Data recovery without partition table, FAT and directory table?

  • Thread starter Thread starter Peter Frank
  • Start date Start date
P

Peter Frank

Hi,

Is it possible to recover data from an HDD without having access to a
readable partition table, FAT and directory table?

Well, the reason I ask this is not because all of these are damaged on
my HDD but there is a software that encrypts all of these and I would
like to know whether this method provides some data security or not.
(Protection against software-based recovery tools would be sufficient
for me, hardware-based data recovery is a whole other thing.)

Regards,
Peter
 
Previously Peter Frank said:
Hi,
Click to expand...
Is it possible to recover data from an HDD without having access to a
readable partition table, FAT and directory table?
Click to expand...
Well, the reason I ask this is not because all of these are damaged on
my HDD but there is a software that encrypts all of these and I would
like to know whether this method provides some data security or not.
(Protection against software-based recovery tools would be sufficient
for me, hardware-based data recovery is a whole other thing.)
Click to expand...

This gives you zero data protection against anyone that wants data
that has a good chance of residing in single clusters, like passwords.
Also media files will leave enough data in one pice to allow
recognition by partial signatures (hashes over pices) and maybe
automated reconstruction. Then there is the problem that in any good
filesystem files will mostly get consecutive clusters. Also files that
fit into one cluster will not need any recovery effort at all.

So all data is there. Some can ge gotten very easily, some might be
harder and some might need some puzzeling together, but if the
contents of a file is recognisable as interesting from cluster-sized
pices (4kB...32kB or so typically) any halfway competent IT person
should be able to find it with reasonable effort.

To sum up: From a security POV this is worthless against an expert
attacker of any level. It might help against people without IT
competence.

Arno
 
Is it possible to recover data from an HDD without having access to a
readable partition table, FAT and directory table?

Well, the reason I ask this is not because all of these are damaged on
my HDD but there is a software that encrypts all of these and I would
like to know whether this method provides some data security or not.
Click to expand...

So data itself is not encrypted?!
 
Peter said:
not.

So data itself is not encrypted?!
Click to expand...

Right, the data itself are not encrypted. This sort of "encryption" is
extremely fast, but - as I was told here - it does not provide good
security at all.

Regards,
Peter - No.2, not to be be confused with you ;-)
 
Peter said:
not.

So data itself is not encrypted?!
Click to expand...

Right, the data itself is not encrypted. This sort of "encryption" is
extremely fast, but - as I was told here - it does not provide good
security at all.

Regards,
Peter - No.2, not to be be confused with you ;-)
 
Arno said:
This gives you zero data protection against anyone that wants data
that has a good chance of residing in single clusters, like passwords.
Also media files will leave enough data in one pice to allow
recognition by partial signatures (hashes over pices) and maybe
automated reconstruction. Then there is the problem that in any good
filesystem files will mostly get consecutive clusters. Also files that
fit into one cluster will not need any recovery effort at all.
Click to expand...

I now tried it out myself with a data recovery tool. All filename and
directory structure information was lost but many files could be
recovered intact from the harddisk. Then, I tried the same thing on a
USB stick (i.e. no partition table, FAT and directory table) and
couldn't recover anything.
Why is that?

Peter
 
Previously Peter Frank said:
Arno Wagner wrote:
Click to expand...
I now tried it out myself with a data recovery tool. All filename and
directory structure information was lost but many files could be
recovered intact from the harddisk.
Click to expand...

Not surprising. Although automated tools are somewhat limited
compared to an expert using his/her skills and imagination.
Good approach though to try to verify what was told you here.
Then, I tried the same thing on a
USB stick (i.e. no partition table, FAT and directory table) and
couldn't recover anything.
Why is that?
Click to expand...

Maybe the stick had far smaller cluster size making recovery more
difficult. Or mey be some flag that tells the filesystem that
writing files to consecutive sectors does not make things faster
on the device and the filesystem just shuffled the clusters more
than on the HDD where writing files to consecuive sectord can gain
you several orders of magitude faster write speed.

But that is just idle speculation. All the data in the files is still
there on the USB stick as well. Addresses, names, passwords, fragments
from media files large enough to recognise them, ...

Arno
 
Back
Top