±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 36775
New Yesterday: 3 Visitors: 129

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

DataRecovery from USB-flash

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page 1, 2  Next 
  

gremodic
Member
 

DataRecovery from USB-flash

Post Posted: Mar 23, 10 18:02

hi to all
in this days trying different tools this happen to me....
i use a 1Gb NTFS pendrive, after a simple complete format performed by windows7 i didn't found inside with the different carving/datarecovery tools
i try with encase foremost scalpel ontrack easy recovery get data back and other but i didn't found nothing od nothing....
my qeustion is...how is it possible? you think i have forget something?
thanks to all  
 
  

Rampage
Senior Member
 

Re: DataRecovery from USB-flash

Post Posted: Mar 23, 10 18:41

the problem is "a simple COMPLETE format"

a complete format overwrites sectors,

since all data recovery softwares (and carvers) rely on files that were deleted or orphaned on the filesystem without being overwritten, with a complete format (or any activity that overwrites sectors) you won't be able to recover anything.  
 
  

gremodic
Member
 

Re: DataRecovery from USB-flash

Post Posted: Mar 23, 10 18:44

8| what? you are sure? is to simple delete all evidence files? i not do a wipe but a complete format by windows non with a professional eraser....i think this is strange  
 
  

Rampage
Senior Member
 

Re: DataRecovery from USB-flash

Post Posted: Mar 23, 10 18:58

a single pass of overwrite is enaugh to make a file impossible to recover.  
 
  

gremodic
Member
 

Re: DataRecovery from USB-flash

Post Posted: Mar 23, 10 19:26

ok now i try a different things i do a rapid formatt and there is the same situation...what happened now?  
 
  

mscotgrove
Senior Member
 

Re: DataRecovery from USB-flash

Post Posted: Mar 23, 10 20:04

A quick format should be recoverable from.

As a simple exercise, fill the disk with jpegs, then a quick format. Then try a raw recovery, or data carving tool, this should find the jpegs. With a 1GB stick, and only a few files, the format may clear down the complete $MFT which will make traditional recovery / undelete techniques fail.

One point to note is how long the format takes. If it takes more than 1 min, it is probably doing a complete format (blanking each sector), less than 1 min, then it will just be rewriting indexes, MFTs etc
_________________
Michael Cotgrove
www.cnwrecovery.com
www.goprorecovery.co.uk 
 
  

jhup
Senior Member
 

Re: DataRecovery from USB-flash

Post Posted: Mar 23, 10 20:23

If I understand correctly NAND gate based USB drive also have an issue how they write to the storage blocks. Before writing they must "erase" everything on the block in question . . . Rewrite or complete formats, nothing remains.

There was a thread somewhere here about that discussion.  
 

Page 1 of 2
Page 1, 2  Next