No practical evidence...overwritten data can be recovered

Discussion in 'Computer Security' started by Non scrivetemi, May 8, 2009.

  1. http://en.wikipedia.org/wiki/Data_recovery

    When data have been physically overwritten on a hard disk it is
    generally assumed that the previous data are no longer possible to
    recover. In 1996, Peter Gutmann, a respected computer scientist,
    presented a paper that suggested overwritten data could be recovered
    through the use of Scanning transmission electron microscopy.[4] In
    2001, he presented another paper on a similar topic.[5] Substantial
    criticism has followed, primarily dealing with the lack of any concrete
    examples of significant amounts of overwritten data being
    recovered.[6][7] To guard against this type of data recovery, he and
    Colin Plumb designed the Gutmann method, which is used by several disk
    scrubbing software packages.

    Although Gutmann's theory may be correct, there's no practical evidence
    that overwritten data can be recovered. Moreover, there are good
    reasons to think that it cannot.[8]
    Non scrivetemi, May 8, 2009
    #1
    1. Advertising

  2. Non scrivetemi

    anon Guest

    http://sourceforge.net/project/showfiles.php?group_id=37015

    > http://en.wikipedia.org/wiki/Data_recovery
    >
    > When data have been physically overwritten on a hard disk it is
    > generally assumed that the previous data are no longer possible to
    > recover. In 1996, Peter Gutmann, a respected computer scientist,
    > presented a paper that suggested overwritten data could be recovered
    > through the use of Scanning transmission electron microscopy.[4] In
    > 2001, he presented another paper on a similar topic.[5] Substantial
    > criticism has followed, primarily dealing with the lack of any concrete
    > examples of significant amounts of overwritten data being
    > recovered.[6][7] To guard against this type of data recovery, he and
    > Colin Plumb designed the Gutmann method, which is used by several disk
    > scrubbing software packages.
    >
    > Although Gutmann's theory may be correct, there's no practical evidence
    > that overwritten data can be recovered. Moreover, there are good
    > reasons to think that it cannot.[8]
    anon, May 8, 2009
    #2
    1. Advertising

  3. Non scrivetemi

    Unruh Guest

    "Non scrivetemi" <> writes:

    >http://en.wikipedia.org/wiki/Data_recovery


    >When data have been physically overwritten on a hard disk it is
    >generally assumed that the previous data are no longer possible to
    >recover. In 1996, Peter Gutmann, a respected computer scientist,
    >presented a paper that suggested overwritten data could be recovered
    >through the use of Scanning transmission electron microscopy.[4] In
    >2001, he presented another paper on a similar topic.[5] Substantial
    >criticism has followed, primarily dealing with the lack of any concrete
    >examples of significant amounts of overwritten data being
    >recovered.[6][7] To guard against this type of data recovery, he and
    >Colin Plumb designed the Gutmann method, which is used by several disk
    >scrubbing software packages.


    >Although Gutmann's theory may be correct, there's no practical evidence
    >that overwritten data can be recovered. Moreover, there are good
    >reasons to think that it cannot.[8]



    Disks now try to use all of the real estate on thedisk to store data, and use
    highly efficient algorithms to use all of the information on the disk
    productively, trather than redundantly. Ie, If it were possible to recover the
    data, that dual level of data ( both the current data and the previous data are
    recoverable) could be used to store current data. And manufacturers try very very
    hard not to waste storage capacity.
    Unruh, May 9, 2009
    #3
  4. Non scrivetemi

    My Name Guest

    Unruh <> related news:Ls8Nl.26209$Db2.22171@edtnps83:

    > "Non scrivetemi" <> writes:
    >
    >>http://en.wikipedia.org/wiki/Data_recovery

    >
    >>When data have been physically overwritten on a hard disk it is
    >>generally assumed that the previous data are no longer possible to
    >>recover. In 1996, Peter Gutmann, a respected computer scientist,
    >>presented a paper that suggested overwritten data could be recovered
    >>through the use of Scanning transmission electron microscopy.[4] In
    >>2001, he presented another paper on a similar topic.[5] Substantial
    >>criticism has followed, primarily dealing with the lack of any concrete
    >>examples of significant amounts of overwritten data being
    >>recovered.[6][7] To guard against this type of data recovery, he and
    >>Colin Plumb designed the Gutmann method, which is used by several disk
    >>scrubbing software packages.

    >
    >>Although Gutmann's theory may be correct, there's no practical evidence
    >>that overwritten data can be recovered. Moreover, there are good
    >>reasons to think that it cannot.[8]

    >
    >
    > Disks now try to use all of the real estate on thedisk to store data, and use
    > highly efficient algorithms to use all of the information on the disk
    > productively, trather than redundantly. Ie, If it were possible to recover the
    > data, that dual level of data ( both the current data and the previous data are
    > recoverable) could be used to store current data. And manufacturers try very very
    > hard not to waste storage capacity.


    http://www.altavista.com/web/result...&dto[y]=2009&filetype=&rc=dmn&swd=&lh=&nbq=50
    --
    A government, of Israel, by Israel, and, for: Israel.
    But all things that are reproved are made manifest by the light:
    for whatsoever doth make manifest is light.
    The light shineth in darkness;
    and the darkness comprehended it not.
    The light of the body is the eye: if therefore thine eye be single,
    thy whole body shall be full of light.
    But if thine eye be evil, thy whole body shall be full of darkness.
    If therefore the light that is in thee be darkness, how great is that darkness!
    Awake thou that sleepest, and arise from the dead,
    and Christ shall give thee light.
    My Name, May 9, 2009
    #4
  5. Non scrivetemi

    Mike Jones Guest

    Responding to Non scrivetemi:

    > http://en.wikipedia.org/wiki/Data_recovery
    >
    > When data have been physically overwritten on a hard disk it is
    > generally assumed that the previous data are no longer possible to
    > recover. In 1996, Peter Gutmann, a respected computer scientist,
    > presented a paper that suggested overwritten data could be recovered
    > through the use of Scanning transmission electron microscopy.[4] In
    > 2001, he presented another paper on a similar topic.[5] Substantial
    > criticism has followed, primarily dealing with the lack of any concrete
    > examples of significant amounts of overwritten data being
    > recovered.[6][7] To guard against this type of data recovery, he and
    > Colin Plumb designed the Gutmann method, which is used by several disk
    > scrubbing software packages.
    >
    > Although Gutmann's theory may be correct, there's no practical evidence
    > that overwritten data can be recovered. Moreover, there are good reasons
    > to think that it cannot.[8]



    Overwritten data does not need to be recovered for legal purposes. All
    that may be required is enough trace of preceding data patterns on a
    platter to confirm an accusation "to an acceptable degree" (this to be
    decided by a court with a poor understanding of the technology). This
    throws the burden of evidence to the contrary onto the planitif.

    While reconstructing a whole HDD might be unfeasable, creating a whole
    can 'o whupass from nothing is very likely within the reach of a
    prosecution.

    Physical destruction is the only sure way to delete a disk.

    Either that, or not putting anything that /could/ be seen (in forensic
    retrospect) as potentially incriminating on it in the first place could
    be a good strategy.

    --
    *===( http://www.400monkeys.com/God/
    *===( http://principiadiscordia.com/
    *===( http://www.slackware.com/
    Mike Jones, May 9, 2009
    #5
  6. Non scrivetemi

    Gerard Bok Guest

    On Sat, 09 May 2009 05:24:59 GMT, Unruh
    <> wrote:

    >"Non scrivetemi" <> writes:


    >>When data have been physically overwritten on a hard disk it is
    >>generally assumed that the previous data are no longer possible to
    >>recover.

    >Disks now try to use all of the real estate on thedisk to store data, and use
    >highly efficient algorithms to use all of the information on the disk
    >productively, trather than redundantly. Ie, If it were possible to recover the
    >data, that dual level of data ( both the current data and the previous data are
    >recoverable) could be used to store current data. And manufacturers try very very
    >hard not to waste storage capacity.


    True. But you are missing a vital ingredient here: money.

    Disk manufacturers have no incentive to put 'as many data as
    physically possible' on a disk. They (and we all) go for 'as many
    data for a buck as feasable'.
    Which means in current terms that 1 TB goes for say $ 100.
    While it might cost another $ 100.000 to retreive 'the previous 1
    TB from that same disk'.
    Law enforcement and secret service operate by standards, quite
    different from a disk manufacturer's.
    A security officer you should keep that in mind :)

    --
    Kind regards,
    Gerard Bok
    Gerard Bok, May 9, 2009
    #6
  7. Non scrivetemi

    Unruh Guest

    (Gerard Bok) writes:

    >On Sat, 09 May 2009 05:24:59 GMT, Unruh
    ><> wrote:


    >>"Non scrivetemi" <> writes:


    >>>When data have been physically overwritten on a hard disk it is
    >>>generally assumed that the previous data are no longer possible to
    >>>recover.

    >>Disks now try to use all of the real estate on thedisk to store data, and use
    >>highly efficient algorithms to use all of the information on the disk
    >>productively, trather than redundantly. Ie, If it were possible to recover the
    >>data, that dual level of data ( both the current data and the previous data are
    >>recoverable) could be used to store current data. And manufacturers try very very
    >>hard not to waste storage capacity.


    >True. But you are missing a vital ingredient here: money.


    >Disk manufacturers have no incentive to put 'as many data as
    >physically possible' on a disk. They (and we all) go for 'as many
    >data for a buck as feasable'.


    Oh yes they do. ?There is a huge competition between disk manufacturers.
    Do you really thing that 1TB on a 3.5 inch disk comes from "manufacturers
    that have no icentive to put as much as physically possible on a disk" When Guttman
    wrote the max disk size lwas a few GB or less.
    >Which means in current terms that 1 TB goes for say $ 100.

    Which means that they spend huge amounts to make sure that they yuse every little bit of the physical
    real estate.

    >While it might cost another $ 100.000 to retreive 'the previous 1
    >TB from that same disk'.


    Just not there.
    >Law enforcement and secret service operate by standards, quite
    >different from a disk manufacturer's.


    They are Hugely more constrained by finacial costs than you are. Prosecutorial services
    are always short of funds, and spending huge sums on some some evidentiary goose chase
    is not looked on kindly by the paymasters.

    >A security officer you should keep that in mind :)


    >--
    >Kind regards,
    >Gerard Bok
    Unruh, May 9, 2009
    #7
  8. Non scrivetemi

    Gerard Bok Guest

    On Sat, 09 May 2009 14:02:30 -0400, Jo Jitty
    <> wrote:

    >Gerard Bok wrote:
    >> On Sat, 09 May 2009 05:24:59 GMT, Unruh
    >> <> wrote:
    >>
    >>
    >>>"Non scrivetemi" <> writes:

    >>
    >>
    >>>>When data have been physically overwritten on a hard disk it is
    >>>>generally assumed that the previous data are no longer possible to
    >>>>recover.
    >>>
    >>>Disks now try to use all of the real estate on thedisk to store data, and use
    >>>highly efficient algorithms to use all of the information on the disk
    >>>productively, trather than redundantly. Ie, If it were possible to recover the
    >>>data, that dual level of data ( both the current data and the previous data are
    >>>recoverable) could be used to store current data. And manufacturers try very very
    >>>hard not to waste storage capacity.

    >>
    >>
    >> True. But you are missing a vital ingredient here: money.
    >>
    >> Disk manufacturers have no incentive to put 'as many data as
    >> physically possible' on a disk. They (and we all) go for 'as many
    >> data for a buck as feasable'.
    >> Which means in current terms that 1 TB goes for say $ 100.
    >> While it might cost another $ 100.000 to retreive 'the previous 1
    >> TB from that same disk'.
    >> Law enforcement and secret service operate by standards, quite
    >> different from a disk manufacturer's.
    >> A security officer you should keep that in mind :)
    >>

    >LOL, in the US who needs evidence!


    I was under the impression that the answer to this question reads

    "that totally depends on who you are working for".
    But then, I am no US citizen ;-)

    --
    Kind regards,
    Gerard Bok
    Gerard Bok, May 9, 2009
    #8
  9. Non scrivetemi

    Gerard Bok Guest

    On Sat, 09 May 2009 14:30:14 GMT, Unruh
    <> wrote:

    > (Gerard Bok) writes:
    >
    >>On Sat, 09 May 2009 05:24:59 GMT, Unruh
    >><> wrote:

    >
    >>>"Non scrivetemi" <> writes:

    >
    >>>>When data have been physically overwritten on a hard disk it is
    >>>>generally assumed that the previous data are no longer possible to
    >>>>recover.
    >>>Disks now try to use all of the real estate on thedisk to store data, and use
    >>>highly efficient algorithms to use all of the information on the disk
    >>>productively, trather than redundantly. Ie, If it were possible to recover the
    >>>data, that dual level of data ( both the current data and the previous data are
    >>>recoverable) could be used to store current data. And manufacturers try very very
    >>>hard not to waste storage capacity.

    >
    >>True. But you are missing a vital ingredient here: money.

    >
    >>Disk manufacturers have no incentive to put 'as many data as
    >>physically possible' on a disk. They (and we all) go for 'as many
    >>data for a buck as feasable'.

    >
    >Oh yes they do. ?There is a huge competition between disk manufacturers.
    >Do you really thing that 1TB on a 3.5 inch disk comes from "manufacturers
    >that have no icentive to put as much as physically possible on a disk"


    As I said: They are in business. Their line of thought is not
    'physically possible" but "commercially viable".

    >Prosecutorial services are always short of funds,


    That's simply not true.
    Prosecutorial services are driven by politics.
    (Whether or not funds are available in a certain case often just
    depends on how far the next elections are off.)

    --
    Kind regards,
    Gerard Bok
    Gerard Bok, May 9, 2009
    #9
  10. Non scrivetemi

    Jo Jitty Guest

    Gerard Bok wrote:
    > On Sat, 09 May 2009 05:24:59 GMT, Unruh
    > <> wrote:
    >
    >
    >>"Non scrivetemi" <> writes:

    >
    >
    >>>When data have been physically overwritten on a hard disk it is
    >>>generally assumed that the previous data are no longer possible to
    >>>recover.

    >>
    >>Disks now try to use all of the real estate on thedisk to store data, and use
    >>highly efficient algorithms to use all of the information on the disk
    >>productively, trather than redundantly. Ie, If it were possible to recover the
    >>data, that dual level of data ( both the current data and the previous data are
    >>recoverable) could be used to store current data. And manufacturers try very very
    >>hard not to waste storage capacity.

    >
    >
    > True. But you are missing a vital ingredient here: money.
    >
    > Disk manufacturers have no incentive to put 'as many data as
    > physically possible' on a disk. They (and we all) go for 'as many
    > data for a buck as feasable'.
    > Which means in current terms that 1 TB goes for say $ 100.
    > While it might cost another $ 100.000 to retreive 'the previous 1
    > TB from that same disk'.
    > Law enforcement and secret service operate by standards, quite
    > different from a disk manufacturer's.
    > A security officer you should keep that in mind :)
    >

    LOL, in the US who needs evidence!
    Jo Jitty, May 9, 2009
    #10
  11. Non scrivetemi

    Justin Thyme Guest

    On Sat, 09 May 2009 15:29:20 GMT, (Gerard Bok) wrote:


    >
    >That's simply not true.
    >Prosecutorial services are driven by politics.
    >(Whether or not funds are available in a certain case often just
    >depends on how far the next elections are off.)


    Actually, I don't think prosecutors are the main customers for this
    sort of thing. It would be tricky to get a conviction for "possession"
    of something that you don't have access to. Most of us don't have a
    scanning electron microscope and can't access anything requiring one.
    Investigators are another matter, if the disk contains clues to where
    other information might be found.

    J. T.
    Justin Thyme, May 10, 2009
    #11
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. remco

    Overwritten mailbox

    remco, Jul 16, 2003, in forum: Computer Support
    Replies:
    5
    Views:
    761
  2. paladin2112

    HELP !!! Recoverying Overwritten Outlook Express files

    paladin2112, Sep 17, 2003, in forum: Computer Support
    Replies:
    1
    Views:
    996
    trout
    Sep 17, 2003
  3. Replies:
    10
    Views:
    490
  4. file recovered, but data is gibberish

    , Nov 16, 2005, in forum: Computer Support
    Replies:
    5
    Views:
    1,243
  5. Replies:
    4
    Views:
    1,296
Loading...

Share This Page