tutorial search on data recovery
Results 1 to 7 of 7

Thread: tutorial search on data recovery

  1. #1
    Junior Member
    Join Date
    Aug 2001
    Posts
    17

    Question tutorial search on data recovery

    Hi there,

    I'm just a newbie entering the field of computer forensics. As of the late, I've been searching the web for tutorials on data recovery techniques on hard drives (running Windows/Linux) that have been wiped clean or slighty damaged but with it's disks/cylinders intact. But I always end up on websites of software products related to data recovery.

    Can anyone suggest a website(s) that has some tutorials? Or if not a website, a good technical book on the subject matter?

    Thanks.

  2. #2
    Senior Member
    Join Date
    Mar 2002
    Posts
    442
    Here is a very good web site, lots of technical information and also information spanning across multiple data retaining mediums.

  3. #3
    Junior Member
    Join Date
    Jan 2003
    Posts
    15
    Hmm, I heared there is a way to recieve data from a box that has been formated, why wouldn't the box wipe all the data when asked to(format)?

  4. #4
    Junior Member
    Join Date
    Jul 2003
    Posts
    8

    Data Wipeout

    I've been talking to me friend lately and he has told me that inorder for all the data to be wiped out completely you have to do a level format. He also explained to me that windows leaves something like .02 seconds of data on the drive when it's formatting, but a level format gets everything!
    --
    Jared

  5. #5
    Junior Member
    Join Date
    Jun 2003
    Posts
    1
    Try www.cops.org. This a well respected computer forensic group. The training is geared for working police officers, but there are several great links to resorces most of which are not for sale oriented. I'll shoot you an email of others I come across, and ask the same in return. Hope it helps.
    Check ya Later
    T-Hex

  6. #6
    Senior Member
    Join Date
    Jun 2003
    Posts
    142
    Well...Gravity...as far as I know...there are references to the data at the hard drive..DELETING means loosing the reference of the file you want to delete and notifying FREE MEMORY MANAGER (this is done by OS Kernel ) that this space of the hard drive is free and you can overwrite the contents at that particular block of hard drive. Now if you want to recover that data you just deleted, you have to regain that pointer or reference of the deleted data on the hard drive before Free memory manager overwrites something on it..I hope you 'll get it...correct me if i am wrong...

  7. #7
    Senior Member DeadAddict's Avatar
    Join Date
    Jun 2003
    Posts
    2,583
    I had posted this in Microsoft security discussions So I thought That you would be able to get some good information from it too

    I rember a few months back two MIT students who bought $1,000 worth of old hard drives and uncovered a wealth of corporate and personal information some of the harddrives were from atm machines, people's old computers Etc here is a link that Simson Garfinkel wrote about it. http://www.computer.org/security/garfinkel.pdf

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •