DataRecovery from U...
 
Notifications
Clear all

DataRecovery from USB-flash

10 Posts
5 Users
0 Likes
664 Views
(@gremodic)
Posts: 24
Eminent Member
Topic starter
 

hi to all
in this days trying different tools this happen to me….
i use a 1Gb NTFS pendrive, after a simple complete format performed by windows7 i didn't found inside with the different carving/datarecovery tools
i try with encase foremost scalpel ontrack easy recovery get data back and other but i didn't found nothing od nothing….
my qeustion is…how is it possible? you think i have forget something?
thanks to all

 
Posted : 23/03/2010 5:02 pm
(@rampage)
Posts: 354
Reputable Member
 

the problem is "a simple COMPLETE format"

a complete format overwrites sectors,

since all data recovery softwares (and carvers) rely on files that were deleted or orphaned on the filesystem without being overwritten, with a complete format (or any activity that overwrites sectors) you won't be able to recover anything.

 
Posted : 23/03/2010 5:41 pm
(@gremodic)
Posts: 24
Eminent Member
Topic starter
 

8| what? you are sure? is to simple delete all evidence files? i not do a wipe but a complete format by windows non with a professional eraser….i think this is strange

 
Posted : 23/03/2010 5:44 pm
(@rampage)
Posts: 354
Reputable Member
 

a single pass of overwrite is enaugh to make a file impossible to recover.

 
Posted : 23/03/2010 5:58 pm
(@gremodic)
Posts: 24
Eminent Member
Topic starter
 

ok now i try a different things i do a rapid formatt and there is the same situation…what happened now?

 
Posted : 23/03/2010 6:26 pm
(@mscotgrove)
Posts: 938
Prominent Member
 

A quick format should be recoverable from.

As a simple exercise, fill the disk with jpegs, then a quick format. Then try a raw recovery, or data carving tool, this should find the jpegs. With a 1GB stick, and only a few files, the format may clear down the complete $MFT which will make traditional recovery / undelete techniques fail.

One point to note is how long the format takes. If it takes more than 1 min, it is probably doing a complete format (blanking each sector), less than 1 min, then it will just be rewriting indexes, MFTs etc

 
Posted : 23/03/2010 7:04 pm
jhup
 jhup
(@jhup)
Posts: 1442
Noble Member
 

If I understand correctly NAND gate based USB drive also have an issue how they write to the storage blocks. Before writing they must "erase" everything on the block in question . . . Rewrite or complete formats, nothing remains.

There was a thread somewhere here about that discussion.

 
Posted : 23/03/2010 7:23 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

For the record, the behaviour of windows format has changed.
Pre-Vista behaves one way, Vista and later behave DIFFERENTLY.

Here
http//www.msfn.org/board/index.php?showtopic=135781

Old behaviour
http//support.microsoft.com/kb/302686/en-us

New behaviour
http//support.microsoft.com/kb/941961/en-us

The format command behavior has changed in Windows Vista. By default in Windows Vista, the format command writes zeros to the whole disk when a full format is performed. In Windows XP and in earlier versions of the Windows operating system, the format command does not write zeros to the whole disk when a full format is performed.

jaclaz

 
Posted : 23/03/2010 8:02 pm
(@gremodic)
Posts: 24
Eminent Member
Topic starter
 

ok ok and so from now i can't recover nothing from a vista formatted device?? or i can use other technics

 
Posted : 24/03/2010 2:56 pm
(@rampage)
Posts: 354
Reputable Member
 

if it's a full format, you cant recover anything

 
Posted : 24/03/2010 3:07 pm
Share: