had not been overwritten. Had
it been overwritten even just once, you would never have recovered it
with any tools you can get off the Internet, whether the free ones or
the big boys like EnCase, FTK, ProDiscover, or XWays Forensics (maybe
if you had friends working for a government agency with access to
extremely sophisticated equipment there is a every so slight chance
that bits of your overwritten data - even one time overwrite - might
have been recovered).
Crawling every bit of info on a 320 gig drive and processing that data
to see if it's a partition entry, Master File Table Entry, folder
structure, fragment of data, etc takes a long time. It may very well
do more than the straight forward undelete which simply looks for
headers/footers in contiguous sectors on a drive and carves out the
data. But it's DEFINITELY NOT recovering any overwritten data,
whether overwritten once or more.
JB