[dba-Tech] Retrieving Deleted Files off a hard drive

John Bartow jbartow at fastbytes.com
Fri Aug 1 09:25:59 CDT 2003


BerichtAs does Norton Utilitie's "Wipe Info" program. I haven't been able to
recover the data, but then I'm not a specialist at it either :o)

Even if Symantec or McAfee garaunteed that it would be unrecoverable I would
question it because they both have to deal with the US govt and I don't know
their laws pertaining to this. If they try to control it the wway they have
been attempting to control encryption then I think Martin's friend is
correct throwing it in a hot fire is the only "for sure" method".

I go through this discussion every now and again with my accounting clients.
They ask me about "permanently" removing client info from the hard drive of
old PCs they are going to discard, I physically remove the hard drive and
damage it and then give it back to them. It builds their confidence in my
thoroughness (and gives them second thoughts about buying a cheap solution
in a box). I don't personally believe that there is no way to destroy the
magnetic signatures of files on a hard drive - I just don't know how to do
it or how to prove it can be done.
:o)

I guess the bottom line is that if a particular company wants dirt on
someone the employ they can find with less expensive methods than paying a
data recovery specialist - they're not cheap!

JB

 -----Original Message-----
From: dba-tech-bounces at databaseadvisors.com
[mailto:dba-tech-bounces at databaseadvisors.com]On Behalf Of Jon Tydda
Sent: Friday, August 01, 2003 4:38 AM
To: 'Discussion of Hardware and Software issues'
Subject: RE: [dba-Tech] Retrieving Deleted Files off a hard drive


  McAfee Shredder does that - passes over the disk 7 times writing junk and
erasing it on each pass, making it unrecoverable (they claim).


  Jon
  -----Original Message-----
  From: Erwin Craps [mailto:Erwin.Craps at ithelps.be]
  Sent: 01 August 2003 10:37
  To: Discussion of Hardware and Software issues
  Subject: RE: [dba-Tech] Retrieving Deleted Files off a hard drive


  Formattting a drive will only remove the FAT (File Allocation Tabe), that
the index of where the files are positoned on the drive.
  Formattig does alos put some positionmakers on the disk (that why you
loose useable data on the disk) to find it way on the disk.

  It like a citymap (simply stated) You have an index saying that stree x is
positioned in the square B7.
  Formatting removes the index (creates an empty one) and puts a new grid
(the quares A7) in pace.
  But the data of the old streets are still there.
   So it is just a question to put to put the pieces togheter and build a
new index (simply stated).
  Custers that are overwritten by the format or by new data will corruot the
old file but the rest of the file is still readable.

  There are companies that can rebuild your disk, within 30 minutes,
depending on the size and fragmentaion.

  Only way to clrear a disk is to write random data on each cluster thus
distroying the old data.
  there does exesits software to do that.

  Erwin

    -----Oorspronkelijk bericht-----
    Van: Martin Reid [mailto:mwp.reid at qub.ac.uk]
    Verzonden: vrijdag 1 augustus 2003 11:05
    Aan: Discussion of Hardware and Software issues
    Onderwerp: Re: [dba-Tech] Retrieving Deleted Files off a hard drive


    AFAIK unless you overwrite the data several time using specific software
then its possible to get most things back. One of our guys says the only way
to be totally sure is to melt down the HDD.

    Martin
      ----- Original Message -----
      From: Jon Tydda
      To: 'Discussion of Hardware and Software issues'
      Sent: Friday, August 01, 2003 9:45 AM
      Subject: RE: [dba-Tech] Retrieving Deleted Files off a hard drive


      I formatted a hard disk with windows 95 on it, then plugged it into a
pc running 98. I ran scandisk and all the files came back, so I guess format
ain't everything.



      Jon

      -----Original Message-----
      From: Stoker, Kenneth E [mailto:Kenneth.Stoker at pnl.gov]
      Sent: 31 July 2003 20:50
      To: dba-Tech (E-mail)
      Subject: [dba-Tech] Retrieving Deleted Files off a hard drive



      Everyone,

      I recently had a discussion with a coworker about the subject of
retrieving deleted files off a hard drive.  We got on the subject because we
are having an audit on those company-owned computers systems that some staff
may have at home for business use.  He claims that any file can be
reclaimed, even if a defragmentation has been run.  I thought that once a
disk has been defragmented, those files were truly gone, if the anyone
defragmented the disk, the audit would basically be a waste of time.  Is
this true?  The computer security group here is, I'm sure, quite good, don't
let any limitations be considered in any advise returned to settle this
score.

      If it is possible, does that also apply to a reformatted disk?  I
would think that a reformatted disk would be the ultimate cleanup, but that
would have me wondering now if a defragment doesn't work.  Which would cause
some serious concerns at this location as much of the stuff that I work with
is very sensitive and would make me wonder about correct processes when
buying a new machine and excessing the old one.

      Thanks for your help in settling the discussion.



      Ken Stoker
      Technology Commercialization
      Information Systems Administrator
      PH: (509) 375-3758
      FAX: (509) 375-6731
      E-mail:  Kenneth.Stoker at pnl.gov



      _______________________________________________
      dba-Tech mailing list
      dba-Tech at databaseadvisors.com
      http://databaseadvisors.com/mailman/listinfo/dba-tech
      Website: http://www.databaseadvisors.com



      The information in this e-mail is confidential and may also be legally
      privileged. The contents are intended for recipient only and are
subject
      to the legal notice available on request from :
webmaster at alcontrol.co.uk
      ALcontrol Laboratories is a trading division of ALcontrol UK Limited.
      Registered Office: Templeborough House, Mill Close, Rotherham, S60
1BZ.
      Registered in England and Wales No 4057291



--------------------------------------------------------------------------


      _______________________________________________
      dba-Tech mailing list
      dba-Tech at databaseadvisors.com
      http://databaseadvisors.com/mailman/listinfo/dba-tech
      Website: http://www.databaseadvisors.com




  The information in this e-mail is confidential and may also be legally

  privileged. The contents are intended for recipient only and are subject

  to the legal notice available on request from : webmaster at alcontrol.co.uk

  ALcontrol Laboratories is a trading division of ALcontrol UK Limited.

  Registered Office: Templeborough House, Mill Close, Rotherham, S60 1BZ.

  Registered in England and Wales No 4057291
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://databaseadvisors.com/pipermail/dba-tech/attachments/20030801/10aa8eaf/attachment.html>


More information about the dba-Tech mailing list