|
Wednesday March 09, 2005
| The Science of Data Recovery | Computers |
Chris Gerhard made an off hand comment about the fact that disk scrubbing simply hinders (doesn't necessarily prevent) a motivated attempt to retrieve information from a disk drive. Disk Scrubbing is the process of (attempting to) securely erasing a disk to prevent others from accessing previously stored information. This is typically done by writing (possibly multiple times) random data over the entire surface of a disk.
Since I work with various government accounts/agencies/programs, this is an area of interest to me and some of my clients.
You might think that a digital medium designed to store only zeros
and ones would be immune to forensic recovery of residual data once the
zeros and ones are randomly altered. The fallacy with this is that
magnetic storage is not a digital medium at all. Magnetic domains are
created when the read/write head applies energy to a bit location to
align some (not all) of the particles to reflect either a zero or a
one. The precise location of the "domain" for each write varys slightly
in three dimensions (including depth). This reality provides
interesting opportunities or risk (depending on your perspective).
A colleague (thanks Joe) pointed me to a fascinating report on techniques involved in recovering data from ostensibly erased disks and computer memory. This is amazing and spooky stuff for the technically inclined. Here is another report (thanks Kurt) that's also very interesting and enlightening. Joe also pointed me to Prof. Gutman's website, who has a lifetime of security related knowledge to share!
Here are a few brief excerpts (read the article for context):
When
all the above factors are combined it turns out that each (disk) track
contains an image of everything ever written to it, but that the
contribution from each "layer" gets progressively smaller the further
back it was made. Intelligence organisations have a lot of expertise in
recovering these palimpsestuous images.
To
effectively erase a medium to the extent that recovery of data from it
becomes uneconomical requires a magnetic force of about five times the
coercivity of the medium... (a modern hard drive has a coercivity of 1400-2200 Oe).... Even the most powerful commercial AC degausser cannot generate Oe needed for full erasure. It
may be necessary to resort to physical destruction of the media to
completely sanitise it (in fact since degaussing destroys the sync
bytes, ID fields, error correction information, and other paraphernalia
needed to identify sectors on the media, thus rendering the drive
unusable, it makes the degaussing process mostly equivalent to physical
destruction).
One example of an adequate degausser was
the 2.5 MW Navy research magnet used by a former Pentagon site manager
to degauss a 14" hard drive. It bent the platters on the drive...
March 09, 2005 03:19 AM EST Permalink
Posted by jim on April 17, 2006 at 10:32 PM EDT #
Posted by Robin on June 14, 2006 at 08:27 AM EDT #
Posted by Will on September 09, 2006 at 02:41 AM EDT #
Posted by jim wessel on September 15, 2006 at 02:58 PM EDT #
Posted by Recover Data on April 26, 2007 at 11:43 AM EDT #
Posted by LVM Recovery on May 28, 2007 at 09:10 AM EDT #
Posted by Linux Recovery on May 28, 2007 at 10:47 AM EDT #
Posted by Novell Data Recovery on July 20, 2007 at 07:37 AM EDT #
Posted by Novell Data Recovery on July 20, 2007 at 07:39 AM EDT #
Posted by Ms Backup Recovery on July 20, 2007 at 07:40 AM EDT #
Posted by Pst Repair on July 20, 2007 at 07:43 AM EDT #
Posted by Repair Pst File on July 20, 2007 at 07:44 AM EDT #
Posted by Ost to Pst Conversion on July 20, 2007 at 07:48 AM EDT #
Posted by DBF Recovery on July 30, 2007 at 02:36 AM EDT #
Posted by DBF Recovery on July 30, 2007 at 02:39 AM EDT #
Posted by Zip Recovery on July 30, 2007 at 02:43 AM EDT #
Posted by MS Backup Repair on July 30, 2007 at 02:45 AM EDT #
Posted by Partition Recovery on July 30, 2007 at 02:47 AM EDT #
Posted by Computer Data Recovery on July 30, 2007 at 02:50 AM EDT #
Posted by MS Backup Recovery on July 30, 2007 at 02:52 AM EDT #
Posted by Novell Data Recovery on July 30, 2007 at 02:54 AM EDT #
Posted by Outlook Repair on July 30, 2007 at 03:15 AM EDT #
Outlook Recovery tools to recover email from Outlook data files. Recover email from Outlook PST, Outlook OST files
Posted by Outlook Recovery on August 17, 2007 at 02:28 AM EDT #
Photo recovery software can recover deleted pictures from cameras, digital media, memory cards, SD cards, disk drives.
Posted by Photo Recovery on August 17, 2007 at 02:29 AM EDT #
Powerpoint Recovery Software and Fix PPT tool to repairs, fixes corrupted MS Powerpoint presentation files quickly and easily. Kernel for powerpoint repair is a advance fix ppt repair utility, rebuilds usable powerpoint presentation files from damaged ms powerpoint .ppt file.
Posted by PPT Recovery Tool on August 17, 2007 at 02:31 AM EDT #
thank you for your information
i recover my 120G data !!!!
Hey Dave
Nice writeup about the data recovery science and the microscopic issues..
Good Work!!!!
Posted by Computer Data Recovery Software on August 18, 2007 at 06:03 AM EDT #
there are number of software product which can help damaged data recover by a disk crash or by a virus and some other reason may be. But beware of those software which'll corrupt ur data. There is diffrent kind of software if i'm not wrong coz i have a very bitter experience about this . If you want to go for a better software to recover your data you just click this site called www.hdrconline.com They have some real good tools or software coz i'm one of thier regular customer and i love thier dedication and thier quality product. So try it.
Regards
kelsang
Posted by raj on August 20, 2007 at 05:41 AM EDT #
hi
how to recover my data
Posted by raj on August 20, 2007 at 05:48 AM EDT #
@ raj,
I dont think that any of the data recovery software can corrupt or cause damage to your data. It only happens when users try to recover data on the bad device which then corrupts the original data by replacing it with.
The rule goes that nothing should be tried on damaged drive as it will overwrite the original contents, alwayas perfrom data recovery on spare drive or any external media, then it will not harm the original data.
Could not understand your views of first going against the data recovery software in your 1st post and then asking how to recover data in 2nd post????
Posted by computer recovery on August 20, 2007 at 05:57 AM EDT #
Each data recovery software has limitations, for example it will help if you have a logical problem, but it will not work if you have a noisy drive or your drive has a mechanical failure.
Posted by Promise Data Recovery Chicago on August 23, 2007 at 12:42 PM EDT #
yes, some of the data recovery software might have limitations for noisy or mechanical failures but prevention is the best cure. Whenever such sounds are heard from the drive or you come to know any hint of mechanical failures; one should start backing up data immidiately.
If you never get the chance, then data recovery services are the best solution. Data recovery technicians can recover your data by working on the damaged disk...
Posted by OST Recovery on August 24, 2007 at 01:05 AM EDT #
It was like a nightmare to me when i was a college student before a couple of years back.I have one p.c where i stored all myimportant file , notes, and almost everything. Somehow, it got all deleted which i dont how it is deleted. I tried to back it up but i failed. Thank god that somebody suggested me one Data recovery centre and it is HDRc in nehru place delhi. It saved my live.I have their kindness still in me. They have a wonderful staff and very efficient tools and they did my work 100%. Thanks HDRC. Guys , if u face such kindda problem click this site www.hdrconline.com They will not let u down./
Cheers
Posted by sunita on August 30, 2007 at 06:45 AM EDT #
good article!!!
Posted by data recovery on September 04, 2007 at 10:56 PM EDT #
If you find that your hard drive is clicking, the first and foremost thing you must do is shut down your system to prevent further damage. This will reduce the chances of permanent damage and will also reduce the risk of making your data unrecoverable. If the hard drive is clicking, making grinding/scraping or whirring sounds, the BIOS does not recognize and accept the drive; external hard drive, laptop or system or was jarred or dropped; the computer was exposed to water or fire/smoke damage. When a hard drive is exposed to any of these things, it will result in physical and internal damage to the read/write head of the hard drive and/or the platters.
When the hard drive is in action, the read/write heads do not rest on the platters. During operating, the heads ride on a micro-cushion of air that prevents it from making any physical contact with the surface of the platters. When the head of the hard drive begins scratching the platters, it results in loss of information. This is known as clicking. If you try to keeping switching off and booting your computer again and again, you are causing more damage and this can result in permanent data loss. A clicking hard drive is a very serious symptom of hard drive crash and must be taken seriously.
The best thing to do when your hard drive crashes is to switch off the system and not boot it up again. Keep it switched off and let a professional technician deal with it. Sometimes disassembly of the hard drive is required in order to recover data. It depends on the extent of the damage to the hard drive. In clean room environment, the covers and seals are removed from the hard drive so that technicians can work on or replace internal parts while maintaining the warranties.
The technician first begins by identifying the problem and replacing problem causing internal parts like read/write heads, re-writing firmware, performing platter swaps, recalibrating and realigning file structures and restoring as much of the data as possible. Hard drives that click generally go a clean environment room where they are disassembled and the individual components are checked for scratching, scoring, correct calibration, ohm reading and failed chips. ROM chips and firmware is also checking. The spindle motor will be tested for proper rotations, speed, alignment and frozen or damaged bearings. Mechanisms that can identify the damaged are used to test the hard drive for overwriting and damage. Faulty parts are replaced and new firmware is installed. When the hard drive is brought to a ready state, the raw image is created sector by sector. After the imaging process, data is recovered, critical files are checked for damage and integrity and the data is saved to a new physical location like an external hard drive.
If the hard drive is not suffering from any severe mechanical or electrical failure then it is sent to a cloning room where bit by bit and sector by sector raw images are created. Once an image of the hard drive is obtained, it is read to make sure the files are not corrupt and the critical files and folders are recovered and copied onto a new physical location. Imaging can take anywhere between 2 to 16 hours depending on the extremity of data loss and the size of the hard drive.
Hard drive data recovery depends on the severity of damage and failure. It is best to keep regular backups of important files and folders to avoid complications due to a hard drive crash. Always make sure you handle an external hard drive carefully and do not hit your computer if it hangs – the hard drive just might crash due to the force!
Posted by RAID data recovery on September 22, 2007 at 09:12 PM EDT #
Comments are closed for this entry.
This is a personal weblog, I do not speak for my employer.