For questions generally relating to recovery of "plain" data from digital storage, when that storage has been damaged or the credentials securing it are lost.

learn more… | top users | synonyms

4
votes
2answers
63 views

How are SSDs different from HDDs from the privacy point of view? [duplicate]

How are SSDs different from HDDs from the privacy point of view? Is it easier or harder to recover traces of deleted and/or wiped (overwritten) files from an SSD than from a HDD?
8
votes
1answer
211 views

Cases where DBAN has won

Are there any real life cases where software such as DBAN (to securely erase disks) has beaten government/law enforcement agencies? I found this online which lists each time encryption has beaten ...
5
votes
2answers
183 views

Data Abstraction Layers in Forensic Imaging

I am a bit confused from various sources about the abstraction level and layers that a file resides in forensic imaging. I have found two slightly different explanations: The first one includes a) ...
0
votes
0answers
28 views

Need computer forensic case citation (urgent) [migrated]

My mother is about to attend court over a car which was written off by a lorry. The CCTV video recording of the accident was mishandled, such as the storage SD card not being imaged, it was also ...
2
votes
2answers
218 views

How to tell if an email is encrypted, or just corrupted?

Ran a recovery program (Kroll Ontrack) on a Windows 7 PC and recovered many, many emails. Almost all of them open in my Windows 10 mail client (and Thunderbird), except for a handful from this March. ...
139
votes
8answers
16k views

What should you do if you catch ransomware mid-operation?

You boot up your computer one day and while using it you notice that your drive is unusually busy. You check the System Monitor and notice that an unknown process is using the CPU and both reading and ...
9
votes
2answers
358 views

Do I need to use the cipher command with a newer SSD to erase files?

I've used Eraser in the past, and recently became aware of the cipher command in Windows 8. Specifically, with the /w flag: /w removes data from portions of the volume it can access and have not ...
1
vote
0answers
39 views

Do Android Security Measures Work on an Unlocked Bootloader?

Let's assume we have an Android device with: Unlocked bootloader Full Device Encryption Password lockscreen Will Android security measures (FDE and password lock) still be able to prevent data ...
3
votes
3answers
9k views

Can files deleted from a true crypt volume be recovered?

I have a True Crypt volume that's set as a file. When I mount the volume and delete a file within the container, windows asks if I'd like to send the file to the recycle bin. While the volume is ...
1
vote
0answers
62 views

Data recovery from BitLocker encrypted device that has been quick-formatted

I apologize if this is in the wrong place, but I couldn't find anywhere else that seemed appropriate for these questions. My classmate has a 512GB USB drive that he had formatted as exFAT and ...
6
votes
3answers
112 views

Is tails os susceptible to a cold boot attack?

I've looked at the documentation and it mentions that upon shutdown the data residing in the ram is overwritten, however it doesn't go into any detail on how it does this. Documentation link: https://...
1
vote
1answer
46 views

Break encryption by applying accidental-overwrite techniques

I read that there are ways, at least on mechanical drives, to sometimes recover data that was overwritten (not just deleted). Now I was wondering if it was theoretically possible to break a fresh ...
8
votes
2answers
223 views

Magnet to wipe HDD [duplicate]

This question is for HDD, not SDD. Would a Neodymium magnet like this one be strong enough to wipe the contents of a hard disk drive? How long would such an act take to destroy any data so it's not ...
0
votes
3answers
90 views

How many backups should I keep?

Recently my backup disk almost got full because of all the backups we keep: 30 days of daily backups for every database (mongodb). So, the more databases we have, the more space we need for backups. ...
1
vote
1answer
39 views

What threats are mitigated in drives encrypted by USB-SATA bridge?

Some external HDDs (notably, WD Essentials) are known to be encrypted by the USB-SATA bridge present in their case: Essentials drives are hardware encrypted. The USB-SATA bridge board is required ...
0
votes
0answers
129 views

How to decrypt a microSD card after a factory reset of the device used to encrypt it?

Two month ago, I encrypted my Micro SD card in my Android device (Samsung Galaxy S5) for security purposes, and yesterday I forgot to decrypt it whilst removing the card I and factory resetting the ...
54
votes
6answers
11k views

Can RAM retain data after removal?

Is it possible for RAM to retain any data after power is removed? I don't mean within a few minutes such as cold boot Attacks but rather 24 hours plus. Working with classified systems the policy ...
1
vote
1answer
72 views

Securely remove data from hard drive without killing recovery partition

Information Security vs Business question here: IT department asks me for a way to securely remove data from a hard drive because they want to sell old hardware. I suggest DBAN as a secure wipe ...
0
votes
0answers
38 views

Accessible data when hard-drive is encrypted

I recently acquired a new computer so I decided to try a few things, such as disk-encryption (fir the record, I installed Ubuntu 15.10, made only one partition, wiping everything that was here). I ...
2
votes
2answers
164 views

Deleted files and their traces

Lets say we delete various files , from hard disk A, with shift - delete , windows 8 . Then we copy new files to the same hard disk A. Then those new files we just copied there to hard disk A, we ...
2
votes
1answer
118 views

Secure data by encrypting and rewriting on same file

I'm working on a project to Encrypt files using AES encryption with a key generated from SHA-256 from a keyword. My idea to claim this was to first : read all bytes from a file second : encrypt ...
-1
votes
2answers
63 views

How likely is it to find valuable information in the slack space of a workstation?

I just read about slack space which is the unused space at the end of a sector. This space is unused in some sectors when either the file itself is smaller then the sector or the sector contains the ...
0
votes
1answer
63 views

Dealing with password vault recovery after a catastrophic failure as a home user

I had a dinner with some friends today, and I mentioned that I use 1Password combined with Dropbox to manage my password. One of them then remarked something which I actually hadn't considered: ...
10
votes
2answers
298 views

Could data be recovered from cut magnetic stripe card?

I know all systems accepting magnetic stripe cards (card readers, access systems, etc) would reject a cut one. But could and expert still get the data that was on it? For the record, I mean "cut in ...
3
votes
3answers
103 views

how many time to take fully destroy a deleted video from SD card?

I have deleted a video from my SD card six months ago. How much times does it take to fully destroy this video file on the SD card? If I wanted to recover this video, is it possible to recover?
0
votes
1answer
261 views

Is it possible to recover a Diskcryptor volume password?

Must admit to being dumb: I have encrypted one partition from my external hard drive with the AES-Twofish-Serpent algorithm and used a key file with a password. My PC ran into a problem and now the ...
9
votes
4answers
3k views

Securely erase personal data from android phone before selling

I have just sold online my old Nexus 5 (Android Lolipop) and need to post it tomorrow morning. I would like to make sure the new owner can't access my files. What should I do?
0
votes
0answers
42 views

What is the legislation (if any) behind self-employment Data Recovery/Destruction?

I am a self-employed technical advisor of about 2 years, and have run into a dilemma: Legislation for Data Destruction and Recovery. Throughout my career, I've been asked many questions regarding ...
5
votes
6answers
7k views

Overwriting hard drive to securely delete a file?

I am working on a computer that I am not allowed to install new software on. It does not have secure delete software installed. Suppose I have a file (or files) that are sensitive that I'd like to ...
19
votes
4answers
4k views

Why is writing zeros (or random data) over a hard drive used when writing all ones is more beneficial? [duplicate]

As far as I know, in order to securely delete the hard drive's contents, one should fill it with zeroes or, for added security and harder recoverability, random data first and then all zeroes. In ...
3
votes
4answers
1k views

How to detect self destructing emails? How to prevent from self destruction?

Recently I came across a gmail extension for Chrome browsers which claims to send self destructive emails. I tested by sending self destructive emails to my email account and it works fine Now my ...
0
votes
2answers
162 views

Decrypting old data from PHP extension

I recently came across an old website of mine that I had used the PageProtectionPlus MediaWiki extension to encrypt parts of. I'm curious to see what I wrote, but the extension is no longer supported ...
5
votes
2answers
1k views

How to securely encrypt data with a public-private key encryption scheme, but also allow decryption if the private key is lost?

This question is a followup question to Storing plaintext passwords for cameras - Security concerns?. In that question, I posed what I thought was a simple question, which actually turned out to have ...
-1
votes
3answers
237 views

Overwriting only Free Space with rubbish data to prevent data recovery?

I am aware of tools which write zeros or other useless data to fill up your harddrive, however so far all of the tools I have come across must fill up the entire harddrrive. My understanding of the ...
0
votes
4answers
148 views

How difficult is it to protect your storage from data recovery

Many of my customers refuse to sell or recycle their old hard drives or mobile phones because everybody now-days talks about how popular data recovery program's are. Isn't it enough to use a software ...
1
vote
1answer
119 views

GPG encryption date or GPG version recoverable?

Is there a way to determine the date of encryption or the GPG version of a GPG-encrypted file (with symmetric encryption)? I lost the password but some rough information about when the file was ...
0
votes
1answer
422 views

Does microwaving a CD erase it?

I just read the question: Does microwaving a hard drive erase it? and now I am curious too... does microwaving a CD (or for that matter, DVD, or blu-ray) erase it? My initial thought is that some ...
9
votes
4answers
5k views

How does forensic software detect deleted files

How does forensic software detect deleted files? When a file is deleted, the pointer from MFT in NTFS system is deleted and the file is no longer accessible from the OS. If our disk is fragmented how ...
0
votes
1answer
108 views

Storing data permanently vs temporarily

My lecturer said that since hard disk space is so cheap these days, most organisations do not delete the data on the disk. Rather, they only logically delete it (remove the link to the data). If this ...
1
vote
1answer
86 views

Data recovery from file collections [closed]

I am presently working as a summer intern. My first objective is, given a collection of files, recover and identify the file types present in it. To download sample pseudo-forensics data I have been ...
6
votes
3answers
4k views

Is filling up the empty space in a disk with any data enough measure against file recovery

If I have an important data in a disk (flash, SSD or HDD) and I deleted them, I know it is easy to recover these deleted data (even by using free software like recuva. Now if I fill this disk with any ...
3
votes
1answer
2k views

How can I recover a GPG private key from a PC which has died? [closed]

Long story short - PC with kleopatra processor died, and I only have a backup of my public key. I've gone into the HDD and tried to re-jig kleopatra in the hope it would remember everything for me on ...
3
votes
1answer
12k views

Is there any way to crack bitlocker drive?

We have disk drive that encrypt with BitLocker . Is there any way to hack or crack and recover our data? my key is lost. AND we haven't any backup from those data!
2
votes
3answers
145 views

Creating a custom restore disk to prevent data mining?

I work in commercial telecoms and one part of our business is the leasing of computer equipment to call centers. If the customer for whatever reason gives us the equipment back (non-payment, out of ...
0
votes
2answers
94 views

Secure system generated symmetric keys

I'm developing a system that manages and shares user passwords (which are encrypted using user generated symmetric keys). But of course a big concern is the user losing their symmetric key and the ...
1
vote
3answers
505 views

Environmentally friendly ways to destroy hard drives

The best method to prevent others from reading the data on hard drives is to destroy the drives physically: a sledgehammer is a cheap and effective tool to prevent the data from being read again. ...
7
votes
1answer
203 views

What's the best duration for storing e-mail? [closed]

We’ve all become so accustomed to using email in our daily personal and working lives that we really don’t give a whole lot of thought to it. It’s the fastest way to communicate with others in the ...
2
votes
2answers
437 views

Is there any way of recover a locked drive using TPM?

Just reading I learned about the TPM technology and how it works. However, it make me wonder... if the motherboard crashes, is the data lost forever? Because you can't use the drive in other system ...
0
votes
0answers
27 views

Secure delete with urandom? [duplicate]

What recovery techniques (if any) exist that can recover data from a mechanical HDD if the user has filled the disk with a single run of dd if=/dev/urandom of=/dev/[disk]? Or in other words: is this ...
7
votes
1answer
1k views

How isolated are files on a VirtualBox virtual machine from the host filesystem?

When transferring ownership of a computer from one party to another, it's advisable to perform steps to clean out personal data from the hard drive. Depending on needs, the type of data, and/or level ...