Recovering Overwritten Data - SD Card - Page 2
Page 2 of 2 FirstFirst 12
Results 11 to 14 of 14

Thread: Recovering Overwritten Data - SD Card

  1. #11
    Super Moderator: GMT Zone nihil's Avatar
    Join Date
    Jul 2003
    Location
    United Kingdom: Bridlington
    Posts
    17,191
    OVERWRITTEN data cannot be recovered, as it has been physically (electronically) replaced with something else.

    Dr. Peter Gutmann (University of Aukland, New Zealand) wrote a paper on this around 1996, when HDD technology was very different. His paper only referred to electro-mechanical hard drives, rather than solid state drives that use transistors as opposed to magnetic media.

    You can frequently recover "deleted", or "lost" data because it is still physically present; however, once it has been overwritten (replaced) with something else, it is GONE FOREVER.

    None of the snake oil products suggested by spammers can do a thing about that!

  2. #12
    Super Moderator
    Join Date
    May 2012
    Posts
    349
    Recurva work fine, as long as it has not been overwritten.

    http://www.piriform.com/recuva

    Memory sticks and SSD because of their size get overwritten fast.

  3. #13
    Super Moderator: GMT Zone nihil's Avatar
    Join Date
    Jul 2003
    Location
    United Kingdom: Bridlington
    Posts
    17,191
    I agree with Shay, and put Piriform's "Recuva" on all my customers' machines. It does what it says on the box

    EDIT:

    @Shay,

    I believe you to have far greater technical knowledge than myself, so this is a discussion point rather than an argument.

    I have recovered stuff from solid state media that I would not have expected to from their electro-mechanical counterparts?

    I put this down to the fact that the SSD stuff has software embedded in it to make all the transistors get used, rather than the next available?

    What is your opinion?
    Last edited by nihil; September 6th, 2013 at 08:52 PM.

  4. #14
    Super Moderator
    Join Date
    May 2012
    Posts
    349
    I figure between the two of us, we make a great team knowledge wise. We have both pulled stuff out of the wood work that surprised the other.

    The SSD programing [ lack of a better word] Seems to delay over writing of items marked for deletion. So yes, you would be able to normally recover more. Remember we do NOT defragment SSD which can be a huge bacon saver.

    Remember IDE/SATA writes to the first open/marked to overwrite areas first.

    Hope that makes sense.

Similar Threads

  1. Forensic Process and Tricks
    By Tiger Shark in forum The Security Tutorials Forum
    Replies: 3
    Last Post: January 12th, 2007, 09:44 PM
  2. An Introduction to Cryptography, and Common Electronic Cryptosystems – Part I
    By 576869746568617 in forum Cryptography, Steganography, etc.
    Replies: 1
    Last Post: July 10th, 2006, 10:38 PM
  3. HJTlog and the ISP ads
    By coolcamel in forum Spyware / Adware
    Replies: 8
    Last Post: September 29th, 2004, 02:54 PM
  4. The Worlds Longest Thread!
    By Noble Hamlet in forum AntiOnline's General Chit Chat
    Replies: 1100
    Last Post: March 17th, 2002, 08:38 AM
  5. Hacking DirecTV Lesson 1
    By KapperDog in forum Security Archives
    Replies: 0
    Last Post: September 5th, 2001, 06:34 AM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •