MyCattMaxx
Active Member
I have recovered data from several hard drives that were formatted.
One of them was mine from accidentally picking the wrong drive to format.
One of them was mine from accidentally picking the wrong drive to format.
What would it take to make data be completely unrecoverable?
- Thread starter Captain Kirk
- Start date
Captain Kirk
Member
Bigfellla,
I wasn't trying to make my data secure by trying to destroy. What I was saying, was that I lost data from a new Windows install with the blue screen setup option to format the hd before the installation proceeds. Then, later, after the OS was installed, I tried to RECOVER, not destroy, my lost data, but was not successful -- and this was from only a SINGLE format.
Don't you find that strange?
I mean, it only sounds logical that the data would still be there, right?
MyCatteMaxx,
I have recovered data from a flash drive
--Captain Kirk
I wasn't trying to make my data secure by trying to destroy. What I was saying, was that I lost data from a new Windows install with the blue screen setup option to format the hd before the installation proceeds. Then, later, after the OS was installed, I tried to RECOVER, not destroy, my lost data, but was not successful -- and this was from only a SINGLE format.
Don't you find that strange?
I mean, it only sounds logical that the data would still be there, right?
MyCatteMaxx,
I have recovered data from a flash drive
--Captain Kirk
Okedokey
Well-Known Member
You arent seeming to understand what a format does. A simple format simply makes the areas on the HDD re-avialble for writing too. It doesn't destroy what is on that part of the disk UNTIL you write information there.
The format didn't destroy your data, the OS installation did.
Therefore a simple format isn't what prevented you recovering your data.
MyCattMaxx
Active Member
I don't find it strange.
You admitted that you tried to recover data after writing onto the hard drive.
It is very hard to recover data that has been written over.
Captain Kirk
Member
Yes its true that I installed the OS first before trying to recover the data, but the XP OS only takes up 1 gig of space, therefore the undestroyed space that is "available" is still 19 Gigs, which still doesn't account for the data that I lost. Because as you said, the space is still there, "UNTIL you write information there."
And as you said, "It is very hard to recover data that has been written over." But only 1 gig of space has been 'written' over, as this is the size of the OS
--Captain Kirk
And as you said, "It is very hard to recover data that has been written over." But only 1 gig of space has been 'written' over, as this is the size of the OS
--Captain Kirk
Okedokey
Well-Known Member
Again, you're assuming something, which makes you wrong.
For your assumption to work, all the data needs to be lined up neatly next to each other. Even a very defragmented drive will not all be contiguous. Parts of any individual file are spread all over the disk and various arrays on the disk 'memorise where these parts are' for later recovery.
By overwriting any of the disk (particularly the inner HDD tracks as happens on newly formated disk), you are destroying parts of these files, making the rest incomplete. Yes, the remaining 'parts' of your files will be on the other 19GB, but it is now garbled.
Essentially you completed what a proper format does, which is to write to the sectors. By installing the OS you almost couldn't have done more damage to your chances of getting the files back.
If it had've been a simple format, you'd probably have the data back by now. A simple Windows Recovery and Start up repair wouldve sorted it.
The only way to possible get back is if you have back up.
I would also complete a diskcheck.
Partition your drive so that if the OS goes pear-shaped, your files (on a secondary partition) will not be touched during reinstall.
Last edited:
Captain Kirk
Member
So you said 'a simple format' doesn't destroy the data right? So if I don't write any data on it then the data will still be there.
So now the question is, if I was to format this hd 4 times without ever writting data on it, would the original data still be there and available for use, like for a restore with a recovery program?
--Captain Kirk
So now the question is, if I was to format this hd 4 times without ever writting data on it, would the original data still be there and available for use, like for a restore with a recovery program?
--Captain Kirk
wolfeking
banned
Yes. the number of formats does not really matter. All format does is open your drives blocks for writting. It basically lies to the OS and says that there is nothing there. Sort of like if you hide a knife in your boot, you still have the knife. The boot is the format and teh knife is the data.
But as soon as you a=start installing an os, or writting any data, you start destroying bits of data. You can likely recover some of it, but if necessary bits are destroyed, then the data will be unrecoverable.
But as soon as you a=start installing an os, or writting any data, you start destroying bits of data. You can likely recover some of it, but if necessary bits are destroyed, then the data will be unrecoverable.
Okedokey
Well-Known Member
Yes. and Yes.
Captain Kirk
Member
Wolfeking, hey what's up bro?
Long time no see!
How you been?
If you only have one hd and you format the drive, is there a way to install the OS somehow so that
you don't lose all 20 Gigs of data when you then try to restore it with a recovery program?
--Captain Kirk
Long time no see!
How you been?
If you only have one hd and you format the drive, is there a way to install the OS somehow so that
you don't lose all 20 Gigs of data when you then try to restore it with a recovery program?
--Captain Kirk
MyCattMaxx
Active Member
If you have enough free space you can add a partition and move the data you want saved to the new partition.
