Computer Experts Can You Answer This?

[GB]

I would have the opinion that once a drive is over written, very little if any of the original file is recoverable.

then why do you always hear about the police getting hold of hard drives and recovering information that was supposedly erased? Maybe that really does not happen as much as I think it does. Perhaps I am confusing TV with real life.

We format our drives when we dispose of them by slamming them against a concrete floor, so no data is recoverable. I'm not so sure that's the best way.

I do the same thing. I then take a hammer to it and go to town. It might not be the best way, but I am confident that it is enough so that someone would need to have a real reason to try to get any info and since my most sensitive data is my baning info and I am far from rich I doubt anyone would go through any real effort to try to get my data after I smash the drive to bits.

 

[blissful]

then why do you always hear about the police getting hold of hard drives and recovering information that was supposedly erased? Maybe that really does not happen as much as I think it does. Perhaps I am confusing TV with real life.

I think the police and detectives WANT you to believe they CAN recover whatever, about whatever. If a person deletes something, it's recoverable if it isn't overwritten. Which is why I think a person needs to make sure it's over written if they want it erased. There's a BUNCH of bravado with authoritarian type police and detectives, that they have SO much power or knowledge--oh yeah. And there is so much they don't know, like in my state their driving, criminal, divorce etc records are on an online database, so you can look it up, as an average citizen. It makes them crazy, they think you know because you are stalking them...lol. They like to 'talk' a lot, it makes them crazy. Crazy people with guns, how cool is that? Versus average people w/ or w/o out. Don't ask me how I know.I'd be a good asset to a detective force needing IT help.

 

[bullseye]

GB--

A hard drives files if simply erased and removed from the trash bin can still be easily recovered if all the sectors occupied have not been overwritten. This is done using a compression algorithm known as lossy compression--the parts of the file not available are predictable to a high degree by the pattern that is left. The scenario you describe is somewhat different, i.e. the writing of a file of exactly the same size in the same space. It is a lot trickier, but files pieces do not use every bit in every cluster. Even if eash and every bit, however, is overwritten, there is a residual magnetic charge left from the old image. It is sometimes called a palimpsest, which derives from the time when writing material was very expensive. When the usefulness of the document was over, it would be scraped clean and reused, but it was still possible to rescrape it and recover what had been underneath. Similarly, data written on magnetic media over other data can be "scraped" off to allow access to what underlies it. This can be done because the magnetic particles that are used to store binary data have a memory once written to. It is possible, though expensive and tedious, to go back two or three iterations of data written and overwritten. The only--so far--reliable method of completely erasing data from magnetic media such as hard drives is to write a bit-wise pattern of zeroes many times, effectively reducing the magnetic residual memory to an unusable state. The hammer method would not deter a determined tech with enough funding and at least most of the pieces. Hope that helps! (BTW, just what are you trying to erase? )

 

[msmofet]

like i said you need to write the drive to zeros to completely erase the drive. without the 1's there is no info.

 

[bullseye]

like i said you need to write the drive to zeros to completely erase the drive. without the 1's there is no info.

Yes, but you need to do it several times, at least.

 

[jet]

You need larger hard drives for a number of reasons:

1. Microsoft Windows is sloppy, and accumulates junk which slowly takes up additional disk space.
2. As hard drives have gotten bigger, applications and data have also gotten bigger.
3. Users accumulate more "stuff" on their hard drives (e.g. pictures, video clips).

As previously stated, when you delete a file, it's not immediately gone. It is simply removed from the file allocation table. That means if you hit delete the second before the cops kick in the door, you're sunk. If you deleted it months ago, the chances are much lower that the data can be recovered.

 

[jet]

Yes, but you need to do it several times, at least.

I you write zeros over every bit on the hard drive (just one time), what could possibly be left to recover?

 

[msmofet]

I you write zeros over every bit on the hard drive (just one time), what could possibly be left to recover?

there isn't anything to recover. zeros are zeros. the drive can't read just zeros it needs the ones also, thats what makes it readable.

 

[bullseye]

I you write zeros over every bit on the hard drive (just one time), what could possibly be left to recover?

To even the casual geek, nothing. I have, however, recovered data from hard drives that have been low level formatted (theoretically returned to the factory state), partitioned in a different way, and populated with new data. It's all a matter of how much time you can spend. For the why, see my first post in this thread.

 

[GB]

GB--

A hard drives files if simply erased and removed from the trash bin can still be easily recovered if all the sectors occupied have not been overwritten. This is done using a compression algorithm known as lossy compression--the parts of the file not available are predictable to a high degree by the pattern that is left. The scenario you describe is somewhat different, i.e. the writing of a file of exactly the same size in the same space. It is a lot trickier, but files pieces do not use every bit in every cluster. Even if eash and every bit, however, is overwritten, there is a residual magnetic charge left from the old image. It is sometimes called a palimpsest, which derives from the time when writing material was very expensive. When the usefulness of the document was over, it would be scraped clean and reused, but it was still possible to rescrape it and recover what had been underneath. Similarly, data written on magnetic media over other data can be "scraped" off to allow access to what underlies it. This can be done because the magnetic particles that are used to store binary data have a memory once written to. It is possible, though expensive and tedious, to go back two or three iterations of data written and overwritten. The only--so far--reliable method of completely erasing data from magnetic media such as hard drives is to write a bit-wise pattern of zeroes many times, effectively reducing the magnetic residual memory to an unusable state. The hammer method would not deter a determined tech with enough funding and at least most of the pieces. Hope that helps! (BTW, just what are you trying to erase? )

Thanks bullseye. This actually helps a lot. So basically, often times the data is still really able to be recovered, but it is cost prohibitive.

