Hello,
When a disk wiped with a tool like "dd" then can it recoverable?
Is it true that agencies using special tools for recovering wiped HDDs?
Thank you.
Hello,
When a disk wiped with a tool like "dd" then can it recoverable?
Is it true that agencies using special tools for recovering wiped HDDs?Thank you.
You can find arguments involving Magnetic Force Microscopes, Bad Sectors, Wear Leveling, Multipass, Single Pass, Pattern vs Random, and perhaps Extraterrestial Intervention. It all makes for spirited debate, but No just No!
Is it true that agencies using special tools for recovering wiped HDDs?
Yes.
The answer to the question you didn't ask, which is
Can these special tools used by agencies for recovering wiped HDD's actually recover any meaningful data?
remains
jaclaz
Thank you, but why someone agree with "
Data can remain in sectors that the disk has marked as bad, or in HPA/DCO/areas that your wiping utility isn't wiping.
Physical destruction guarantees that no data remains. (As long as you actually destroy the platters)
Ultimately, a single pass is fine, but to be absolutely sure if that's what you need, then shred the disk
Thus, agencies can recover the data from "HPA/DCO "areas?
Any way to clear it manually?
Thus, agencies can recover the data from "HPA/DCO "areas?
Any way to clear it manually?
Sure they can.
As a matter of fact most knowledgeable people with the right programs - freely or commercially available - can.
And sure it is normally possible to clear those areas.
But what would be residing (again "normally") in the HPA or DCO areas?
Would those areas contain any data that is
1) meaningful?
2) useful for *anything*?
Yes, at a probability level of two to the power of 276,709 to one against.
See also
https://www.forensicfocus.com/Forums/viewtopic/t=12744/
Ultimately, a single pass is fine, but to be absolutely sure if that's what you need, then shred the disk
AND send the pieces to random addresses in China
https://www.forensicfocus.com/Forums/viewtopic/t=9682/
jaclaz
They can recover all of my data by "HPA/DCO" areas ????
They can recover all of my data by "HPA/DCO" areas ????
Not only "they".
You, we can also.
As an example. check this OSForensics page
https://
Still, the point you are evidently missing is that the HPA and DCO areas are not normally accessible by you, so it is unlikely that any of your data landed there, unless you intentionally an by means of a "special" software, managed to write data there.
The DCO may be used by the hard disk manufacturer to "reduce" the size of a device.
The HPA may be used by the hard disk manufacturer or the OEM building the machine to store some test/debug programs or similar.
But still, and as said, nothing prevents you from removing the (eventual) HPA and/or DCO and then 00 fill the hard disk
https://
https://
And
https://www.forensicfocus.com/Forums/viewtopic/t=10870/
And
https://www.forensicfocus.com/Forums/viewtopic/t=10808/
jaclaz
Excuse me, When I wiped a HDD and all data are overwritten then how "HPA and DCO" can recover all of my data? How about their sizes?