2

This question already has an answer here:

I need to recover some old data which were stored on a drive. The data were deleted and the hard drive was formatted twice and filled twice with random data intentionally.

First the drive had a Windows 7 installed.

Then it was formatted twice with windows installer. After each format the space was filled with random video files.

Considering that when we delete something from a drive, only the index is deleted, the actual data is removed when new information is overwritten in that section of the drive.

The drive is an SSD.

Is there any possibility to find the old data?

marked as duplicate by Xander, Teun Vink, Rory Alsop Dec 19 '18 at 17:23

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 2
    Too many variables to answer: the only answer is "maybe" – schroeder Dec 12 '18 at 20:37
6

Given the information that you have rewritten all ssd contents twice with true random data to the brim I'd say

No, you cannot recover any data from that disk.

This is the sane answer to give to people who lost data and e. g. show up in a data recovery shop.


If you want an academic answer weather or not it's possible at all then we're entering the hypothetical sphere of "given unlimited money and will - is it then possible?". There are a lot of contributing factors (e. g. SSD Controller, state of dead cells, random data source, partition alignment, …). But since you asked folks on the internet instead of physically shredding that disk I assume the disk holds no valuable information for any world power.


Please notice that the "Loose all data" option at your operating system installer does not perform a complete wipe of the disk.

  • 4
    @forest , it may have a few percent of a few percent of the original disk’s image remaining in some of the blocks that were cycled through the wear leveling process, and some original data may still be occupying a bad block. But the chances of recovering a specific file intact are minuscule, especially if the desired file was larger than a single block. – John Deters Dec 13 '18 at 4:09
  • 1
    This is the hypothetical sphere we're entering. Having a "recall one seminal paper" doesn't directly translate to "there's a tool that makes data recovery possible for OP". – BlueWizard Dec 13 '18 at 9:15
  • 1
    @BlueWizard There are reasons to give an incomplete or abstract answer. The reason "because you asked people on the internet" is not one of them - especially not on a Q&A site on the internet. – Tom K. Dec 13 '18 at 9:20
  • 2
    @forest, There are two ways to look at it. If you are a forensic investigator, you might be looking for anything that is evidence, and may be satisfied with finding a single frame of incriminating video. If you are a person looking to recover a treasured photo from an accidental overwrite, you need a very specific set of blocks to have survived. The investigator is in a strong position to find something of value, but the person is not. Yes, if you are looking for a way to thoroughly clean a drive overwriting is insufficient, but that doesn’t mean data is likely recoverable after an overwrite. – John Deters Dec 14 '18 at 15:57
  • 2
    @JohnDeters You're right. I'm looking at it from the forensics perspective. – forest Dec 15 '18 at 0:43
1

Is Data Remanence a Myth?

This is great coverage of the underlying question -- is data recoverable after a wipe. And while the preponderance of answers agree to be "no", the source documentation does also asert this but acquieses that bits of information are potentially recoverable.

So the answer to your question is "no", you cannot recover whole video files after a byte-by-byte overwrite. However, if the drive is known to contain text based data of significant interest where fragments may be enough to piece together a provactive picture, the answer becomes less definite. But, in those cases, you'd be talking in the realm of corporate espionage by the biggest companies in the world and/or nation-states.

0

It depends on what you mean when you say “filled with random video files”.

If the drive was completely filled to capacity with new data, it is highly unlikely to be retrievable.

If the drive was filled to 50% of capacity with new data, the chances are better, but not great.

  • Filled completely ☹ – Vini7 Dec 12 '18 at 21:08
  • 1
    Video files usually have compression. Thus it's unlikely that the SSD controller compressed it before writing it. Some people try to "zero out" their SSDs and then are astonished at the speed on which the SSD is able to do so. – BlueWizard Dec 12 '18 at 21:18
0

You said the hard drive is SSD. This is enough information to answer with a resounding no - even with a single pass write. Let me explain why ...

With an SSD when you delete a file the operating system sends a TRIM command to the SSD and the SSD will delete said file completely. This happens immediately. Why? Because it's faster for the SSD/OS to work this way.

You can read more about it here. Provided the OS issues the TRIM command and the SSD acts upon it then a 1 pass write is enough.

Any more than that and you're just going to burn your SSD out quicker.

Not the answer you're looking for? Browse other questions tagged or ask your own question.