Article 3 of 3: Can The FBI Recover Data You Deleted?

December 14, 2013

This is a guest post series written by Elena Pakhomova, Marketing and Development for the data recovery software company www.ReclaiMe.com.

There are three articles to this series that examines the method(s) of deletion at the user-level, at the operating system level, and at the hardware level. Please visit again to capture the rest of the story…

image

In light of recent high profile espionage events, subject of personal data protection has become very popular. In this article I will try to shed light on the subject of data deletion and answer the question how does one delete the data so that even the FBI fails to restore it.

There are three parts involved in data management on every device, be it a PC, phone, or some other gadget.

User who creates content, manages it, and finally deletes it. –  (SEE ARTICLE #1)

Operating system or more specifically a certain component of operating system called filesystem, which based on user commands stores, deletes, and performs other operations with data on the logical disk level. – (SEE ARTICLE #2)

Hardware – hard disk or other physical device which is responsible for storing data at the lowest level of electromagnetic fields and electric charge.

The behavior of each of the above parts determines how data is being deleted on a particular device and therefore what are the chances to restore it.


Deletion At Hardware Level

At the moment, there are two types of data storage devices differing in how writing, storing, and deleting data on them are implemented.

Rotational hard drives

This group includes familiar to all of us hard drives of various form-factors, vendors, and characteristics. The information on such drives is stored in magnetization which upon read request is transformed into set of bits (basic information units). Magnetized spot of the disk surface is read as 1, while non-magnetized spot produces 0. Although due to the specifics of disk magnetic head, new write does not always destroy the previous data completely, practically it is impossible to recover overwritten data from the modern high density hard drives1.
Thus, if data was overwritten at least once, data recovery for all practical purposes is not possible.

Flash-memory based devices

This group includes the data storage devices based on flash memory – memory cards, USB thumb drives, and solid sate drives (SSD).

Writing, storing, and deleting data on such devices differ from the same processes in the regular hard drives. First, data is stored in the bits as well but now 1 and 0 are the result of voltage in cells rather than magnetization of the surface in a regular hard drive. Unlike the magnetized surface, electronic cells retain no memory of the previous state of each individual bit. This means it is physically impossible to know what data was in particular place earlier.

One more SSD quirk is that new data can be written only to cells zero-filled beforehand. This led to creation of TRIM command which cleans the cells containing unnecessary data when SSD is idle. In case of a typical hard drive, if you do not use the drive for writing new data, most likely your deleted data is still on it. For SSD this trick won’t work because even if you do not use SSD, TRIM process deletes all traces of previous data at the first opportunity. This means that for SSD data recovery is typically useless, although each case has to be considered individually.

Conclusion

As you can see in order to delete files so that even the FBI cannot extract them, it is not enough just to press the “Delete” button. You need to know the specifics of your data storage device such as host operating system (filesystem type as well), what type of the device you deal with – hard drive or SSD, and so on.

Anyway the simplest way to check presence of the deleted data on the disk is to launch any data recovery software and see whether it finds data. You can use different tools and even paid tools (which in practice are more powerful) since in data recovery field demo versions of software fully discover data and often allow either to preview it or to save a small sample.

References

1. Wright, Craig; Kleiman, Dave; Sundhar R.S., Shyaam (December 2008). “Overwriting Hard Drive Data: The Great Wiping Controversy”. Lecture Notes in Computer Science (Springer Berlin / Heidelberg).

Thank You to Elena Pakhomova, Marketing and Development for the data recovery software company www.ReclaiMe.com for this GREAT ARTICLE!

[ COMMENTS ARE WELCOME – CLICK HERE ]


Be Sure To Visit Bookmarks4Techs.com

Bookmarks4Techs.com


Article 1 of 3: Can The FBI Recover Data You Deleted?

November 26, 2013

This is a guest post series written by Elena Pakhomova, Marketing and Development for the data recovery software company www.ReclaiMe.com.

There are three articles to this series that examines the method(s) of deletion at the user-level, at the operating system level, and at the hardware level. Please visit again to capture the rest of the story…

image

In light of recent high profile espionage events, subject of personal data protection has become very popular. In this article I will try to shed light on the subject of data deletion and answer the question how does one delete the data so that even the FBI fails to restore it.

There are three parts involved in data management on every device, be it a PC, phone, or some other gadget.

User who creates content, manages it, and finally deletes it. –  (SEE ARTICLE #1)

Operating system
or more specifically a certain component of operating system called filesystem, which based on user commands stores, deletes, and performs other operations with data on the logical disk level. - (SEE ARTICLE #2)

Hardware – hard disk or other physical device which is responsible for storing data at the lowest level of electromagnetic fields and electric charge. – (SEE ARTICLE #3)

The behavior of each of the above parts determines how data is being deleted on a particular device and therefore what are the chances to restore it.


How A User Deletes Data

Not all people understand that the data recovery result depends on the way you delete the data. There are several ways to delete data; some of them are familiar to every user while the others are known to only a few.

