Recovering wiped HD...
 
Notifications
Clear all

Recovering wiped HDD.

12 Posts
4 Users
0 Likes
1,180 Views
(@hack3rcon)
Posts: 11
Active Member
Topic starter
 

Hello,
When a disk wiped with a tool like "dd" then can it recoverable?
Is it true that agencies using special tools for recovering wiped HDDs?

Thank you.

 
Posted : 28/12/2019 11:56 am
watcher
(@watcher)
Posts: 125
Estimable Member
 

Hello,
When a disk wiped with a tool like "dd" then can it recoverable?
Is it true that agencies using special tools for recovering wiped HDDs?

Thank you.

No!

You can find arguments involving Magnetic Force Microscopes, Bad Sectors, Wear Leveling, Multipass, Single Pass, Pattern vs Random, and perhaps Extraterrestial Intervention. It all makes for spirited debate, but No just No!

 
Posted : 28/12/2019 3:17 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

Is it true that agencies using special tools for recovering wiped HDDs?

Yes.

The answer to the question you didn't ask, which is
Can these special tools used by agencies for recovering wiped HDD's actually recover any meaningful data?
remains

No!

jaclaz

 
Posted : 28/12/2019 4:47 pm
(@hack3rcon)
Posts: 11
Active Member
Topic starter
 

Thank you, but why someone agree with "Smashing with a hammer" ?

 
Posted : 28/12/2019 9:26 pm
(@randomaccess)
Posts: 385
Reputable Member
 

Data can remain in sectors that the disk has marked as bad, or in HPA/DCO/areas that your wiping utility isn't wiping.

Physical destruction guarantees that no data remains. (As long as you actually destroy the platters)

Ultimately, a single pass is fine, but to be absolutely sure if that's what you need, then shred the disk

 
Posted : 28/12/2019 11:52 pm
(@hack3rcon)
Posts: 11
Active Member
Topic starter
 

Thus, agencies can recover the data from "HPA/DCO "areas?
Any way to clear it manually?

 
Posted : 29/12/2019 6:49 am
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

Thus, agencies can recover the data from "HPA/DCO "areas?
Any way to clear it manually?

Sure they can.
As a matter of fact most knowledgeable people with the right programs - freely or commercially available - can.
And sure it is normally possible to clear those areas.

But what would be residing (again "normally") in the HPA or DCO areas?

Would those areas contain any data that is
1) meaningful?
2) useful for *anything*?

Yes, at a probability level of two to the power of 276,709 to one against.

See also
https://www.forensicfocus.com/Forums/viewtopic/t=12744/

Ultimately, a single pass is fine, but to be absolutely sure if that's what you need, then shred the disk

AND send the pieces to random addresses in China
https://www.forensicfocus.com/Forums/viewtopic/t=9682/

jaclaz

 
Posted : 29/12/2019 9:36 am
(@hack3rcon)
Posts: 11
Active Member
Topic starter
 

They can recover all of my data by "HPA/DCO" areas ????

 
Posted : 29/12/2019 12:13 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

They can recover all of my data by "HPA/DCO" areas ????

Not only "they".

You, we can also.

As an example. check this OSForensics page
https://www.osforensics.com/hidden-areas-hpa-dco.html

Still, the point you are evidently missing is that the HPA and DCO areas are not normally accessible by you, so it is unlikely that any of your data landed there, unless you intentionally an by means of a "special" software, managed to write data there.

The DCO may be used by the hard disk manufacturer to "reduce" the size of a device.
The HPA may be used by the hard disk manufacturer or the OEM building the machine to store some test/debug programs or similar.

But still, and as said, nothing prevents you from removing the (eventual) HPA and/or DCO and then 00 fill the hard disk
https://en.wikipedia.org/wiki/ATATool
https://en.wikipedia.org/wiki/Hdparm

And
https://www.forensicfocus.com/Forums/viewtopic/t=10870/
And
https://www.forensicfocus.com/Forums/viewtopic/t=10808/

jaclaz

 
Posted : 29/12/2019 1:16 pm
(@hack3rcon)
Posts: 11
Active Member
Topic starter
 

Excuse me, When I wiped a HDD and all data are overwritten then how "HPA and DCO" can recover all of my data? How about their sizes?

 
Posted : 01/01/2020 11:13 am
Page 1 / 2
Share: