The Science of Data Recovery

Chris Gerhard made an off hand comment about the fact that disk scrubbing simply hinders (doesn't necessarily prevent) a motivated attempt to retrieve information from a disk drive. Disk Scrubbing is the process of (attempting to) securely erasing a disk to prevent others from accessing previously stored information. This is typically done by writing (possibly multiple times) random data over the entire surface of a disk.

Since I work with various government accounts/agencies/programs, this is an area of interest to me and some of my clients.

You might think that a digital medium designed to store only zeros and ones would be immune to forensic recovery of residual data once the zeros and ones are randomly altered. The fallacy with this is that magnetic storage is not a digital medium at all. Magnetic domains are created when the read/write head applies energy to a bit location to align some (not all) of the particles to reflect either a zero or a one. The precise location of the "domain" for each write varys slightly in three dimensions (including depth). This reality provides interesting opportunities or risk (depending on your perspective).

A colleague (thanks Joe) pointed me to a fascinating report on techniques involved in recovering data from ostensibly erased disks and computer memory. This is amazing and spooky stuff for the technically inclined. Here is another report (thanks Kurt) that's also very interesting and enlightening. Joe also pointed me to Prof. Gutman's website, who has a lifetime of security related knowledge to share!

Here are a few brief excerpts (read the article for context):

When all the above factors are combined it turns out that each (disk) track contains an image of everything ever written to it, but that the contribution from each "layer" gets progressively smaller the further back it was made. Intelligence organisations have a lot of expertise in recovering these palimpsestuous images.

To effectively erase a medium to the extent that recovery of data from it becomes uneconomical requires a magnetic force of about five times the coercivity of the medium... (a modern hard drive has a  coercivity of 1400-2200 Oe).... Even the most powerful commercial AC degausser cannot generate Oe needed for full erasure. It may be necessary to resort to physical destruction of the media to completely sanitise it (in fact since degaussing destroys the sync bytes, ID fields, error correction information, and other paraphernalia needed to identify sectors on the media, thus rendering the drive unusable, it makes the degaussing process mostly equivalent to physical destruction).

One example of an adequate degausser was the 2.5 MW Navy research magnet used by a former Pentagon site manager to degauss a 14" hard drive. It bent the platters on the drive...

Comments:

EASEUS DataRecoveryWizard is a complete range of data recovery software for all Windows operating system platforms and supports various file systems including FAT, FAT16, VFAT, FAT32, NTFS, NTFS5 on various storage media. EASEUS DataRecoveryWizard ensures safe and precise file recovery against numerous threats like accidental file deletion and disk formatting and so on. For more detail: http://www.easeus.com/

Posted by erdod on January 09, 2006 at 02:25 PM EST #

Good article.

Posted by aqedol on January 18, 2006 at 04:17 PM EST #

I've spent the past 5 weeks building a new life on my new hard drive. I've been working here for a year and a half and no, I didn't have any backup of any kind. It's like being a new employee again. No e-mail. No bookmarks. I've already heard it all from my loving and caring colleagues here at SNC, so don't start...

Posted by 数据恢复 on April 05, 2006 at 06:32 PM EDT #

EaseUs Data Recovery Wizard is also a good tool http://www.yaodownload.com/utilites/file-disk-management/data-recovery-wizard/

Posted by jim on April 17, 2006 at 03:32 PM EDT #

The data recovery software are a great help. But for many people who dont have time to try all these just like there are many organisations helping in the data recovery. one such being http://www.diskdoctors.com/ from where i got my recovery, liked the way these guys worked and on time delivery.

Posted by Robin on June 14, 2006 at 01:27 AM EDT #

Wow, I don't think that I will ever have to go that far to get the data I need. I'm just happy that my Stompsoft's Recover Lost Data can get back the files I need. Though, it is simultaneously scary and reassuring that there are ways to retrieve nearly anything for the right price.

