Ethical Hacking Training at InfoSec Institute

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Computer Forensics Computer-Forensics
[Top] [All Lists]

Re: 5.25 Inch Disk Data Recovery

Subject: Re: 5.25 Inch Disk Data Recovery
Date: Wed, 25 Aug 2004 13:39:17 -0400
Assuming that your data is unreadable because it just got old, it
might be worth looking into recovery systems that can recover
overwritten data. A solution will almost certainly require investment
in hardware, unfortunately.

The basic theory is that as you write and overwrite and overwrite a
section of disk, only so much of the magnetic medium will assume the
correct orientation. The remaining medium will hold the orientation of
the data that was written previously. A nice discussion (albeit old,
but it's perfect for you) of how to irretrievably recover data can be
found here:

http://www.cs.auckland.ac.nz/~pgut001/pubs/secure_del.html

The (simplified) reason why all your attempts to recover failed is
because the problem isn't based in software -- it's based in hardware.
As magnetic media sits, little bits of magnetic material the comprise
the magnetic medium will change magnetic orientation. This is a
problem because when your disk drive reads a bit, it doesn't see a
straight "0" or "1". It sees a mixture of both and other orientations,
depending on how often that area of disk has been overwritten, the
conditions under which the write occurred and other factors. Your
computer isn't designed to handle your disk drive saying "There is an
80% chance that this is a '0'". So, the drive will guess and say it's
a 0 (which is why your drive won't cut it for this kind of recovery).
Unfortunately, if enough random flips have happened just because the
medium is old, your disk drive will have a harder time determining if
any given bit is a 0 or a 1, making it likely that at least one bit
will be read incorrectly. String enough together and you'll have a
nice pile of garbage. =-)

So, you need to create or obtain hardware that is capable of saying
"This location is 70% 0, 20% 1 and 10% in other orientations" and
software that will capture and save and analyze that data. I have no
clue where to find these things, although the above linked article
does discuss more expensive means of doing this. I would suspect that
with the low data density, you're in luck, however. =-)

Anyway, best of luck to you!
Brian

Come to think of it, wouldn't it be possible to hack a 5.25" drive to
permit this sort of data output? Hmmm....

On Mon, 23 Aug 2004 07:47:41 -0700 (PDT), sety martin
<wearing_a_greyhat@yahoo.com> wrote:
Hi all,

I would appreciate any help in trying to resolve a
problem I am having.

I am trying to recover data from some 5.25 inch disks.
 They came off an older Apple system. (Apple 2?).

I have tried using dd, Ghost, Encase, FTK, Winhex and
Norton Utilites to view/image these diskettes without
any success.

It is not clear to me if there is still valid data on
these disks.  My experience has shown me that data on
a 5.25 inch can get corrupted over time.  Does anyone
know if the tools above could successfully read these
disks?  I am using a 1.2 Mb drive.  If these tools
can't do the job, does anyone know of a definitive way
to get at this data using an x86 or Sun system?

Thanks all,

Sety

_______________________________
Do you Yahoo!?
Win 1 of 4,000 free domain names from Yahoo! Enter now.
http://promotions.yahoo.com/goldrush

-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com




-- 
Brian Kim
bmhkim@cynica.lly.org
bmhkim@gmail.com
585.455.6464

"As a result of the war, corporations have been enthroned and an era of
corruption in high places will follow, and the money power of the
country will endeavor to prolong its reign by working upon the
prejudices of the people until all wealth is aggregated in a few hands
and the Republic is destroyed. I feel at this moment more anxiety for
the safety of my country than ever before, even in the midst of war."
       Abraham Lincoln, 1864

-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com

<Prev in Thread] Current Thread [Next in Thread>