Mike said:
On 6/18/2010 7:10 AM, John John - MVP wrote:
Mike S wrote:
On 6/18/2010 4:39 AM, John John - MVP wrote:
Mike S wrote:
On 6/17/2010 11:10 AM, Db wrote:
there are utilities that
wipe the disk of deleted files.
however, there are differing
opinions whether wiping
deleted files with something
like military encryption
is effective against
hard drive forensics.
my opinion and a old friend
who is an m.i.t professor
is that the only sure way that
the contents on the disk are
not retrievable is to toss the
hard drive into a volcano or
the middle of ocean in the
middle of the night.
I saw a show on television that mentioned some very powerful forensic
software that could find the last two (that's right 2) sets of files
on a hdd that had been overwritten. That is you save file A, then you
overwrite it with file B. Then you overwrite that with file C. They
could recover B and A with extremely high rates of accuracy!!!
But most people do not have access to that software.
Most people don't have access to that software because it just plain
doesn't exist, it's nothing but BS!
John
And you know this how?
You are the one who made the claim that there is some sort of 'magic'
software available that can recover overwritten files, it is up to you
to substantiate your claim and supply the name of the software and the
company who makes this software. The leading forensic recovery software
(EnCase) cannot do this and none of the major data recovery firms can do
this, just call them and ask them and you will get the same answer from
all of them. This idea that data could be recovered from overwritten
drives was a theory advanced by Dr. Peter Gutmann and he himself has
told me that his theory was misconstrued by many who read his paper, he
was never able to recover overwritten files and he knows of no one who
ever was.
John
I claimed that I saw this on a television show, that is true. They did
not mention the name of the software. Also the government often has
technology that is years ahead of what the public knows about. I have
not seen this at work but I now damage platters on drives I don't want
people to access anything from, and I advise the same to all of my friends.
You also made a claim, that it doesn't exist, so how can you be
uncomfortable if someone asks you to back up your claim?
For a period of about five years, on and off in my spare time, I did a
lot of searching for this 'Holy Grail' of data recovery! Anytime that
it would appear that promising information was about to be found it
always came down to the same thing; quotes from or claims made on the
basis of Dr, Gutmann's paper or hearsay about conspiracies and
government secrets! I found out that the one thing in common that any
who claimed that this was possible have is that none of them could give
hard evidence or give us the name of anyone or any company who could
actually do it, classic hallmarks of urban myths!
After countless hours of futile searching for this data recovery Grail I
decided to ask persons and companies in the know about data recovery, I
started e-mailing and calling those who I thought would be able to
provide real answers. I contacted at least 10 different data recovery
companies, some who make data recovery software and some who run clean
room data recovery. All of them told me the same thing, they cannot
recover overwritten data. Quoting from an email from one of the major
firms: "It is nothing but a theory at best, add secret government
capabilities and the theory has now entered the realm of urban legends".
The claim that governments have tools to do this is often used to
bolster the myth but it is interesting to note that in his 2004 paper,
Recovering Unrecoverable Data - The Need for Drive-Independant Data
Recovery, Charles H. Sobey wrote:
"It is very telling that the US Department of Defense's Combating
Terrorism Technology Support Office placed a "Broad Agency
Announcement" seeking just such a [magic] machine for damaged, erased,
or overwritten media."
The DoD's request went unanswered, no one took them up on it. In a
telephone conversation I posed the question about the DoD's request to
an engineer at Seagate. The engineer chuckled and said that while he
was not privy to any information about these kind of projects within his
company he nonetheless felt that to undertake the request would have
been an exercise in futility.
Finally, after all of the data recovery and hard disk manufacturers that
I had contacted told me that it was impossible to recover overwritten
data I decided to ask Dr. Gutmann himself about it. His answers to me
confirmed the urban myth status of the whole thing.
You can read Charles H. Sobey's paper here:
ActionFront Research
Recovering Unrecoverable Data - The Need for Drive-Independant Data Recovery
http://www.actionfront.com/ts_whitepaper.aspx
Dr. Gutmann's paper is available here:
http://www.cs.auckland.ac.nz/~pgut001/pubs/secure_del.html
More on the subject in these links:
Data Removal and Erasure from Hard Disk Drives
http://www.actionfront.com/ts_dataremoval.aspx#Overwriting
Overwritten data: Why even the Secret Service can't get it back
http://blogs.computerworld.com/node/5756
Is overwritten data really unrecoverable?
http://blogs.computerworld.com/node/5687
Can Intelligence Agencies Read Overwritten Data?
http://www.nber.org/sys-admin/overwritten-data-guttman.html
Researchers Prove Single Pass Overwrite Effective
https://infosecurity.us/?p=5474
John
