Deep Recovery

Ok, whats the definition of term 'overwrite' that makes it impossible for software to recover data.

I've used this software and this software to recover data that has been overwritten by my understanding of the term.

Formatting a drive does not overwrite it's contents, by default, it basically clears the MFT or FAT, the lookup tables that tell the OS where exactly on a disk to find the data relating to "filename.ext". Say I have a word document that is 32KB, if I write new data over every sector on the disk that used to be used by that file, that file will be gone an unrecoverable.
 
Ok, whats the definition of term 'overwrite' that makes it impossible for software to recover data.

I've used this software and this software to recover data that has been overwritten by my understanding of the term.

If you totally write new data over the sectors/blocks which were used to store your original data that than is an overwrite. If it was recoverable (with software) then you must have not overwritten the sectors/blocks.

What bam0 is saying is correct.
 
TrueCrypt hidden volume + CCleaner + BCwipe :cool: Surely that'll at least make things difficult?!

I'm surprised the police are putting so much effort in to it. Still though, you shouldn't be vandalising stuff, and I hope whoever did it (be it you or your friends) gets punished. It make streets look grotty, intimidating and down right disgusting. Graffiti is the #1 way to make it look like your neighbourhood is poor and full of skanks. I have no idea why people do it.

There are sometimes exceptions and I have seen some graffiti that is an improvement to an otherwise ugly concrete slab, but it sure as hell wasn't the scrawling of some irresponsible idiots groupie nickname on a wall.
 
I wouldn't worry about it.

Your disk will probably be sent to the lab and lost in the post :)
 
Perhaps MSN is subject to the same controls as telephone and email? I.E. a bit of hardware scans for key words, then saves them for later investigation. I used to be a Telephone Exchange (Switch) service tech and in each and every exchange is a white box, about the size of a fridge which the Police in white suites would access once a month. We were never told what this was for, but I can guess.
 
A myth I'm afraid, overwrite it once and it's gone.

incorrect, we use file shredders at work and i can tell you the only secure file wipe is 7 pass dep of defence standard and even then if the drive is dismantled and put under an electron microscope platter by platter you can still recover files, although your looking at months and months of work,

other than that theres the 35 pass gutman wipe which is at present impossible to recover.


but the easiest thing to do is not to have anything dodgey on your comp in the first place ;)
 
incorrect, we use file shredders at work and i can tell you the only secure file wipe is 7 pass dep of defence standard and even then if the drive is dismantled and put under an electron microscope platter by platter you can still recover files, although your looking at months and months of work,

other than that theres the 35 pass gutman wipe which is at present impossible to recover.


but the easiest thing to do is not to have anything dodgey on your comp in the first place ;)

I linked to gutmanns paper in an earlier post, I suggest you read his epilogue.
 
Can anyone proove this 9 time overwrite thing? Seems ridiculous to me.

I don't think any software can recover after that, and you'll need special hardware after that.

sid
 
We were tempted to send some discs to the fMRI unit at Addenbrookes at one point, that should have done the trick :p
 
A myth I'm afraid, overwrite it once and it's gone.

That confuses me. I did some work for a local council that was giving old council PCs away to community groups and the like, and we were told we had to overwrite 7 times to comply with the data protection act?
 
ah so technically the DOD 7 pass should be more effective as each pass uses a different method of wiping.

No, it's basically saying it doesn't matter what you use, modern hard drives aren't as exposed in the same way as old MFM/RLL drives (when was the last time you heard of them being used) and that anything past 1 pass with random data is overkill, but knock yourself out.
 
:lol:

The case was actually in pretty bad shape when they took it - a shuttle esque design with the top of it off, exposing pretty much everything. I wouldnt be suprised if it wouldnt boot u[ by the time they get around to it.

Ummm ... they probably would not have even tried to boot it in case you had something on there which executed on boot and attempted to erase or alter evidence. They'd have taken the disk out and hooked it up to some for of test rig to access/image.

If you are looking at legal issues for the disks content then you really should not be talking about this on a public forum.
 
Back
Top Bottom