Typical deletion

This is the simplest type of deletion which is known to everyone both a PC user and user of some new-fangled gadget. In this case we just click “Delete” and believe that whatever we delete is gone. However, such deletion does not result in immediate and complete data deletion from a device. First, there is Recycle Bin from which you can often (though not always) restore files by several clicks. Second, when you delete data, even bypassing Recycle Bin, data is never deleted immediately. In this case, only information about the file is removed (its location on the disk, in which folder it was stored and so on). The file content itself is retained for some time making it possible to restore the file under certain circumstances.

Special deletion

This includes those cases when you intentionally want to delete your data in such a way that nobody can recover it.

Format

Format is a quite common method to remove data, although not suitable for removal of individual files and folders. By formatting you can delete all the data stored on the device. Of course, the primary goal of the format procedure is to write blank data structures onto the disk before the first use, rather than to delete data irreversibly. Data deletion is a side effect of format.

Take into account that there are two types of format – quick and complete format. Quick format deletes only information about files rather than their content, while complete format removes data once and for all. Different operating systems and even different versions of the same operating system have different format type set by default. For example in Windows XP neither quick nor complete format deletes data irreversibly but in Windows 7 there is a crisp differentiation between these types of format.

Thus, it is clear that even format does not guarantee that data will be deleted irreversibly. So to be sure that you delete data irretrievably using a format procedure you should check what type of format your operating system uses.

Special erasing software

There are special tools (both free and paid) to erase files from a device irreversibly. Such tools just fill every sector on the device with zeros, so sometimes they are called zero-filling tools.

Among these tools, you should distinguish those which work with the entire disk like Lowvel and erase all the contents of the device and those which work file-by-file and delete a particular file or folder like
File Shredder.

As for the tools working at the file level, it is difficult to ensure that all the parts of file are deleted. This is because the file system has a whole number of peculiarities in storing data.

So, only tools which erase all files can reliably ensure that data is completely deleted and nobody, not even FBI, can restore data after such tools have worked on the device.

Overwriting data

It is quite exotic type of data deletion. The mechanism is similar to data deletion using special software, but in this case data is overwritten with another less valuable data rather than with zeros. Let’s suppose you have a 1TB disk with data you want to delete irreversibly. In this case you need to write exactly 1TB of another data (for example videos) to really overwrite all previous data.

Obviously, it is impossible to use this method if you need to delete a certain file or folder since for guaranteed deletion you have to fill all capacity of a device.

Mechanical disk damage

Surely, there is such an odd way to delete data as to damage the disk mechanically or, better yet, to melt it liquid. With mechanical damage you should be aware that any data recovery lab is able to replace various disk components. So, it is impossible to determine in advance whether data is recoverable based only an external appearance of a damaged disk, unless the disk looks like a pool of molten metal.

Thank You to Elena Pakhomova, Marketing and Development for the data recovery software company www.ReclaiMe.com for this GREAT ARTICLE!

[ COMMENTS ARE WELCOME – CLICK HERE ]


Be Sure To Visit Bookmarks4Techs.com

Bookmarks4Techs.com


Wallpaper of the Week (#118) – A Tibet Lake

April 20, 2013

This week’s wallpaper is in support of one of my fellow bloggers, who manages the site Awesome Wallpapers, who is working his way through school and sports. I decided to pick a recent wallpaper from his collection and came up with this one, a scene at a Tibet Lake that is just awesome.

To Get This Wallpaper – [ CLICK HERE ]

Awesome Wallpapers

Windows 7 (and 8) Users: If you are using Windows 7 (or 8), did you know you can create a desktop background slideshow to show off your pictures and wallpaper images?  To learn how to use this feature [CLICK HERE].

GEEK BONUS AREA

Visit Bookmarks4Techs.com

Bookmarks4Techs.com

The PC Won’t Turn On: Basic Troubleshooting for Power Loss

Using WordPress As A Website In 9 Steps

DTIDATA Data Recovery

image

Subscribe by RSS

Get What's On My PC by Email

Bookmark and Share

[ CLICK HERE TO LEAVE A COMMENT ]


Avoid Retyping A Document With Online OCR

February 21, 2013

I recently was faced with situation where I had a hardcopy of a typed document where there was no editable or electronic version available and I needed a way to access and edit the document without completely retyping it.

It was at this point I started to think in terms of OCR (optical character recognition). OCR is software that has the ability to take typewritten (and sometimes handwritten) text and convert it to a digital version that can be electronically stored and edited. In my case, I did not want to install software on the computer, and started to think even further outside the box. I wondered, are there any online OCR services on the internet?

As I have said before, “if you can think of it, someone has done it”…  There are quite a few OCR services out there that I tried and the one I am settling with is called Online OCR… Online OCR is a free service in a “Guest mode” (without registration) that allows you to convert 15 images per hour.

Online OCR

I was able to take the hardcopy of the document, scan it to a PDF file, upload the PDF file to Online OCR where the text in the file was read and subsequently converted to an editable Microsoft Word document. What sold me on Online OCR was that Online OCR managed to convert the document and retain the formatting (fonts, table, etc…) to near perfection.

