Re: Re: Data Recovery

On Tue, Oct 31, 2006 at 01:27:29PM -0000, bsmathers@reypd.com wrote:
> I agree. It is more of a myth then reality. Physically, the magnetic
> fluxes have been changed when the data is overwritten. Then, only the new
> data patterns will be read. Although it may seem possible, I have never
> seen or heard of it being done successfully. All of the data recovery
> companies I've seen always claim some form of physical, logical, or
> deleted data recovery and not specifically overwritten data recovery.

One thing which might be of interest here: in the old days, with smaller
drives and older technology, data was stored on the drive in a much
more discrete fashion: "there's a 1" and "there's a 0" (as seen by the
spook-type tools). It may well have been straightforward - but tedious -
to get back overwritten data for these kinds of devices.

But modern drives operating in the hundreds of gigabytes use much, much
more advanced magnetic mechanisms that do things like overlapping of bits
which require statistical methods to recover. This is to get back *their
own* bits which have not been overwritten. ECC is at the center of this
universe here.

I once talked with a Western Digital firmware engineer, who told me that
the push for higher/cheaper capacity and performance has required acts of
magnetics that are just on the edge of violating the laws of physics.

It would be wise to check the publication date and reported drive capacity
before extrapolating from previous efforts to modern products.

Steve

-- 
Stephen J Friedl | Security Consultant |  UNIX Wizard  |   +1 714 544-6561
www.unixwiz.net  | Tustin, Calif. USA  | Microsoft MVP | steve@unixwiz.net