EnCase recover file erased by Eraser 5.7 ?
- Thread starter kknd
- Start date
kknd said:
The short answer is "no". Even one pass with Eraser will eliminate data beyond the ability of any file recovery software (including all forensic software) to recover. I've verified this personally using disk viewing and file-recovery stoftware: Eraser does what it says it does.
The long answer is that if the information in the file is stored elsewhere on the system (e.g. in temp files, deleted or otherwise; in old copies; in program or system logs; in the system page file or hibernation file; in the NTFS journaling file, etc., etc.), the information is still recoverable, even though you wipe the specific disk area where the file is stored.
This is true for any wiping program, by the way, and isn't a flaw in the program. It's a consequence of an operating system (i.e. Windows) and a file system that save an awful lot of information in multiple places during normal operation.
Swifty said:Why are so many people worried about this? The only time your gonna get that kinda software used on your hard disk is when you've been very naughty.
Software like Encase is available to anyone with a little cash, or willingness to download illegal copies.
For that matter, Winhex is available for free, and it includes many of the same features. Finally, there are file/data recovery programs out there, also available for free for anyone who wants it.
While I agree that "Encase" is likely to be used by law enforcement mostly, it's certainly possible that any of these software packages could also be used for industrial espionage, etc. And frankly, I do think there should be an ability for private citizens to protect their privacy from law enforcement, too, in a world in which law enforcement has fewer restrictions on its actions than has historically been the case...
DataRecoveryWizard
I suggest you use DataRecoveryWizard to recover your data.
The software provides very useful functions for data recovery:
DeleteRecovery, FormatRecovery, AdvancedRecovery, RawRecovery.
This program is an efficient disk recovery software providing
you a complete answer to data loss.
First thing I recommend you download the demo version of
DataRecoveryWizard. (http://www.easeus.com/download.htm)
Run the program and select the recovery mode "DeletedRecovery",
or "FormatRecovery", or "AdvancedRecovery".
See more: http://www.easeus.com
http://www.easeus.com/datarecoverywizar ... -files.htm
http://www.easeus.com/datarecoverywizar ... tition.htm
http://www.easeus.com/datarecoverywizar ... tition.htm
http://www.easeus.com/datarecoverywizar ... drives.htm
http://www.easeus.com/datarecoverywizar ... -files.htm
http://www.easeus.com/datarecoverywizar ... drives.htm
http://www.easeus.com/datarecoverywizar ... k-disk.htm
http://www.easeus.com/datarecoverywizar ... e-data.htm
http://www.easeus.com/datarecoverywizar ... d-data.htm
I suggest you use DataRecoveryWizard to recover your data.
The software provides very useful functions for data recovery:
DeleteRecovery, FormatRecovery, AdvancedRecovery, RawRecovery.
This program is an efficient disk recovery software providing
you a complete answer to data loss.
First thing I recommend you download the demo version of
DataRecoveryWizard. (http://www.easeus.com/download.htm)
Run the program and select the recovery mode "DeletedRecovery",
or "FormatRecovery", or "AdvancedRecovery".
See more: http://www.easeus.com
http://www.easeus.com/datarecoverywizar ... -files.htm
http://www.easeus.com/datarecoverywizar ... tition.htm
http://www.easeus.com/datarecoverywizar ... tition.htm
http://www.easeus.com/datarecoverywizar ... drives.htm
http://www.easeus.com/datarecoverywizar ... -files.htm
http://www.easeus.com/datarecoverywizar ... drives.htm
http://www.easeus.com/datarecoverywizar ... k-disk.htm
http://www.easeus.com/datarecoverywizar ... e-data.htm
http://www.easeus.com/datarecoverywizar ... d-data.htm
aakshitr1
Member
Hi.
EnCase Data Recovery software has been smartly designed for Windows platforms to support a complete suite of digital investigation products, and to recover maximum possible data in their original form. Via this software, users can easily perform EnCase data recovery from the EWF file, be it a hard disk image or image of any particular file. It supports all popular file systems of Windows, Mac, and Linux systems, i.e. EXTX, FAT16, FAT32, FAT64, NTFS, and HFS+. Also, it supports both partition tables, i.e. MBR (master boot record) and GPT (GUID partition table).
EnCase Data Recovery software has been smartly designed for Windows platforms to support a complete suite of digital investigation products, and to recover maximum possible data in their original form. Via this software, users can easily perform EnCase data recovery from the EWF file, be it a hard disk image or image of any particular file. It supports all popular file systems of Windows, Mac, and Linux systems, i.e. EXTX, FAT16, FAT32, FAT64, NTFS, and HFS+. Also, it supports both partition tables, i.e. MBR (master boot record) and GPT (GUID partition table).
- Users are allowed to define custom settings of the selected volume.
- Addition of new custom volume in case of missing volume from the hard disk drive.
- Powerful RAW recovery mode is available in the Treat file system as an option.
- Addition of new file signatures into new or the existing file to recover more data.
- Tree-structure preview of recovered data (files and folders) and file properties can also be checked.
- Auto-search files (multiple at a time) by just entering the file names/types in the search box.