Can data really be recovered?

Tringa

Tringa

Numpty of the Day'
Suspended / Banned
Messages
6,133
Name
Dave
Edit My Images
Yes
Can the original data on a hard drive that has been formatted really be recovered or is this a computing myth?


If I understand correctly a quick format deletes the information about the structures of the files ( ie file names and where the files are stored on the disk) but leaves the actual file data on the disk. Therefore, I can imagine that with the right software the files could be read.

However, and again if I have understood correctly, a full format writes '0' to every bit on the drive. If that is correct then how can any software reconstruct the original files? How can software work out if the original state of any bit was a '0' or a '1'?


Dave
 
A full secure erasure requires a number (7 minimum?) of passes of completely re-writing to the disk, I don't know how it does it but evidently it can be recovered at least in part with anything other than a number of full re-write erasures.
 
unless you've put data back onto the drive then data should be recoverable after a format (quick or full). most consumer software should be able to do that.

after 1 or more overwrites you're going a bit specialist.
 
It's certainly not a myth. I've previously worked within the forensic arena for twenty plus years. During this time I was also responsible for the High Tech Crime Unit. It's perfectly possible to recover data from hard drives that have been erased and sometimes even destroyed. There is a number of software packages on the market that purport to be able destroy all traces of data. Don't believe everything you read !
 
Last edited:
I'm curious how that is possible, if you write a zero to every sector on the disk does that not erase what was before or simply cover it over?
 
jakeblu said:
I'm curious how that is possible, if you write a zero to every sector on the disk does that not erase what was before or simply cover it over?
Click to expand...
im no expert but from what i understand even after a single overwrite there is ghost of the magnetic data that can be inspected with specialist tools/software. which is why several overwrites is usually enough to secure erase.

not sure if the same applies to flash based storage.
 
Just to go off at a slight tangent, it's amazing what can actually be recovered if you have a will to do so, and deep pockets to finance it.

In a previous life as an IT consultant, I once had a call from a company that had a computer that held some very "mission critical" data. Unfortunately, it had been installed out of the purview of their IT people, and had no backup strategy (indeed, the machine wasn't connected to their network, and all means of getting data off the machine had been physically removed - this being pre-usb port backup devices, and the floppy drive had been removed - this was - ironically - a "security measure" to prevent people copying the data of the computer to sell to the competition)

Of course, the inevitable happened, and the HD crashed. Badly. As in when the hardware engineer removed the HD from the case, you could hear the read-write head arms rattling around loose. I ended up finding a company that said they could help, and I drove the HD to their premises, where it was opened in a clean room environment, and they ended up mounting the individual platters onto a "lathe like" machine which allowed them to "hoover up" all the raw sectors from the disk and eventually, with a lot of manual intervention, to recover almost 90% of the content - fortunately the 10% that was lost happened to be in the operating system and programs, and the actual critical data files were preserved.

The cost of this process was not exactly insignificant - I think it was considerably more than the cost of the brand new Compaq desktop machine that was purchased to replace the defunct hardware. I suggested that the cost be taken out of the product directors salary (for it was he who set the un-sanctioned computer up to hold his new product development ideas and recipes).
 
I wonder if one might not be better just using a big magnet and and a hammer.
 
i think a few passes will put the data out of reach for most. there comes a point where the data on the disk will be more expensive to recover than the gains from exploiting that data.
 
If you want to destroy the data on a drive and be utterly sure, then you should degaus or shred the disk. The guys above have outlined how easy it is to recover data when it has been deleted (data flagged as being available to overwrite) unless data is written over multiple times.
 
rich_ said:
If you want to destroy the data on a drive and be utterly sure, then you should degaus or shred the disk
Click to expand...


Indeed any hard drive I am finished with gets physically destroyed
 
in case anyone needed to know, you can set the amount of zero passes a windows format does..

format x: /p:8

(where x is the drive letter and 8 is the amount of passes)

obviously this is not available on a quick format and may take a long time.
 
Thanks for the comments all.

Dave
 
Some friends of mine used to have the disk-shredding van come round twice a year. But that was very expensive, now they use a hammer for the glass/ceramic platters.
 
Last year I accidentally formatted a 4TB drive (quick format) but was able to recover a lot of data using Recuva, but some was beyond recovery even though I did not use it at all once i realised my mistake - about 10 secs too late!

Some of it was data that had previously been deleted quite deliberately but was still there.

After I had backed it up I did a full format and then Recuva reported that there was nothing to recover.

I have also in the past recovered pictures (all of them) from a memory card which had been formatted in the camera.

So it is possible in some circumstances to recover data from a HDD or memory card.
.
 
Recova is a very basic option, proper data retrieval is quite different.
 
ancient_mariner said:
I wonder if one might not be better just using a big magnet and and a hammer.
Click to expand...
Better, yes. But proportionality comes into it as well. Depending on the security levels you are working within shredding following a degaussing maybe the only sensible and cost effective option.

The funny thing is that with one setup my team killed two shredders as the hard drives were too hard.

But also don't forget the printers and switches and routers etc.
 
hollis_f said:
Some friends of mine used to have the disk-shredding van come round twice a year. But that was very expensive, now they use a hammer for the glass/ceramic platters.
Click to expand...
shouldn't be too bad, we had a recycling company down recently and they took away about 20 laptops, several desktops, screens, printers etc etc and a box full of about 30 old hard disks. they charged us about £500 and provided a certificate of destruction for the disks.
 
neil_g said:
in case anyone needed to know, you can set the amount of zero passes a windows format does..

format x: /p:8

(where x is the drive letter and 8 is the amount of passes)

obviously this is not available on a quick format and may take a long time.
Click to expand...
I know this is OT, but this is a really good tip for anyone selling on/getting rid of a computer after their ownership.
 
Rather than physically destroying disks, why not encrypt them instead? Even if the data is recovered, it will be gibberish.
 
jakeblu said:
I'm curious how that is possible, if you write a zero to every sector on the disk does that not erase what was before or simply cover it over?
Click to expand...

Think of it as using a crap rubber on something pencil written. You can still normally read what's been rubbed out or see the impression it left.
 
afasoas said:
Rather than physically destroying disks, why not encrypt them instead? Even if the data is recovered, it will be gibberish.
Click to expand...

But can take a lot of time.

Far better to do a quick format then encrypt it - but it still can take a LOT of time to do a complete disk encrypt - several hours at least.
.
 
You must log in or register to reply here.
Back
Top