 

[msmofet]

To even the casual geek, nothing. I have, however, recovered data from hard drives that have been low level formatted (theoretically returned to the factory state), partitioned in a different way, and populated with new data. It's all a matter of how much time you can spend. For the why, see my first post in this thread.

is there a free app that can write zeros to a laptop with vista, out there?

 

[bullseye]

Thanks bullseye. This actually helps a lot. So basically, often times the data is still really able to be recovered, but it is cost prohibitive.

That is absolutely correct, GB. The cost can easily run into the thousands; the really advanced stuff can be well into the tens of thousands. The state of the art stuff, I have no idea. It needs to be really worthwhile.

 

[msmofet]

also bullseye how do i reset my IP? i can no longer get onto a favorite board and i have lost my JAVA options in the advanced tab of internet options.

 

[bullseye]

is there a free app that can write zeros to a laptop with vista, out there?

Yes, but not, as far as I know, selectively and effectively. You need to erase all and start from scratch.

 

[bullseye]

also bullseye how do i reset my IP? i can no longer get onto a favorite board and i have lost my JAVA options in the advanced tab of internet options.

For the IP reset, open a command prompt, type "ipconfig /renew" and hit enter. I'm not sure what your JAVA issues are; can you expand?

 

[msmofet]

Yes, but not, as far as I know, selectively and effectively. You need to erase all and start from scratch.

well i had something go whacky and i now can't get onto a board that i know is fine. i spoke to the owners and they say it is not on their side. and said maybe i need to reset my ip. i can't get onto that board using any stand alone browser like chrome, firefox, netscape or avant even AOL explorer doesn't work. i CAN get onto the board through the AOL platform which i hate using except to get my email. i have lost jave options and no java appears in my add/remove but i know it is there. i think there are some components of java missing. i have done a complete reinstall of my OS but it did not cure the problem with java or the website. when vista does a reinstall it places a copy of the old files in my c drive. not a partion. when i open computer in the laft pane it has local disk c and in the list there is listed:
windows
windows.old

i had a program to write my XP to zeros but i don't think it will work for this puter.

any help would be useful.

 

[jet]

To even the casual geek, nothing. I have, however, recovered data from hard drives that have been low level formatted (theoretically returned to the factory state), partitioned in a different way, and populated with new data. It's all a matter of how much time you can spend. For the why, see my first post in this thread.

Formatting a hard disk drive (HDD) does not erase it. I was simply pointing out that if you write zeros over every bit on a HDD, there is absolutely nothing left to recover. Some utilities will write random ones and zeros over every bit and make multiple passes. That's not to be thorough, but to attempt to conceal the fact the wipe every took place.

There are a couple of points on the data recovery issue that I failed to mention. Things like System Restores, temporary files and meta data are often overlooked. The enormous size of HDD's themselves can be a problem. Let's say you have a 250GB HDD that has 199GB of free space and today you delete a 1GB file. Tomorrow you have 200GB free and you add a new 1GB file. What are the chances that the new file will overwrite the old file (which still physical resides on disk)? That file, or significant portions of it, might easily still exist in six months.

 

[bullseye]

well i had something go whacky and i now can't get onto a board that i know is fine. i spoke to the owners and they say it is not on their side. and said maybe i need to reset my ip. i can't get onto that board using any stand alone browser like chrome, firefox, netscape or avant even AOL explorer doesn't work. i CAN get onto the board through the AOL platform which i hate using except to get my email. i have lost jave options and no java appears in my add/remove but i know it is there. i think there are some components of java missing. i have done a complete reinstall of my OS but it did not cure the problem with java or the website. when vista does a reinstall it places a copy of the old files in my c drive. not a partion. when i open computer in the laft pane it has local disk c and in the list there is listed:
windows
windows.old

i had a program to write my XP to zeros but i don't think it will work for this puter.

any help would be useful.

OK, I don't want to derail this thread about GBs question and turn it into tech support. I don't mind helping out, though, so why not PM me and I'll see what I can do.

BTW, your zeros program for XP probably didn't do what you thought it did; if the boot sector and whatever is used for file allocation control are not also overwritten, you're in the minor leagues.

 

[bullseye]

Formatting a hard disk drive (HDD) does not erase it. I was simply pointing out that if you write zeros over every bit on a HDD, there is absolutely nothing left to recover. Some utilities will write random ones and zeros over every bit and make multiple passes. That's not to be thorough, but to attempt to conceal the fact the wipe every took place.

There are a couple of points on the data recovery issue that I failed to mention. Things like System Restores, temporary files and meta data are often overlooked. The enormous size of HDD's themselves can be a problem. Let's say you have a 250GB HDD that has 199GB of free space and today you delete a 1GB file. Tomorrow you have 200GB free and you add a new 1GB file. What are the chances that the new file will overwrite the old file (which still physical resides on disk)? That file, or significant portions of it, might easily still exist in six months.

I didn't say "format," I said "low level format." Different thing, entirely. A single pass of zeros does not remove the underlying data.

At this point in the thread I want to say that I only jumped in to answer a valid and interesting question from GB. I do this kind of thing for $$$ and DC for my love of cooking. I'm not on the clock, so I'm going to head off to find something interesting to do with the lamb chops on the counter. No offence intended, and if you want some links and/or white papers, let me know.

 

[jet]

I didn't say "format," I said "low level format." Different thing, entirely. A single pass of zeros does not remove the underlying data.

At this point in the thread I want to say that I only jumped in to answer a valid and interesting question from GB. I do this kind of thing for $$$ and DC for my love of cooking. I'm not on the clock, so I'm going to head off to find something interesting to do with the lamb chops on the counter. No offence intended, and if you want some links and/or white papers, let me know.

If you write zeros over every bit on a HDD, there is absolutely never left to recover.

As for your second point, I couldn't agree more. This is supposed to be a holiday weekend. Let's go cook something.