Posted by Will on September 08, 2006 at 07:41 PM EDT #

I hear you Will. I found it to be very disheartening to know that my whole computer life could be pried open by a determined individual. Though, on one hand I understand that such measures are needed to catch the "bad guys" but on the flip side criminals could reek havoc with your personal information. I guess though if I stop and think for a moment, I realize that make use of the same software that you do and subsequently I guess we all enjoy the ability to get back what, by fate, we should not have.

Posted by jim wessel on September 15, 2006 at 07:58 AM EDT #

Recover your lost data and get back deleted files using Recover Data Software.

Posted by Recover Data on April 26, 2007 at 04:43 AM EDT #

Kernel Linux - Ext2 & Ext3 Data Recovery Software supports LVM Partition PARTIALLY http://www.datarecoverylinux.com

Posted by LVM Recovery on May 28, 2007 at 02:10 AM EDT #

Recover Data for Linux - Ext2 & Ext3 Data Recovery Software also supports LVM Partition Recovery PARTIALLY http://www.recoverdatasoftware.com/recover-linux-files

Posted by Linux Recovery on May 28, 2007 at 03:47 AM EDT #

<a href="http://www.qweas.com/download/system/data_recovery/okoker_data_recovery.htm"Okoker Data Recovery can help you to recover all the deleted and lost your data. You can use the software: missing or lost partition recovery, deleted partition recovery, deleted file recovery.

Posted by monicker on June 28, 2007 at 07:38 PM EDT #

Advance Novell Data Recovery Software tool supports NWFS, Net386 and NSS file systems and recovers novell data in case the disk crashed using Kernel Novell data recovery software. <a href="http://www.datarecoverynovell.com ">Data Recovery Novell http://www.datarecoverynovell.com

Posted by Novell Data Recovery on July 20, 2007 at 12:37 AM EDT #

Advance Novell Data Recovery Software tool supports NWFS, Net386 and NSS file systems and recovers novell data in case the disk crashed using Kernel Novell data recovery software. http://www.datarecoverynovell.com

Posted by Novell Data Recovery on July 20, 2007 at 12:39 AM EDT #

Best tool to repair bkf file quickly. Bkf repair software fixes corrupted backup files quickly and easily. It is a advance ms backup recovery utility, recovers files from damaged msbackup file or bkf file created using Windows (ntbackup.exe), Veritas Backup Exec Software. http://www.bkffilerecovery.com

Posted by Ms Backup Recovery on July 20, 2007 at 12:40 AM EDT #

MS Outlook PST Repair tool - Corrupt PST Repair software for outlook email recovery. Fix corrupt MS Outlook PST. http://www.pstrepair.net

Posted by Pst Repair on July 20, 2007 at 12:43 AM EDT #

Outlook PST Recovery tool - Corrupt PST Repair software for outlook email recovery. Fix damaged Outlook PST (Personal Folders) file. Repair PST software tool enables you to restore, retrieve rebuild PST file from corrupt or damaged outlook email storage file. http://www.repairpst.net

Posted by Repair Pst File on July 20, 2007 at 12:44 AM EDT #

Convert OST is a OST to PST conversion tool. It is a Advance Exchange Outlook OST recovery software tool to perform the OST to PST Conversion for ost email Recovery. Quickly retrieve Outlook OST Emails (Offline STorage). Convert OST software enables you to restore, retrieve &amp; rebuild OST file from orphaned outlook OST email storage file. http://www.convertost.com

Posted by Ost to Pst Conversion on July 20, 2007 at 12:48 AM EDT #

Kernel DBF Recovery Software Tool repairs corrupted or damaged Foxpro database files and dBase Files, backup archives corrupted due to unrecognized database format, virus attacks, unproper shutdown or media corruption. Kernel DBF Recovery Software Tool provides the facility of single or multiple file repairing at a time.

Posted by DBF Recovery on July 29, 2007 at 07:36 PM EDT #

Kernel DBF Recovery Software Tool repairs corrupted or damaged Foxpro database files and dBase Files, backup archives corrupted due to unrecognized database format, virus attacks, unproper shutdown or media corruption. Kernel DBF Recovery Software Tool provides the facility of single or multiple file repairing at a time.