Then you can format just the OS partition for a re-install.
If the drive is full burn a bunch of back-up DVD's since you don't have a spare HDD.
You should be backing up your data anyway if it is valuable to you.
The way you are talking about doing it is just plain nuts.
Then you can format just the OS partition for a re-install.
If the drive is full burn a bunch of back-up DVD's since you don't have a spare HDD.
You should be backing up your data anyway if it is valuable to you.
The way you are talking about doing it is just plain nuts.
Captain Kirk
Member
Would you be able to recover data after one pass with a Kill Disk, such as with dban?
Or would this render all your data unrecoverable?
--Captain Kirk
Or would this render all your data unrecoverable?
--Captain Kirk
Okedokey
Well-Known Member
Yes, unless it writes to the disk.
Captain Kirk
Member
That's funny. Yea, that would definitely do it.
Best Answer
Doesn't a Kill Disk write to the disk?
I thought that that was what the purpose of this program!...
--Captain Kirk
Last edited:
MyCattMaxx
Active Member
One pass of zeros with either with make it harder for amateurs to recover the data but it is still possible and only someone who is serious would spend the time and money to recover it.
Okedokey
Well-Known Member
That's funny. Yea, that would definitely do it.
Best Answer
Doesn't a Kill Disk write to the disk?
I thought that that was what the purpose of this program!...
--Captain Kirk
Actually physically destroying the platter doesn't prevent (theoretically) data recover. You would need to chemically alter the disk (burn it etc) to really destroy the data.
I think military standard pass is 8?
FuryRosewood
Active Member
id think military level includes destroying the harddrive...nothing more secure.
Okedokey
Well-Known Member
I worked for a company in London that collected MI5 and MI6 paper waste.
It came as dust.
Then we acid treated it.
Not a word of exaggeration.
so yeah..
But i think "military standard" from memory is 'industry speak' for 8 passes?
Quick, someone mathematical explain.
BUt I think on standard latitudinal disks, the imprint of data (magnetic) is similar looking to the pin-out of a DVI connector
Dependant on which 'pin' is ON, which is OFF, will determine the data meaning
Later models simply turned the data writing on its head by using longitudinal writing, allowing greater read and write density (i.e. more 'magnetic DVI imprints' per unit area)
So 8 passes has something to do with ensuring each of the pins is randomly at a different "magnetic states" post format.
It came as dust.
Then we acid treated it.
Not a word of exaggeration.
so yeah..
But i think "military standard" from memory is 'industry speak' for 8 passes?
Quick, someone mathematical explain.
BUt I think on standard latitudinal disks, the imprint of data (magnetic) is similar looking to the pin-out of a DVI connector
Dependant on which 'pin' is ON, which is OFF, will determine the data meaning
Later models simply turned the data writing on its head by using longitudinal writing, allowing greater read and write density (i.e. more 'magnetic DVI imprints' per unit area)
So 8 passes has something to do with ensuring each of the pins is randomly at a different "magnetic states" post format.
Last edited:
Captain Kirk
Member
Bigfellla,
what up bro?
So I guess a hammer was NOT the best answer: as the data can still theorectically be recovered.
Acid: Bigfellla got the Best Answer.
Someone said that 7 passes was enough, and all that you need.
I guess an extra pass is kind of a "just because" pass, as a maximum security standard I guess.
Military standard it would seem would be greater than "normal", sort of an "overkill" mentality.
At this point you have no doubts about being safe.
The reality of James Bond is not as fun as the movies in real life.
But its still good to know basic procedures.
What I don't understand is why they even waste their time with a paper shredder, unless they want other people to find the information.
I thought a burn box was completely safe.
However, if time was an issue, as a killdisk pass takes 1 full day, and your killdisk was "interrupted" in the middle so that it was not able to complete a full pass,
would your information be able to be recovered with a "common person's" recovery program; meaning that military grade software is not used?
(Assuming that you already have recovery software).
This happened to me once, and I was wondering if I would have been able to recover the data at this point...
--Captain Kirk
what up bro?
So I guess a hammer was NOT the best answer: as the data can still theorectically be recovered.
Acid: Bigfellla got the Best Answer.
Someone said that 7 passes was enough, and all that you need.
I guess an extra pass is kind of a "just because" pass, as a maximum security standard I guess.
Military standard it would seem would be greater than "normal", sort of an "overkill" mentality.
At this point you have no doubts about being safe.
The reality of James Bond is not as fun as the movies in real life.
But its still good to know basic procedures.
What I don't understand is why they even waste their time with a paper shredder, unless they want other people to find the information.
I thought a burn box was completely safe.
However, if time was an issue, as a killdisk pass takes 1 full day, and your killdisk was "interrupted" in the middle so that it was not able to complete a full pass,
would your information be able to be recovered with a "common person's" recovery program; meaning that military grade software is not used?
(Assuming that you already have recovery software).
This happened to me once, and I was wondering if I would have been able to recover the data at this point...
--Captain Kirk