-
April 19th, 2007, 08:45 PM
#21
Originally Posted by kythe
This simply isn't true. As Nihil noted, if it were true, disks would produce errors all the time, as they'd not be able to tell what data is current and which is old.
Among others: DBAN.
Well that is why there is a fat table this directs the computer where to see the data. So when people do quick formats all that is deleted is the fat table the data is still there but the directory isnt, until the data is completely written over it can still be seen. Im not an expert at hard drives but I do remember what I was taught back in my college days.
I also understand it that even after a full format the magnetic charge only formats to all zeros and if the magnetic charge isnt at full charge there would still be evedence of the ones, making it somewhat readable. True this may be very old information and hard drives have changed but I thought it was worth noting.
S25vd2xlZGdlIGlzIHBvd2VyIQ
-
April 19th, 2007, 09:06 PM
#22
Originally Posted by Ghost_25inf
Well that is why there is a fat table this directs the computer where to see the data. So when people do quick formats all that is deleted is the fat table the data is still there but the directory isnt, until the data is completely written over it can still be seen. Im not an expert at hard drives but I do remember what I was taught back in my college days.
I also understand it that even after a full format the magnetic charge only formats to all zeros and if the magnetic charge isnt at full charge there would still be evedence of the ones, making it somewhat readable. True this may be very old information and hard drives have changed but I thought it was worth noting.
I think Nihil had it right: we crossed definitions of "deleted" with "overwriting". A quick format, indeed, leaves the data itself intact and it can be recovered. My apologies for jumping all over you about it.
-
April 19th, 2007, 11:05 PM
#23
Ghost~ I am afraid that you have misunderstood me. When I said that
they'd not be able to tell what data is current and which is old.
I meant in terms of chronological order or "layers" on the platters. Not which data was "live" and which had been flagged as deleted Obviously, if the new data doesn't overwrite the old with a much stronger magnetic image the machine will have serious problems reading it.
Formatting is a different issue. It is true that a quick format will leave all the file contents on the drive. These could then be extracted with a data recovery program.
AFAIK, the "full format" is only available in Windows Vista, and will fill the drive with 0s. This would be virtually impossible to recover if the drive has been in use for some time as they would be overlaid over several previous "layers"
In other versions of Windows I believe that the only difference is that the regular format will also check the drive for bad sectors.
Incidentally, Encase is not a data recovery tool, it is an evidence gathering one. If you overwrite the drive thoroughly with even one pass, it is totally useless
-
April 20th, 2007, 09:31 AM
#24
in terms of being physically able to read the disk it IS very possible to read data that has been over written. The trouble is translating it back into data. Reading edges of tracks or particles that were "missed" in the overwrites is definitely possible. However, unless you started with a brand new drive in perfect condition, wrote some data to it then wrote over it with nothing but 0s the problem of extracting the actual data becomes completely impractical.
If the world doesn't stop annoying me I will name my kids ";DROP DATABASE;" and get revenge.
-
April 20th, 2007, 12:25 PM
#25
-
April 20th, 2007, 01:09 PM
#26
Its like that other CSI computer fallacy. You know, where they take the low quaility CCTV tape, run it through an enhancement algorithm and read the numberplate on a car 3 miles away.
If the world doesn't stop annoying me I will name my kids ";DROP DATABASE;" and get revenge.
Similar Threads
-
By Irongeek in forum The Security Tutorials Forum
Replies: 13
Last Post: January 3rd, 2005, 07:35 PM
-
By jerichoholic in forum Spyware / Adware
Replies: 12
Last Post: November 30th, 2004, 11:14 AM
-
By moxnix in forum Spyware / Adware
Replies: 7
Last Post: July 8th, 2004, 01:42 PM
-
By preep in forum Other Tutorials Forum
Replies: 9
Last Post: June 8th, 2002, 04:01 PM
-
By Noble Hamlet in forum AntiOnline's General Chit Chat
Replies: 1100
Last Post: March 17th, 2002, 09:38 AM
Posting Permissions
- You may not post new threads
- You may not post replies
- You may not post attachments
- You may not edit your posts
-
Forum Rules
|
|