No practical evidence...overwritten data can be recovered

Discussion in 'Computer Security' started by Non scrivetemi, May 8, 2009.


    When data have been physically overwritten on a hard disk it is
    generally assumed that the previous data are no longer possible to
    recover. In 1996, Peter Gutmann, a respected computer scientist,
    presented a paper that suggested overwritten data could be recovered
    through the use of Scanning transmission electron microscopy.[4] In
    2001, he presented another paper on a similar topic.[5] Substantial
    criticism has followed, primarily dealing with the lack of any concrete
    examples of significant amounts of overwritten data being
    recovered.[6][7] To guard against this type of data recovery, he and
    Colin Plumb designed the Gutmann method, which is used by several disk
    scrubbing software packages.

    Although Gutmann's theory may be correct, there's no practical evidence
    that overwritten data can be recovered. Moreover, there are good
    reasons to think that it cannot.[8]
    Non scrivetemi, May 8, 2009
    1. Advertisements

  2. Non scrivetemi

    anon Guest

    1. Advertisements

  3. Non scrivetemi

    Unruh Guest

    Disks now try to use all of the real estate on thedisk to store data, and use
    highly efficient algorithms to use all of the information on the disk
    productively, trather than redundantly. Ie, If it were possible to recover the
    data, that dual level of data ( both the current data and the previous data are
    recoverable) could be used to store current data. And manufacturers try very very
    hard not to waste storage capacity.
    Unruh, May 9, 2009
  4. Non scrivetemi

    My Name Guest[y]=2009&filetype=&rc=dmn&swd=&lh=&nbq=50
    A government, of Israel, by Israel, and, for: Israel.
    But all things that are reproved are made manifest by the light:
    for whatsoever doth make manifest is light.
    The light shineth in darkness;
    and the darkness comprehended it not.
    The light of the body is the eye: if therefore thine eye be single,
    thy whole body shall be full of light.
    But if thine eye be evil, thy whole body shall be full of darkness.
    If therefore the light that is in thee be darkness, how great is that darkness!
    Awake thou that sleepest, and arise from the dead,
    and Christ shall give thee light.
    My Name, May 9, 2009
  5. Non scrivetemi

    Mike Jones Guest

    Responding to Non scrivetemi:

    Overwritten data does not need to be recovered for legal purposes. All
    that may be required is enough trace of preceding data patterns on a
    platter to confirm an accusation "to an acceptable degree" (this to be
    decided by a court with a poor understanding of the technology). This
    throws the burden of evidence to the contrary onto the planitif.

    While reconstructing a whole HDD might be unfeasable, creating a whole
    can 'o whupass from nothing is very likely within the reach of a

    Physical destruction is the only sure way to delete a disk.

    Either that, or not putting anything that /could/ be seen (in forensic
    retrospect) as potentially incriminating on it in the first place could
    be a good strategy.
    Mike Jones, May 9, 2009
  6. Non scrivetemi

    Gerard Bok Guest

    True. But you are missing a vital ingredient here: money.

    Disk manufacturers have no incentive to put 'as many data as
    physically possible' on a disk. They (and we all) go for 'as many
    data for a buck as feasable'.
    Which means in current terms that 1 TB goes for say $ 100.
    While it might cost another $ 100.000 to retreive 'the previous 1
    TB from that same disk'.
    Law enforcement and secret service operate by standards, quite
    different from a disk manufacturer's.
    A security officer you should keep that in mind :)
    Gerard Bok, May 9, 2009
  7. Non scrivetemi

    Unruh Guest

    Oh yes they do. ?There is a huge competition between disk manufacturers.
    Do you really thing that 1TB on a 3.5 inch disk comes from "manufacturers
    that have no icentive to put as much as physically possible on a disk" When Guttman
    wrote the max disk size lwas a few GB or less.
    Which means that they spend huge amounts to make sure that they yuse every little bit of the physical
    real estate.
    Just not there.
    They are Hugely more constrained by finacial costs than you are. Prosecutorial services
    are always short of funds, and spending huge sums on some some evidentiary goose chase
    is not looked on kindly by the paymasters.
    Unruh, May 9, 2009
  8. Non scrivetemi

    Gerard Bok Guest

    I was under the impression that the answer to this question reads

    "that totally depends on who you are working for".
    But then, I am no US citizen ;-)
    Gerard Bok, May 9, 2009
  9. Non scrivetemi

    Gerard Bok Guest

    As I said: They are in business. Their line of thought is not
    'physically possible" but "commercially viable".
    That's simply not true.
    Prosecutorial services are driven by politics.
    (Whether or not funds are available in a certain case often just
    depends on how far the next elections are off.)
    Gerard Bok, May 9, 2009
  10. Non scrivetemi

    Jo Jitty Guest

    LOL, in the US who needs evidence!
    Jo Jitty, May 9, 2009
  11. Non scrivetemi

    Justin Thyme Guest

    Actually, I don't think prosecutors are the main customers for this
    sort of thing. It would be tricky to get a conviction for "possession"
    of something that you don't have access to. Most of us don't have a
    scanning electron microscope and can't access anything requiring one.
    Investigators are another matter, if the disk contains clues to where
    other information might be found.

    J. T.
    Justin Thyme, May 10, 2009
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.