Recover overwritten data

F

fanhan

New Member
Hello. Maybe you guys can help settle a debate. Is it possible to recover overwritten data on a harddrive? If I were to zero out all sectors, can I ever get them back (if money is of no concern)?
 
Overwritten possible with a well written data recovery program. Professional software may have a need in some cases however.

For zero filling forget any recovery since the idea there is to simply nuke a drive by writing binary zeros to eliminate any traces of existing data. That's was originally done with a dos tool taking hhhhhoursssss... to see done as a security method and since now sees softwares that work much faster. Once done data gone for good.
 
Yes, if money is no concern. There is equipment out there that can recover data in high percentages off HDDs that have been written full of zeroes multiple times; however, these require very specialized facilities and personnel, and recovering data off a HDD using these methods is going to be VERY pricey and it's going to be a challenge finding a company that can do this.
 
For the consumer there are data recovery services being described there where you bring in a drive that's been overwritten or you accidently deleted something while in Windows(or Mac or Linux) and they will recover what they can either to a spare drive you provide or burned to a data disk like dvd-r.

For highly specialized recovery you are then looking a professional and often official sources like criminal investigation. Generally any program that repeatedly writes binary zeros to a drive will nuke the data where you might see some traces recovered at the most by a service.
 
For highly specialized recovery you are then looking a professional and often official sources like criminal investigation.
Click to expand...
True. I read an APC article on this, it is possible but I indeed have no clue about the availability of such options to general public or even big-money companies.
 
Any large company will see professional softwares that literally blast data off of drives to protect confidential materials from recovery programs you would readily find consumer ready. Those insure no one can recover anything from them when going to upgrade their networks and servers.

Another tool for wiping a drive totally while ruining a drive as well would be the idea of running a strong magnet over the platters in a drive. Since those are magnetically charged the magnetism is toast afterwards leaving a useless item behind.
 
Even specialized recovery companies cannot recover an overwritten harddrive. Especially if we are talking about modern harddrives. So your data will be pretty much lost.
 
not that i know of. im pretty sure once you overwrite something that its gone for good. deleting something might send it to the recycle bin depending on your system settings and the size of the file, but im pretty sure overwriting puts something else in the same place where the old item used to be. normally something gets overwritten because the two can't be named the same thing in the same directory.
 
Most of the time when any zero fill utility is used you won't find traces of data left to recover. For simply overwritten or deleted by Windows data there are some very specialized data recovery softwares out but simply not sold to the general public. Then there are professional services that can recover bits and pieces.

It mainly depends on what fragments are still remaining for any recovery to start with. If you nuke a drive with some professional security program used for erasing drives you won't find much for certain there.
 
Overwritten means to overwrite whatever data is stored in a sector. To zero out/fill a harddrive means to overwrite all sectors.

To delete a file is not the same thing as to overwrite all the sectors that it spans over, and thus you can recover deleted files, but not overwritten files.
 
Last edited:
When you delete a file in Windows it's moved from an active appearance into a temporary archive known as the recycle bin. On the other hand some zero fill utilities are geared for local sector not total drive wipes where they simply nuke specified files and folders only.

Those are security utilities that wipe data while leaving the OS intact. Simply overwritten data can still be recovered since it is only layered over and often recoverable with special recovery software. Like I mentioned at the top of the thread that would be something not available to the general public.
 
With a zero filler you are overwritting all data with binary zeros. That insures all sectors are switched to 0 seeing a total wipe. A security tool will see only select portions of a drive effected. That also uses the same principle there.

All that depends on what type of overwriting is being seen. If you reinstalled an old version of Windows like 98 over itself you then would see layers with any special recovery tools. It essentially comes down to whatever files or file fragments still found remaining.
 
You are talking about something else. This is about the recovery of overwritten sectors.

There have been published papers about this, and how it can be theoretically done. It is just not that easy to do in practice.
 
That's one reason why there are professional services equipped for the difficult tasks as well as time savers for corporations. "Do not try at home" would be a good slogan there.

For the typical home user when a folder full of family photos is overwritten everyone's in a panic. :eek: They end up needing a service to salvage whatever can be. While there are several freewares even available for home those along with some retail products still tend to be rather limited depending on circumstance.
 
I still don't think you get what overwritten means in this context. If the "professional services" could recover overwritten data, they would also be able to recover a hard drive that had been wiped clean with zeroes.
 
Last edited:
If the "professional services" could recover overwritten data, they would also be able to recover a hard drive that had been wiped clean with zeroes.
Click to expand...
And that CAN be done, believe it or not. It's slow, pricey, needs highly specialized equipment and people and you won't be able to recover ALL the data, but it can be done.
 
motivator6661539.jpg
 
You must log in or register to reply here.
Back
Top