Posted by DBF Recovery on July 29, 2007 at 07:39 PM EDT #

Kernel ZIP Repair software tool effectively recovers the corrupt zip file(s). ZIP File Repair Software performs an extensive scan of the corrupt zip files and instantly recovers zipped file(s) compressed through any compression utility.

Posted by Zip Recovery on July 29, 2007 at 07:43 PM EDT #

Software tool to repair corrupt ms backup files created using NTBACKUP.

Posted by MS Backup Repair on July 29, 2007 at 07:45 PM EDT #

Recover data from corrupt partitions using partition recovery software tool.

Posted by Partition Recovery on July 29, 2007 at 07:47 PM EDT #

Perform computer data recovery using computer file recovery software tools.

Posted by Computer Data Recovery on July 29, 2007 at 07:50 PM EDT #

Repair damaged bkf files using Windows Backup Recovery software tool.

Posted by MS Backup Recovery on July 29, 2007 at 07:52 PM EDT #

Get back novell data from corrupt novell volumes using Novell Data Recovery Software tool.

Posted by Novell Data Recovery on July 29, 2007 at 07:54 PM EDT #

Outlook Express Repair software tool is Advanced Outlook Express email recovery software for restoring corrupt or damaged data of Outlook Express including Emails, Deleted Items, Sent Items, Drafts, and Inbox etc.

Posted by Outlook Repair on July 29, 2007 at 08:15 PM EDT #

PST Repair is a advanced outlook recovery software to recover and restore deleted email from corrupt or damaged pst file.

Posted by Fix PST on July 30, 2007 at 01:19 AM EDT #

Outlook Recovery tools to recover email from Outlook data files. Recover email from Outlook PST, Outlook OST files

Posted by Outlook Recovery on August 16, 2007 at 07:28 PM EDT #

Photo recovery software can recover deleted pictures from cameras, digital media, memory cards, SD cards, disk drives.

Posted by Photo Recovery on August 16, 2007 at 07:29 PM EDT #

Powerpoint Recovery Software and Fix PPT tool to repairs, fixes corrupted MS Powerpoint presentation files quickly and easily. Kernel for powerpoint repair is a advance fix ppt repair utility, rebuilds usable powerpoint presentation files from damaged ms powerpoint .ppt file.

Posted by PPT Recovery Tool on August 16, 2007 at 07:31 PM EDT #

thank you for your information

i recover my 120G data !!!!

Posted by anyu on August 16, 2007 at 07:40 PM EDT #

Hey Dave

Nice writeup about the data recovery science and the microscopic issues..

Good Work!!!!

Posted by Computer Data Recovery Software on August 17, 2007 at 11:03 PM EDT #

there are number of software product which can help damaged data recover by a disk crash or by a virus and some other reason may be. But beware of those software which'll corrupt ur data. There is diffrent kind of software if i'm not wrong coz i have a very bitter experience about this . If you want to go for a better software to recover your data you just click this site called www.hdrconline.com They have some real good tools or software coz i'm one of thier regular customer and i love thier dedication and thier quality product. So try it.
Regards
kelsang

Posted by raj on August 19, 2007 at 10:41 PM EDT #

hi
how to recover my data

Posted by raj on August 19, 2007 at 10:48 PM EDT #

@ raj,

I dont think that any of the data recovery software can corrupt or cause damage to your data. It only happens when users try to recover data on the bad device which then corrupts the original data by replacing it with.

The rule goes that nothing should be tried on damaged drive as it will overwrite the original contents, alwayas perfrom data recovery on spare drive or any external media, then it will not harm the original data.

Could not understand your views of first going against the data recovery software in your 1st post and then asking how to recover data in 2nd post????

Posted by computer recovery on August 19, 2007 at 10:57 PM EDT #

Each data recovery software has limitations, for example it will help if you have a logical problem, but it will not work if you have a noisy drive or your drive has a mechanical failure.

