Low level format recovery

[Smilin]

Originally posted by: pallejr

Originally posted by: Smilin

You asked if this is an urban legend or not. No it is not. You can read data that has been overwritten. It's not theoretical, it's been done.

You are right, the OP asked if this was urban legend. It is. It is true that researches have been able to recover a bit here and there on old harddrives. I'm puzzled, what will you do with those few random bits? Read your own paper again, and the link I provided. The data density and precision of modern harddrives make it even harder, next to impossible, to restore any bits, let alone an entire drive.

Section 4.2.3 of that doc states that a spin-stand MFM has been demonstrated. This is the method used to get the entire drive, not just a few bits here and there. Regardless..

The question was, "if someone decided to low-level format their hard drive using the manufacturer software, so literally every single byte of data shows as 00, is it still possible for someone to recover the data? "

Difficult, yes. Insanely difficult, yes. Time consuming, yes. Expensive, yes. Commercially viable, probably no.

However... "is it still possible for someone to recover the data?", YES.

We're not debating if it's hard or next to impossible. It is possible. I've got Charles Sobey's whitepaper right here in front of me and I'm looking at a picture of overwritten data with my own eyes.

If you wish to debate more determined efforts to hide data I'll concede. A low level format is one thing but multi-pass DoD wipes, Degaussers and such are a different story.

 

[Smilin]

Originally posted by: Juddog

Originally posted by: Rebel44
It is possible but very expensive.

How expensive are we talking?

Expensive enough to not be commercially viable. I don't think anyone knows but it's up there in the realm of NSA and DoD budgets. For the enterprise crowed it's probably cheaper to completely recreate whatever was lost.

 

[pallejr]

Originally posted by: Smilin

We're not debating if it's hard or next to impossible. It is possible. I've got Charles Sobey's whitepaper right here in front of me and I'm looking at a picture of overwritten data with my own eyes.

http://www.actionfront.com/ts_...moval.aspx#Overwriting

Read this, will you. They very clearly states that it is not possible. You can do nothing with a few random (raw) bits here and there (applies to older drives - with new drives, you get nothing).

(If you care to note, this company also wrote that paper you linked to.)

 

[Smilin]

Originally posted by: pallejr

Originally posted by: Smilin

We're not debating if it's hard or next to impossible. It is possible. I've got Charles Sobey's whitepaper right here in front of me and I'm looking at a picture of overwritten data with my own eyes.

http://www.actionfront.com/ts_...moval.aspx#Overwriting

Read this, will you. They very clearly states that it is not possible. You can do nothing with a few random (raw) bits here and there (applies to older drives - with new drives, you get nothing).

(If you care to note, this company also wrote that paper you linked to.)

The paper you linked was written around six years before the one I linked (which states it can be done) and refers to a hard drive of 200MB (not GB). They are also refering to the theoretical practice of using an electron microscope not a spin-stand MFM.

 

[pallejr]

The paper says the exact same thing. Look back where I quoted the author. He has never seen this technique demonstrated in pratice, to actually recover user data. If the companies could do it, don't you think they would at least recover a couple of such sectors just for the proof-of-concept? That would give them some real respect in the business...

 

[lxskllr]

Originally posted by: pallejr
The paper says the exact same thing. Look back where I quoted the author. He has never seen this technique demonstrated in pratice, to actually recover user data. If the companies could do it, don't you think they would at least recover a couple of such sectors just for the proof-of-concept? That would give them some real respect in the business...

The emphasis in that section was on *commercially viable* Many things can be done that aren't "commercially viable" A company could sell trips to the moon, where you could get out of the lander and walk around on the surface. Due to the effort, cost, and regulations it *isn't commercially viable*, that doesn't mean it can't be done.

 

[pallejr]

*isn't commercially viable*

Did you not read what I said: proof-of-concept? They cannot even produce such one, just a single sector...

 

[lxskllr]

Originally posted by: pallejr
*isn't commercially viable*

Did you not read what I said: proof-of-concept? They cannot even produce such one, just a single sector...

I read what you said, but it's meaningless. I've never seen a platypus, does that mean they don't exist?

Nobody's going to go through the effort of recovering the data just to prove a point. It'll get used when the benefit outweighs the effort.

 

[pallejr]

They wont do it just to prove a point? You are way off with that statement. If they could, they would, I assure you.

 

[lxskllr]

A *commercial* data recovery firm won't do it because nobody could afford the cost of the service. Are they really going to pay their people to recover data just for kicks? The people that need to recover data like that will be able to.

 

[pallejr]

Do you understand the term "proof of concept"? Have you read what "actionfront" says about it? They cannot even recover the contents of a single sector. I'm not sure how money takes part in this.

 

[lxskllr]

Originally posted by: pallejr
Do you understand the term "proof of concept"? Have you read what "actionfront" says about it? They cannot even recover the contents of a single sector. I'm not sure how money takes part in this.

That article was written as recently as 10 years ago. Why not link an article from 1938 stating we can't crack Nazi codes :^/

 

[Smilin]

Believe what you want. I've got shit to do.

 

[pallejr]

the pdf smilin links to is only four years old.

I too, have shit to do. Just read (and understand) what they actually write about it.