tutorial search on data recovery

[cable]

Hi there,

I'm just a newbie entering the field of computer forensics. As of the late, I've been searching the web for tutorials on data recovery techniques on hard drives (running Windows/Linux) that have been wiped clean or slighty damaged but with it's disks/cylinders intact. But I always end up on websites of software products related to data recovery.

Can anyone suggest a website(s) that has some tutorials? Or if not a website, a good technical book on the subject matter?

Thanks.

[The3ntropy]

Here is a very good web site (http://www.fish.com/security/secure_del.html), lots of technical information and also information spanning across multiple data retaining mediums.

[Gravity]

Hmm, I heared there is a way to recieve data from a box that has been formated, why wouldn't the box wipe all the data when asked to(format)?

[Kimeramon_2001]

I've been talking to me friend lately and he has told me that inorder for all the data to be wiped out completely you have to do a level format. He also explained to me that windows leaves something like .02 seconds of data on the drive when it's formatting, but a level format gets everything!

[sws2k42]

Try www.cops.org. This a well respected computer forensic group. The training is geared for working police officers, but there are several great links to resorces most of which are not for sale oriented. I'll shoot you an email of others I come across, and ask the same in return. Hope it helps.

[ommy]

Well...Gravity...as far as I know...there are references to the data at the hard drive..DELETING means loosing the reference of the file you want to delete and notifying FREE MEMORY MANAGER (this is done by OS Kernel ) that this space of the hard drive is free and you can overwrite the contents at that particular block of hard drive. Now if you want to recover that data you just deleted, you have to regain that pointer or reference of the deleted data on the hard drive before Free memory manager overwrites something on it..I hope you 'll get it...correct me if i am wrong...

[DeadAddict]

I had posted this in Microsoft security discussions So I thought That you would be able to get some good information from it too :D

I rember a few months back two MIT students who bought $1,000 worth of old hard drives and uncovered a wealth of corporate and personal information some of the harddrives were from atm machines, people's old computers Etc here is a link that Simson Garfinkel wrote about it. http://www.computer.org/security/garfinkel.pdf