Deleted file retrieval

  • Thread starter Thread starter Sal
  • Start date Start date
S

Sal

Can a file that's been deleted and subsequently had all it's sectors
overwritten with new data be restored to its original content? My
intuitive sense is that it cannot, but I seem to remember a thread on a
different news group where someone claimed that even if a file had been
completely overwritten numerous times, it could still be retrieved.

In light of above, is there a poor man's way (meaning without
specialized software) of rendering a deleted sensitive file
unretrievable by overwriting it's data with another file of equal or
greater size?
 
Even when a file is overwritten, there is a degree of magnetic
retentivity that can (with effort) be read. Thus previous data
has the possibility of being recovered. There are two distinct
types of recovery, Software & Hardware. To stop hardware
recovery takes numerous passes of writing alternating data to
make reading old magnetic states nearly impossible.
Personally, I use CyberScrub for drive security. I would do a
Google as there are likely several free utilities available.
For full drive erasure, many hard drive vendors provide a tool
that does what's called a "Zero Fill" - Writes Zeros to all areas
of the disk.
 
I find it intriguing that previously overwritten data can be recovered.
Assuming a hard drive has been in use for awhile, it's feasible that
the sectors where a file was stored contained previous data themselves,
even before they were overwritten. So how can it be determined exactly
which magnetic 1's and 0's are relevant?
 
One simple technique is to make multiple 'Read' passes over the file/drive,
on each pass the results are stored and then compared to the previous and
next pass. This data is then used to build a table containing the most
likely results for a previously deleted file.
There are other techniques (such as reading the edge of a drive sector as
opposed to the center) and tools to recover data more extensive then the
method described above.

The only way to truly remove all data is to destroy the platters on the
drive.

Jim
 
Back
Top