Posted by Promise Data Recovery Chicago on August 23, 2007 at 05:42 AM EDT #

yes, some of the data recovery software might have limitations for noisy or mechanical failures but prevention is the best cure. Whenever such sounds are heard from the drive or you come to know any hint of mechanical failures; one should start backing up data immidiately.

If you never get the chance, then data recovery services are the best solution. Data recovery technicians can recover your data by working on the damaged disk...

Posted by OST Recovery on August 23, 2007 at 06:05 PM EDT #

It was like a nightmare to me when i was a college student before a couple of years back.I have one p.c where i stored all myimportant file , notes, and almost everything. Somehow, it got all deleted which i dont how it is deleted. I tried to back it up but i failed. Thank god that somebody suggested me one Data recovery centre and it is HDRc in nehru place delhi. It saved my live.I have their kindness still in me. They have a wonderful staff and very efficient tools and they did my work 100%. Thanks HDRC. Guys , if u face such kindda problem click this site www.hdrconline.com They will not let u down./
Cheers

Posted by sunita on August 29, 2007 at 11:45 PM EDT #

good article!!!

Posted by data recovery on September 04, 2007 at 03:56 PM EDT #

If you find that your hard drive is clicking, the first and foremost thing you must do is shut down your system to prevent further damage. This will reduce the chances of permanent damage and will also reduce the risk of making your data unrecoverable. If the hard drive is clicking, making grinding/scraping or whirring sounds, the BIOS does not recognize and accept the drive; external hard drive, laptop or system or was jarred or dropped; the computer was exposed to water or fire/smoke damage. When a hard drive is exposed to any of these things, it will result in physical and internal damage to the read/write head of the hard drive and/or the platters.
When the hard drive is in action, the read/write heads do not rest on the platters. During operating, the heads ride on a micro-cushion of air that prevents it from making any physical contact with the surface of the platters. When the head of the hard drive begins scratching the platters, it results in loss of information. This is known as clicking. If you try to keeping switching off and booting your computer again and again, you are causing more damage and this can result in permanent data loss. A clicking hard drive is a very serious symptom of hard drive crash and must be taken seriously.
The best thing to do when your hard drive crashes is to switch off the system and not boot it up again. Keep it switched off and let a professional technician deal with it. Sometimes disassembly of the hard drive is required in order to recover data. It depends on the extent of the damage to the hard drive. In clean room environment, the covers and seals are removed from the hard drive so that technicians can work on or replace internal parts while maintaining the warranties.
The technician first begins by identifying the problem and replacing problem causing internal parts like read/write heads, re-writing firmware, performing platter swaps, recalibrating and realigning file structures and restoring as much of the data as possible. Hard drives that click generally go a clean environment room where they are disassembled and the individual components are checked for scratching, scoring, correct calibration, ohm reading and failed chips. ROM chips and firmware is also checking. The spindle motor will be tested for proper rotations, speed, alignment and frozen or damaged bearings. Mechanisms that can identify the damaged are used to test the hard drive for overwriting and damage. Faulty parts are replaced and new firmware is installed. When the hard drive is brought to a ready state, the raw image is created sector by sector. After the imaging process, data is recovered, critical files are checked for damage and integrity and the data is saved to a new physical location like an external hard drive.
If the hard drive is not suffering from any severe mechanical or electrical failure then it is sent to a cloning room where bit by bit and sector by sector raw images are created. Once an image of the hard drive is obtained, it is read to make sure the files are not corrupt and the critical files and folders are recovered and copied onto a new physical location. Imaging can take anywhere between 2 to 16 hours depending on the extremity of data loss and the size of the hard drive.
Hard drive data recovery depends on the severity of damage and failure. It is best to keep regular backups of important files and folders to avoid complications due to a hard drive crash. Always make sure you handle an external hard drive carefully and do not hit your computer if it hangs – the hard drive just might crash due to the force!

Posted by RAID data recovery on September 22, 2007 at 02:12 PM EDT #

Post a Comment:
Comments are closed for this entry.
About

dcb

Search

Archives
« April 2014
SunMonTueWedThuFriSat
  
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
   
       
Today
News
Blogroll

No bookmarks in folder