Quake3World

Can their data be recovered once deleted? I'm thinking mainly USB key drives here. In principle.

tanks.

No

Buy why not?

Any file-restore app should do no? That is if you don't start writing to the usb too much, otherwise it's less likely that you can recover

FragaGeddon wrote:Buy why not?

I should have put more thought into that reply really. My take on hard drive data security is that it's not possible to recover data from the drive after a single write, either. The reason I hold that position is because it's never been demonstrated, the most that's ever been said about recovering data after an overwrite lies firmly in the realm of theoretical scientific reports based on very specific electron microscope observations where it was possible to determine the history of a single bit. Being concerned about that kind of potential 'recovery' of data is something I think we can safely minimise for the time being.

The reason we currently implement 3/7/32-pass wipes is partly based on this theoretical science (and the possible problems it may cause if such observations become feasible on an entire data chunk in the future) but also partly because of some elements of hard drive architecture. For example some wiping patterns are designed to force the drive's write controller to overwrite data on a sector where normally it may decide of its own volition to disregard the command being sent to it and leave the data in place (this is getting into drive controller operation and the limit of my knowledge, but I can prolly dig up some docs if you want to read more)

Also another problem for data sanitation is that HDs have more capacity than they're marketed as having, as it's a given that over time areas of the disk will become unreadable and marked as bad. When this happens, the HDs own firmware allocates the 'block' as unusable, and makes use of some of its spare space to redirect the data that would otherwise be written into the bad block. Hence, if you wrote some data into a block and it then happened to be marked bad, your data may sit in that block and never be touched again. Some data sanitation software addresses this issue, but most don't. Partly because it's a technical nightmare, but partly because the odds of a significant chunk of data being allocated into a bad block and being recoverable is extremely slim.

You should still overwrite data with a single pass on any form of 'permanent' data storage, because most OS delete functions merely clear the reference to the data, and not the data itself. Sorry, I really should have clarified earlier.

Good to know Foo, thanks.

However, my question regarding solid state media (usb key drives mainly) is whether data recovery is within the realm of physical possibility? HDD data recovery aside, though that was a solid read.

have u tried the proggy from my linkage ?

It's a theoretical question, SoM. I don't need to recover data from a usb key at the moment.

Though I do have uses for solid data recovery software so I'll look into it.

Apparently so.

http://www.dtidata.com/resourcecenter/2 ... -recovery/

So the 2 dozen or so apps that are out in the field are all scams?

dzjepp wrote:So the 2 dozen or so apps that are out in the field are all scams?

Who is this directed at?

A lot of data recovery information is snake oil BTW. Lots of companies out there want to charge consultancy and recovery fees but they can only recover data that's not been overwritten. Again, it's a case of trying to find a (genuine) case study where data has been recovered after being overwritten, but they don't exist.

Its as much a myth as 'RAM Tuners'.

I think he just wants to know if it's possible to recover deleted files from a flash or similar type device. I just checked one of my flash drives and was able to locate several deleted files. So yes it is possible, at least if not overwritten.

Yes scourge, that's what I mean. If overwritten though, would anything theoretically salvageable remain?

Is that Eraser program equally effective on this type of media?

It appears to be. Anything that can be formatted with a recognisable file system (NTFS or FAT) can have its data area overwritten.

There are a few caveats as I outlined above but nothing's 100% guaranteed to work.

Well, I tell a lie. There's still no evidence that anyone, anywhere has ever been able to read data off a drive which has been erased, then physically burned and smashed.

The most effective data removal tool is still a hammer.

To that end, I'd imagine usb keys would be much easier to incinerate or destroy beyond the threshold of theoretical data recoverability.

Disconnect it, slap it in a vice, job done.

Then all you have to worry about is the page/temp files.

Right, and if you're set up with Virtual PC I'm guessing that can be all self-contained there. Correct?

Almost completely. VPC will still use your PCs RAM and swap file which is a potential, albeit very minor, hazard....

Best option there is to set the swap file (on your 'real' PC) to 0, reboot, then use VPC.

This has proved fruitful, thank you.