±Forensic Focus Partners

±Your Account


Nickname
Password


Forgotten password/username?


Membership:
New Today: 6
New Yesterday: 7
Overall: 27333
Visitors: 54

±Follow Forensic Focus

Join our LinkedIn group

Subscribe to news

Subscribe to forums

Subscribe to blog

Subscribe to tweets

Ever reported data recovering from broken CD/DVD/HDD?

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page 1, 2, 3  Next 
  

Ever reported data recovering from broken CD/DVD/HDD?

Post Posted: Sat Jan 19, 2013 7:24 am

Hello

I am curious to know if has ever been reported any significant data recovery -texts, images, music(sound files)from:

1. CDS and DVDs broken into four or more pieces.

2. Drilled/perforated Hard drives(around 6-8 chisel holes around 1 cm each). Question  

williamsonn
Senior Member
 
 
  

Re: Ever reported data recovering from broken CD/DVD/HDD?

Post Posted: Sat Jan 19, 2013 8:18 am

Before you answer my questions I am posting here an article I have found on this regard, and based on this I wanted to add a third question: is this article about something real or about paranoia?

www.deathvalleymag.com...your-data/  

williamsonn
Senior Member
 
 
  

Re: Ever reported data recovering from broken CD/DVD/HDD?

Post Posted: Sat Jan 19, 2013 11:36 am

And before asking this question:

- williamsonn

1. CDS and DVDs broken into four or more pieces.

you might have searched a bit on the board (or simply have all your banks of memory properly connected and recall how you ALREADY asked it)

However, here:
www.forensicfocus.com/...ic/t=9811/

With reference to the "article" you just posted a link to, there is an English word (starts with "b", ends with "t", eight letters long) that is commonly used to describe contents such as:
The only sure fire way to destroy data on a drive is to melt it down. Just destroying the device into pieces won’t do unless you use a special shredder and end up turning it into dust. Even broken into pieces, a DVD/CD can be recovered (at least parts of it anyhow).

Software such as EnCase will allow you to recover data on an amazing amount of destroyed data and I have both seen and heard of cases where criminals had thought they had ‘destroyed’ the hard drive by smashing it with a hammer, but ended up only pissing the investigators off and working harder to find something.


It is not like asking same question over and over will change the answers you will get (or change reality).

This one is actually (almost) a "new" one:
- williamsonn

2. Drilled/perforated Hard drives(around 6-8 chisel holes around 1 cm each).

The answer is STILL NO (at least for any decently modern hard disk, anything manufactured, say, after year 1998 or 2000).

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 

jaclaz
Senior Member
 
 
  

Re: Ever reported data recovering from broken CD/DVD/HDD?

Post Posted: Sat Jan 19, 2013 1:49 pm

hello jaclaz. Thanks for your comments.

1

I remembered to have asked already a very similar question before posting this second message about that subject. However, the new hue regarding it(at least for me)is not only this article I posted, mentioning certain apparently new software capable of doing it, but, also, that this supposedly software or "new techniques" was the subject of talking some days ago between a friend of me, computing engineer, and me. According him, this kind of data retrieving was possible(shattered CD or DVD). So I decided to expose here the matter again. Now I see you think that article is "bullshit" . Wink I suppose, then that these statements about data retrieving are made for commercial purposes.

2

Regarding the hammered and drilled hard drives, your answer makes me wonder what happens exactly with hard drives made around 1998-2001, for laptops. The ones I am refeferring of are 2,5 ones whose plates are made of glass/aluminum/ceramic substrate and that after each drill they break into diminute fragments. About these destroyed drives, my friend´s opinion was that no data can be actually retrieved from them. However as I said, your answer, partially, makes me to doubt. Could you clarify it please?  

williamsonn
Senior Member
 
 
  

Re: Ever reported data recovering from broken CD/DVD/HDD?

Post Posted: Sun Jan 20, 2013 5:41 am

1. NO, that is the SAME EXACT question (already replied to), if you had actually read the replies, you would have seen how the number of pieces is irrelevant (until we are within the use of "normal" hardware). In the last reply there is also a link to a relevant paper that analyzes a particular approach with dedicated hardware.

I never said that the whole article is b**lsh*t, the quoted part is, and clearly exposes the fact that the Author has either NO idea of the differences between hardware and software or mixes them liberally.
Encase (or any other software, rest assured) does not (and cannot) recover "destroyed data", at the most it can recover data which indexing system has been destroyed, and LIMITED to software erasing it.
If you prefer, if you give me a hard disk and a hammer I can guarantee you that the Author (and his friends from which he "heard" these stories) will not be able to retrieve anything from it after I place a single blow on the HD platter, NO WAY (let alone using Encase only).

2. There are several ways (materials) with which a hard disk platter is made and many drilling techniques.
In theory it is perfectly possible to drill a hole in a platter without altering/breaking the rest of the platter.
The whole point is - again - exactly the same as the one ALREADY talked about to death here:
www.forensicfocus.com/...0/#6564240

Such a cleanly drilled platter won't (obviously) work anymore in a "normal" disk drive.
The technique (both theory and practice) discussed in the above link may work as well, though.

I will try to re-cap for your benefit, hoping to make the matters more clear (and hopefully to avoid having again and again the same questions asked).

Let's assume (to simplify) that there are ONLY three types of hard disks:
1.manufactured until 1996 (MFM/RLL)
2.manufactured since 1997 and up to 2006 (PRML/EPRML)
3.manufactured after 2006 (perpendicular recording)

For #1 we have a valid theory and a SINGLE report (partial, not fully documented) of someone having put it into practice.
For #2 we have a (similar) theory (hopefully as valid as the above) and NO reports of anyone EVER having been able to put it into practice (and each year, due to increasing areal density the theory becomes more difficult to be put into practice)
For #3 we don't have a theory, let alone someone that put it into practice.


jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 

jaclaz
Senior Member
 
 
  

Re: Ever reported data recovering from broken CD/DVD/HDD?

Post Posted: Sun Jan 20, 2013 7:02 am

Hello jaclaz. thank you very much for your interesting and clear post. Being a lot of internet sites a source of misinformation always is important that experts like you make clear the ideas, sometimes, even, repeating them, in the same way that misinfrmations are again and again repeated Wink

By the way, is possible for a non expert to easily recognize visually which type of hard drive does he has in order to apply it any of the 3 you mention? thanks again  

williamsonn
Senior Member
 
 
  

Re: Ever reported data recovering from broken CD/DVD/HDD?

Post Posted: Sun Jan 20, 2013 12:59 pm

- williamsonn

By the way, is possible for a non expert to easily recognize visually which type of hard drive does he has in order to apply it any of the 3 you mention?


I really don't get it.
Apply WHAT?
There is NOTHING that can be applied.

I listed a simplified 3 types list specifying that for TWO of them there is NO known method/tool/hardware/approach capable of recovering ANYTHING.

For the first one there is ONLY one person that reported some partial success (and obviously he is an EXPERT, and to - hopefully - be able to replicate what he did you will need to become a - BTW extremely good - expert).

So a non-expert (actually as well as let's say 99.9999% of actual experts) can do nothing about any of the types in the simplified list.

What would be the sense of being able to visually distinguish these types?

And "visually" and "visually for non-experts"? Shocked

No, there is nothing "visually".

And AGAIN, you already got an answer to a very similar question:
www.forensicfocus.com/...0/#6564280

BTW I am no expert, I just stayed at a Holiday Inn.

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 

jaclaz
Senior Member
 
 
Reply to topicReply to topic

Share this forum topic to encourage more replies



Page 1 of 3
Go to page 1, 2, 3  Next