Greetings,
Transmission electron microscopy is one possible method. One of the original papers on it is here - http//
There's a lot of debate on this. I believe the general consensus is that a single pass wipe is sufficient on modern drives against any reasonable attempts to recover data.
-David
There is a process to recover data from a whipped drive…
Recovering data from a whipped drive is heavily dependent upon a number of things…such as, did the drive enjoy being whipped, did it pay for being whipped, and did it wear a leather mask and ball gag while being whipped?
So…couldn't resist….
…I believe the general consensus is that a single pass wipe is sufficient on modern drives against any reasonable attempts to recover data.
-David
I have validated this in my lab. Be it flash memory or magnetic media, a single pass does the job.
One of the speakers at this year's Techno Security conference reported that using a magnetic force microscope (we all have one in our labs, right???) MAY recover deleted data but, as expected, it would be very slow-going. He reported that it would require approximately 6 months to recover data equivalent to a single printed page.
Im not sure I fully understand whether this is a completely wiped drive or if its just the unused space, so as a more general point
If users of Eraser do not enable 'wipe cluster tips' when cleaning unused space you will still have data in file slack. But I do seem to remember that it will also do quite a good job at touching up the MFT.
There is a process to recover data from a whipped drive however I can't remember what it's called. Maybe someone here knows? The 0's and 1's are still detectable from the left over wobble of the magnetic frequency which can remain on the disc. It's got a long winded scientific name.
I wouldn't mind reading into it further too.
Electron Microscopy is really expensive, and not 100% reliable.
What files?
If hibernation was 'turned off', was it ever enabled? Same with the Restore Points…
Stolen accounts details, etc
I suppose yes, but BEFORE he done his job.
In short, I'm just not clear what you're asking…
Its simple do I have any chances to recover erased data.
Awesome thanks, I understood no clear chance to recover.
There is a process to recover data from a whipped drive…
Recovering data from a whipped drive is heavily dependent upon a number of things…such as, did the drive enjoy being whipped, did it pay for being whipped, and did it wear a leather mask and ball gag while being whipped?
So…couldn't resist….
I presume you are talking about track edges.
Read this - http//
or synopsis at http//
Often we hear controversial opinions in digital forensics on the required or desired number of passes to utilize for properly overwriting, sometimes referred to as wiping or erasing, a modern hard drive. The controversy has caused much misconception, with persons commonly quoting that data can be recovered if it has only been overwritten once or twice. Moreover, referencing that it actually takes up to ten, and even as many as 35 (referred to as the Gutmann scheme because of the 1996 Secure Deletion of Data from Magnetic and Solid-State Memory published paper by Peter Gutmann) passes to securely overwrite the previous data. One of the chief controversies is that if a head positioning system is not exact enough, new data written to a drive may not be written back to the precise location of the original data. We demonstrate that the controversy surrounding this topic is unfounded.
Does Eraser clear down small files that are normally stored in an MFT entry?
Yes and no. Directly user 'eraser' to delete a file (which is not in the recycle bin) whose data is resident in MFT entry will remove the data in the MFT, but (ironically) can cause the file data to be additionally written to $LogFile in the process, as part of the way in which Microsoft manages NTFS disks.
Phil.
There is a process to recover data from a whipped drive however I can't remember what it's called. Maybe someone here knows? The 0's and 1's are still detectable from the left over wobble of the magnetic frequency which can remain on the disc. It's got a long winded scientific name.
I wouldn't mind reading into it further too.
This is a MYTH, that had some (NOT full) validity several years ago.
Do read from the actual Author of the paper that "started it all"
http//
Please pay particular attention to the "Epilogue" and to the "Further Epilogue".
Some comments can be found here
http//www.forensicfocus.com/index.php?name=Forums&file=viewtopic&t=2065
http//
http//www.forensicfocus.com/index.php?name=Forums&file=viewtopic&t=3387
jaclaz
This is a MYTH, that had some (NOT full) validity several years ago.
I have to vehemently disagree! evil
Although my approach is different, as keydet89 eloquently explained
Recovering data from a whipped drive is heavily dependent upon a number of things…such as, did the drive enjoy being whipped, did it pay for being whipped, and did it wear a leather mask and ball gag while being whipped?
whipping data doesn't always work.
It highly depends on the data's behavior while being whipped. Sometimes stirring does better job. Vigorous whipping can often collapse the data before it gets to the oven. Furthermore, folding, specially when we include other materials such as raisins or tree nuts, helps not crush the data. !
Therefore, the force of whipping doesn't always work for the best. Taking time and gently stirring or folding can result in a much finer texture of the data after the second rise.
Sorry. It is one of those days for me too! wink