LITTLEBLACKDOG.COM

Posted: Mon Nov 27, 2000 4:38 pm Post subject:

is it true that emptying the recycle bin doesn't necessariliy delete the files completely? are the deleted files stll retreiveable??

Big Dog Joined: 20 Oct 2000 Posts: 3689 Location: USA

the actual data is still on your hard drive someplace, all emptying the recycle bin does is erase the location data for all the fragments that add to gether to make up the files

but anyone with some recovery software, and a little patience can find those fragments, and quite possibly turn them back into files.

personally I'd go read the article on installing PGP and once you have it installed, you can "PGP" a file out of permanent existance, much safer than "deleting" them (using pgp to permanently delete a file becomes part of the menu options when you right click on a file)

http://www.littlewhitedog.com/reviews_other_00008a.asp

There is NO spoon !
-Brain

Butt Sniffer Joined: 24 Oct 2000 Posts: 1545 Location: USA

I remember seeing an old dos Norton progie that when ran you could find files that were deleted and not writen over. They would show up with the first letter removed. I think when you delete files, from windows at least, that is what it does, just removes the first letter so it is no longer recognizeable. Correct me if i am wrong.....

One there can only be
and i'm not it. ò¿ò

Posted: Tue Nov 28, 2000 9:08 am Post subject:

what software is capable of doing such a deed?

Cat Chaser Joined: 24 Oct 2000 Posts: 951 Location: USA

I thought when you empty the recycling bin, windows deletes the location of the file in the file alocation table, so in essence the file is deleted from the FAT.

----------------------------

Booyah grandma. Booyhah.

Posted: Tue Nov 28, 2000 3:16 pm Post subject:

Yes.. it's true that those data that have been erased from the recycle bin is possible to recover by using some software such as Go Back, Norton Recover Utility or whatever it call. Also, heard that .. there are some decoding programs that have been used by FBI to extract any sensitive data from the erased hard-disk. Is that possible even after reformat the whole hard-disk?

Big Dog Joined: 20 Oct 2000 Posts: 3689 Location: USA

Quote:

Yes.. it's true that those data that have been erased from the recycle bin is possible to recover by using some software such as Go Back, Norton Recover Utility or whatever it call. Also, heard that .. there are some decoding programs that have been used by FBI to extract any sensitive data from the erased hard-disk. Is that possible even after reformat the whole hard-disk?

the FBI uses a machine code program to determine the specific relative polarity of each bit on the hard drive ( not if it's positive or negative, bit HOW much positive or negative it is) then that information is fed into a larger computer which runs a decryption style algorythm to try to determine that the last value of the bit was, in theory if they get enuff of the bits, correct they can reconstruct the data by intorpolation (taking the bits they are sure, of, and running all of the possabilities on the other bits till they get something that makes some kind of sense)

if that doesn't give them something they find usable they disassemble the drive and use quantum imaging on the platters (to get a better resolution on the previous polarity of the data), and re-run the decryption algorythms

the quantum approach costs a hell of alot fo $$ but i read it's 93% accurate before decryption, and 99.99...... out to 10 places accurate after decryption

so YES the FBI can rebuild whatever was on your hard drive unless it's been over written with a random pattern a few times, or unless it's degaussed or taken apart, and the platters are physically rendered unreadable ( scrape off the media by abbrasion or acid or something)

There is NO spoon !
-Brain

Posted: Wed Nov 29, 2000 2:58 pm Post subject:

does that Wipe option in PGP really do the job?? it takes a while when you wipe files compared to just emptying the recycle bin

Big Dog Joined: 20 Oct 2000 Posts: 3689 Location: USA

the wipe option from PGP is SUPPOSED to write over the data with several, known values ( in hexidacimal...like all 1's, and then all 2's.. etc) and then after it does that enough times it double over writes it with random data, thus completely destroying any chance of recovery. I read some place that it exceeds the specifications for the C2 level of data security (government specs) for data on a hard disk

so it sounds like it does a good job

personally, I used it once to completely frag somebody's hard drive, and they couldn't recover a damn thing, and that person used 4 diffrent tools trying to recover files

There is NO spoon !
-Brain

Posted: Wed Nov 29, 2000 4:31 pm Post subject:

typically, how much is recoverable? like all the files you've had in the past?

Big Dog Joined: 20 Oct 2000 Posts: 3689 Location: USA

recoverable how Confused

:

by the Feds, or by some generic file recovery software

There is NO spoon !
-Brain

Posted: Thu Nov 30, 2000 4:51 pm Post subject:

are all the files that you've had in the past & deleted still recoverable?

Butt Sniffer Joined: 24 Oct 2000 Posts: 1545 Location: USA

BRAIN, Will a low-level format wipe all data off a HDD and not let it be recovered in any way shape or form ?

One there can only be
and i'm not it. ò¿ò

Big Dog Joined: 20 Oct 2000 Posts: 3689 Location: USA

Quote:

are all the files that you've had in the past & deleted still recoverable?

by the feds ? maybe, it depends on alot of factors ( if you just deleted them, and didn't PGP them)

by generic recovery software, pretty much just stuff that you haven't over written, either by accident(new data, or page file) or by doing a defrag or overwritten on purpose

IF you PGP'd something feel free to consider it gone

Quote:
BRAIN, Will a low-level format wipe all data off a HDD and not let it be recovered in any way shape or form ?

it's SUPPOSED to. low level is supposed to reset everything to almost absolute zero. it frags any MBR and partition info even cluster info.

however, I wouldn't be too trusting of that unless you have the ability to perform a low level as an option in BIOS

I had to checkout like 15 "approved" applications that were supposed to wipe your drive squeeky clean at my last job (not damage the drive, just get rid of the data) and like 11 of them allowed atleast partial recovery of some of the previous files. All i had to do was create some partition structure, and scan it with drive recovery software. (sorry, didn't keep the list, and none of them were big names)

after all that wasted time I convinced my boss it was better to just purchase a drive degausser, and kill all of the drives for good

if you DO have to rely on software to delete data, for good, i'd fill the disk full of random data (like copying all of your game cd's to the disk till it's absolutely full) leaving like 5 meg free, then do a defrag ( to provide the multiple over writes.. this WILL take a long time though) then leave all the temp data on the drive, and then use the software to get rid of the data

There is NO spoon !
-Brain

Butt Sniffer Joined: 24 Oct 2000 Posts: 1545 Location: USA

HEHEHE probably the best, fastest, thing to do is take a 3lb sledge hammer to it then![} Smile

]

One there can only be
and i'm not it. ò¿ò