Page 1 of 3 123 LastLast
Results 1 to 10 of 26

Thread: Recovering overwritten data - can software alone do it?

  1. #1
    Junior Member
    Join Date
    Mar 2007
    Posts
    13

    nvmd

    nvmd i think i found my answer,, can delete if you want
    Last edited by screwd; April 15th, 2007 at 12:34 AM. Reason: foudn answer

  2. #2
    Senior Member nihil's Avatar
    Join Date
    Jul 2003
    Location
    United Kingdom: Bridlington
    Posts
    17,188
    Don't use the HDD............not ever...............nohow............noway............nowhen...........

    Now, you need a backup.............

    Please explain the situation for your question............or just use some C4

    I can tell you how to recover stuff, but it might take a bit of effort.......I can also tell you how to destroy it.............

    "encase"................. well you are entitled to your sense of humour I suppose?

    It all depends how well it was wiped in the first instance?...................... (but you won't turn a sow's (pig's) ear into a silk purse )

    And very much on how much they are prepared to pay to get ya

  3. #3
    Member Unimatrix 2's Avatar
    Join Date
    Aug 2006
    Location
    The Netherlands
    Posts
    40
    I'm realy curious and somewhat shocked after I did a little search about this topic. I knew it was somehow possible to retrieve some deleted files, but I didn't know you can bring them back completely even after you formated your hard drive.
    Do you need additional software to "permantly, as in wipe from the world forever" delete files from your computer, or can you do it by hand?
    Got it Memorized?

  4. #4
    I'd rather be fishing DjM's Avatar
    Join Date
    Aug 2001
    Location
    The Great White North
    Posts
    1,867
    Quote Originally Posted by Unimatrix 2
    or can you do it by hand?
    I find a six pound sledge hammer the best.



    Cheers:
    DjM

  5. #5
    AO übergeek phishphreek's Avatar
    Join Date
    Jan 2002
    Posts
    4,325
    Quote Originally Posted by DjM
    I find a six pound sledge hammer the best.



    Cheers:
    Or, you can try out DBAN.
    http://dban.sourceforge.net
    Quitmzilla is a firefox extension that gives you stats on how long you have quit smoking, how much money you\'ve saved, how much you haven\'t smoked and recent milestones. Very helpful for people who quit smoking and used to smoke at their computers... Helps out with the urges.

  6. #6
    AO Senior Cow-beller
    Moderator
    zencoder's Avatar
    Join Date
    Dec 2004
    Location
    Mountain standard tribe.
    Posts
    1,177
    ((note: not complaining, just informing you))

    FYI, it is considered bad form to start a thread, then edit the original information out of the original topic; much better to reply with your "nevermind, I found a solution" to the thread. In fact, part of being a member of a forum kind of suggests one would post their findings if they had any, so others in the future who may have related problems can learn from your experience.

    Just so you know.
    "Data is not necessarily information. Information does not necessarily lead to knowledge. And knowledge is not always sufficient to discover truth and breed wisdom." --Spaf
    Anyone who is capable of getting themselves made president should on no account be allowed to do the job. --Douglas Adams (1952-2001)
    "...people find it far easier to forgive others for being wrong than being right." - Albus Percival Wulfric Brian Dumbledore

  7. #7
    Senior Member nihil's Avatar
    Join Date
    Jul 2003
    Location
    United Kingdom: Bridlington
    Posts
    17,188
    Hi zen~

    I can't remember the original question, but it was something like "can overwritten data be recovered?"

    The answer is "yes, but not easily"

    It depends on whether it really was overwritten with something else. If it was, then normal software won't do it............. otherwise you computer wouldn't work?

    Encase is an evidence collection tool........... not a data recovery one

  8. #8
    There are lots of considerations. The bottom line, though, is that data overwritten is pretty much unrecoverable by ANY means, episodes of "NCIS" notwithstanding.

    The trick is to actually overwrite it. There are some very good tools out there (e.g. DBAN, Eraser) that will do this. As far as I know, only the Host Protected Area on a disk is beyond such overwriting. A normal format, even a low-level one, might not do the job.

    There have been rumors of more exotic methods of data recovery post-overwriting (they involve imaging the platters with scanning microscopes and/or analyzing the raw signal output from the read heads), but actual attempts to do this by researchers have usually only succeeded under some pretty strict assumptions, such as already knowing the data to be recovered, knowing the overwrite pattern and only one overwrite pass.

    Whenever I want to start fresh on a drive or take it out of commission permanently, I always start with DBAN.
    Last edited by kythe; April 18th, 2007 at 02:14 PM.

  9. #9
    Senior Member Aardpsymon's Avatar
    Join Date
    Feb 2007
    Location
    St Annes (aaaa!)
    Posts
    434
    well, over written data can be recovered with special hardware. Most easily if you know what it was over written with. For example say a 0 on a hard drive all the particles are aligned - and a 1 is |. If you over write all data on a drive with a single pass of just 0s, most of the particles will be -, however just a few will be | still where the 1s were. Get sensetive enough equipment and you can detect that.
    If the world doesn't stop annoying me I will name my kids ";DROP DATABASE;" and get revenge.

  10. #10
    Quote Originally Posted by Aardpsymon
    well, over written data can be recovered with special hardware. Most easily if you know what it was over written with. For example say a 0 on a hard drive all the particles are aligned - and a 1 is |. If you over write all data on a drive with a single pass of just 0s, most of the particles will be -, however just a few will be | still where the 1s were. Get sensetive enough equipment and you can detect that.
    Theoretically, it's possible. But again, when researchers have actually tried to do it, the signal is buried in the noise--more sensitivity doesn't help.

    Usually, what's done is to attach the raw analog signal output from the read heads to a spectrum analyzer or oscilloscope (or similar test equipment). If you do that, you can see the old data if there's only been one overwrite pass. Of course, you have to read the same area 100 times to get the noise low enough to see the signal, the old data has to be a repeating pattern, and again, you have to know the overwrite pattern (always use a pseudo-random overwrite pattern!). And after more than one overwrite pass, the signal disappears, no matter what crutches you may have for finding it.

    Here's a great example:

    http://www.tomcoughlin.com/Techpaper...,%20042502.pdf

    This is one of those things that's often been rumored, but never demonstrated in practice. Everyone who has tried to find someone who can actually recover data in this way has come up disappointed, and most conclude it's an urban legend.

    The government, out of an abundance of caution, recommends overwriting with multiple passes. If that makes you more comfortable, do that.
    Last edited by kythe; April 18th, 2007 at 02:31 PM.

Similar Threads

  1. Practical Guide to Alternative Data Streams in NTFS
    By Irongeek in forum The Security Tutorials Forum
    Replies: 13
    Last Post: January 3rd, 2005, 07:35 PM
  2. Should I be worried....?
    By jerichoholic in forum Spyware / Adware
    Replies: 12
    Last Post: November 30th, 2004, 11:14 AM
  3. Spyware/Maleware User Agreements
    By moxnix in forum Spyware / Adware
    Replies: 7
    Last Post: July 8th, 2004, 01:42 PM
  4. Guide to computer cables
    By preep in forum Other Tutorials Forum
    Replies: 9
    Last Post: June 8th, 2002, 04:01 PM
  5. The Worlds Longest Thread!
    By Noble Hamlet in forum AntiOnline's General Chit Chat
    Replies: 1100
    Last Post: March 17th, 2002, 09:38 AM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •