is recovering possible

P

parachute

New Member
Hey,

I have wiped my hard disk with Dban Nuke, and did it with the quick methode. I have test with recover software and there where no files found. That s good.

My questions:

Is there recover software that can do that? I hope not!

I have read about R-studio and encase that they are very good, is it possible that they can recover my files on the hard drive that I have wiped with Dban Nuke?

Is the way of wiping the Harddisk in relationship with the age of the harddisk or is recovering een older harddrive easier than a modern hardisk? Or make it voor DBAN no difference?
 
No.
Even professional forensic scientists with their special tools wouldn't be able to recover anything.
But finally it depends on the used erasing method and the number of rounds (you can see the security level in the description of the available methods).

But also the methods with a medium security level are very safe already.
It would be very, very, very time consuming and a lot more difficult to recover any remaining fragments and with a high security level it's quite impossible to get anything.

Also a low security level would be enough in the most situations and for the most institutions (the police included). If you aren't Osama bin Laden, no one would invest the time and the money to recover your files, because it wouldn't be worth while.
 
OGG said:
No.

Finally it depends on the used erasing method and the number of rounds (you can see the security level in the description of the available methods).

.
Click to expand...

Thank you for your answer, but :D

Sa as I say I used the Quik methode with one round or one pass. :?:

Is that good enough that no software can recover my files?

And where can I see the security Level?

Thank you :D
 
You are welcome!

The quick method has a low security level, but is acceptable for the the most skilled people and their programs out there. But some fragments would be recoverable with some knowledge, the right tools and time.
But for "normal" people without a forensic laboratory and enough motivation and interest in your files it would be quite impossible to recover them.

You can see the security level in the description (bottom area of the screen), where you choose a mehtod.
 
OGG said:
You are welcome!


But for "normal" people without a forensic laboratory and enough motivation and interest in your files it would be quite impossible to recover them.
Click to expand...

Thank you again. Last question.

Do you mean with a forensic laboratory, software or hardware with very expansive software?? I know that some Linux distributions have free forensic software. And maybe some clever boys can use that.

Can that be a "danger" in the future for our privacy.?

No I am not Bin laden and I have nothing to hide for the police. My financials are oke and I wil keep that ok :wink:
 
I meant something like this ^^
http://www.unirecovery.co.uk/images/lab1.jpg

I would say, that "normal" recovery tools aren't able to recover anything after an overwriting of the hdd with the quick methode. But special forensic tools could maybe find and recover something.
I don't know how good this Linux tools are.

'The higher the security level the lower the chance to recover anything.'

I personally would prefer a methode with a medium security level anyway, because that's the best balance for me, between erasing speed and security (DoD for example).
 
The DBAN developer states that the defaults are sufficient for most people. I believe the default method is the short DoD option (and is activated by typing "autonuke" at the DBAN splash screen).

The Quick method merely blanks the disk, that is it overwrites the data with zeros. All other options write data other than all zeros to the drive. There is no need to change the Rounds from the default "1" Round when using the Quick method. In fact I'm not even sure that it will run the Quick Erase with more than one round as it would be quite pointless (the same data - a bunch of zeros - would just just be written once again). The method also just runs one pass.

You could use the default short DoD 3 pass method then afterwards use the Quick Erase method if you so desired. The likelihood of anything being recovered is minuscule, if indeed anything could be recovered.
 
The real last question:

:oops:


Is the way of wiping the Harddisk in relationship with the age of the harddisk or is recovering een older harddrive easier than a modern hardisk? Or make it voor DBAN no difference?
 
parachute said:
The real last question:

:oops:


Is the way of wiping the Harddisk in relationship with the age of the harddisk or is recovering een older harddrive easier than a modern hardisk? Or make it voor DBAN no difference?
Click to expand...
very old hard drives apparently require much longer passes to be certain that the data is not recoverable, ie the Peter Guttman 35 pass method. His article is reproduced here:

http://www.cs.auckland.ac.nz/~pgut001/p ... e_del.html

You will notice the original article is from July 1996 and in the epilogue to that article (written a few years later) he states that modern drives no longer need such a series of wipe patterns and I'm sure he wrote that part in 2001 or 2002. How old is the hard drive? If it was manufactured in the 2000s I would class it as a modern hard drive (in fact you could probably go further back than that, probably a decade at least). If so, a handful of wipes is probably as good and just as effective as 35 wipes was - in fact probably a lot better since it isn't causing wear and tear on the hard drive.
 
Question in a word of blue

If I encrypt my whole drive with TRUECRYPT like AES -Twofish - Serpent and then I'll use DBAN with PRNG and GUTMANN can I recovery any SH**T from my drive ?? :shock:
Thank You !!
 
Robbie said:
How old is the hard drive? If it was manufactured in the 2000s I would class it as a modern hard drive (in fact you could probably go further back than that, probably a decade at least).
Click to expand...

Hey Robbie,

Thank you for your comprehensive reply.
I think it was a hard drive of 1996 in a Compaq Desktop.

You said (see the quote) a decade at lest. Do yoy mean from 2008 or from 2000?

Suppose it is a old drive and I have used the Quik Methode, is it than possible to recover the data with free recovering software that you can download from the internet?like ontrackdatarecovery and so on?


thank you again :D
 
parachute said:
Robbie said:
How old is the hard drive? If it was manufactured in the 2000s I would class it as a modern hard drive (in fact you could probably go further back than that, probably a decade at least).
Click to expand...

Hey Robbie,

Thank you for your comprehensive reply.
I think it was a hard drive of 1996 in a Compaq Desktop.

You said (see the quote) a decade at lest. Do yoy mean from 2008 or from 2000?

Suppose it is a old drive and I have used the Quik Methode, is it than possible to recover the data with free recovering software that you can download from the internet?like ontrackdatarecovery and so on?


thank you again :D
Click to expand...
Hi parachute. By "decade" I meant back to about 1998 - ie 10 years ago. I have to admit I don't know anything about hard drives from before then. Weren't most of them just small, 2GB? Just overwrite it several times and I would imagine it would be OK though I couldn't vouch for that.

If you have data that you think is sensitive and you don't feel comfortable with several wipes then I would suggest disposing of the Hard Drive.

I can't give you the reassurance you seek, though I would imagine it will be perfectly fine.
 
Robbie,

I did a test with a hard drive I found in a cabinet at my workroom.

Western Digital 1.2 GB

The date printed on te cover of the hard drive is 9 jun 96

So I supposed it is a real old drive. I have fill with 500 mb different files.

After that I did a Quik erase (Blanking) with Dban

After that I use with windows XP the program Active@File Recovery.

It founds nothing at all. my experience with that " normal" recovery program is that it can find more than other programs. Thats good :D

What the result is with real forensisch software, I dont know, but I think its very difficult to recover the files also.?????

By the way, the old hard drive off the Compaq is maybe 10 GB.
 
parachute said:
Robbie,

I did a test with a hard drive I found in a cabinet at my workroom.

Western Digital 1.2 GB

The date printed on te cover of the hard drive is 9 jun 96

So I supposed it is a real old drive. I have fill with 500 mb different files.

After that I did a Quik erase (Blanking) with Dban

After that I use with windows XP the program Active@File Recovery.

It founds nothing at all. my experience with that " normal" recovery program is that it can find more than other programs. Thats good :D

What the result is with real forensisch software, I dont know, but I think its very difficult to recover the files also.?????

By the way, the old hard drive off the Compaq is maybe 10 GB.
Click to expand...
I would say that all the data on the hard drive has been erased so you should be OK - forensics won't be able to recover your data.
 
EnCase Data Recovery has been smartly designed for Windows platforms to support a complete suite of digital investigation products, and to recover the maximum possible data in their original form. It provides Parse as Disk option for parsing/scanning the EWF file as a hard disk
 
You must log in or register to reply here.
Back
Top