Online OCR’s conversion process with recognize 32 languages and can handle up to 8 different input file formats and produce 6 different output formats:

INPUT FORMATS:

  • PDF (All types of PDF files including multi-page PDFs)
  • TIF/TIFF (Multipage TIFFs supported)
  • JPEG/JPG
  • BMP
  • PCX
  • PNG
  • GIF
  • ZIP files containing the above types of files can also be uploaded.

OUTPUT FORMATS:

    • Adobe PDF
    • MS Word 2003/XP
    • MS Excel 2003/XP
    • Html 4.0
    • RTF
    • Text Plain

GEEK BONUS AREA

Bookmarks4Techs

General Data Recovery Knowledges

FBI Cybercrime Division ransomware

6 Levels of Gadget-Dependence: Where do You Stand?

Anti-Static Memory Card Case
Keeps Memory Cards Safely Stored

Subscribe by RSS

Get What's On My PC by Email

Bookmark and Share

[ CLICK HERE TO LEAVE A COMMENT ]


[GEEK SQUEAKS'] – Free PDF Reader, New ThinkPad Tablet, Facebook Danger, Photos Gone Missing and SanDisk Flash Drive Bargain

July 22, 2011

image

Sumatra PDF
Free PDF, XPS, DjVu, CBZ and CBR reader for Windows

Gadgetsholic
Lenovo Thinkpad Tablet Available in the US

Faster PC! Clean! Clean!
Don’t Click that
“This girl must be Out of her Mind” Facebook Video

Data Recovery Blog
5 Reasons Why Your Digital Photos Gone Missing

Geek Deal of the Day @ Amazon
SanDisk Cruzer 16 GB Cruzer USB 2.0 Flash Drive

——————————————-

MORE Geek Squeaks’…

Computers & Accessories Index

Over 600 Bookmarked Tech Sites

[ CLICK HERE TO LEAVE A COMMENT ]


All In One FREE Data Recovery Suite

May 12, 2011

Recently I featured an article, titled A Successful Data Recovery Story Using Some Desperation Moves where the hero of the day was a software application called MiniTool Power Data Recovery.

MiniTool Power Data Recovery

I realize there are numerous undelete recovery apps out there, but for some reason I always go to this app to get the job done. I have found it seems to dig a little deeper than most when recovering deleted data.

In addition, MiniTool Power Data Recovery is a “data recovery suite” which means it does more than the standard apps that are available.

For example, MiniTool Power Data Recovery has the ability to:

- Recover formatted disks or partitions
- Recover damaged partitions
- Recover lost partitions
- Recover CD & DVD disks
- Recover Photos & Flash Memory cards

Home users can use MiniTool Power Data Recovery software to recover their lost data in any condition for free. I highly recommend this app for the tech toolbox.

NOTE: A second hard disk is recommended for recovery. Do not download the software on the drive that contains lost data. This may cause disk overwrite and permanent data loss!!!

StumbleIt

Bookmark and Share

Bookmarks4Techs_Blogger2

[ CLICK HERE TO LEAVE A COMMENT ]


A Successful Data Recovery Story Using Some Desperation Moves

April 15, 2011

A friend recently came to me with an old IDE hard drive that was determined to be dead by a computer tech. He had held onto the drive, which was several years old, with the hope that someday the data on the drive could possibly be recovered, without costing him an arm and a leg. Typically, professional data recovery can be very expensive and there are no guarantees the data can be fully recovered.

Data Recovery

As a challenge, I opted to take a shot at recovering the data on the drive. I placed the drive in an external drive enclosure, powered it up and connected it to my PC. The first bad sign was the clunking noise being generated from the drive and the drive not spinning up properly (which indicated a mechanical problem); AND the second bad sign was that my computer could see the drive but was unable to pull up the file/folder structure (which indicated a potential drive sector or partition issue).

At this point, I had to agree with the original tech’s assessment of the drive; however, it hit me to try a couple of things out of desperation. I put the drive in a ziplock plastic bag and placed it in the freezer for a couple of hours. The theory being that this would cause contraction of the metal parts in the drive. Following the deep freeze, I quickly connected the drive to the PC and I could tell immediately that it was spinning up and the clunking noise had dissipated. My PC could see the drive; however, the sector/partition issue was still looking me in the eye. What I did next was really out of desperation. I started thinking, I can see the drive and if I can see the drive can I format it?  My plan was to do a “quick format” then use data recovery software to extract the data on the drive.  Guess what?  It worked!

Using data recovery software (called Power Data Recovery) I was able to extract every single bit of file data from formatted the drive ( a total of 21 GBs of data). Using the Power Data Recovery software, the data recovery process took over 8 hours to complete.

Several points this article:

  • The Hard Drive Freezer Trick – I do think there is something to this!
  • Data Recovery – Don’t ever think by formatting your drive you are wiping the data from the drive! It can be recovered…
  • Backup Your Files – If you have files on your PC that is close to your heart and soul, make sure you back them up.  Hard Drives do and will fail.

StumbleIt

jaanix post to jaanix

Bookmark and Share

Bookmarks4Techs_Blogger2

[ CLICK HERE TO LEAVE A COMMENT ]


Follow

Get every new post delivered to your Inbox.

Join 245 other followers