14

Is it possible to recover securely (or wiped out) deleted data from a hard drive using forensics?

Imagine police have arrested a hacker, and that hacker, before getting caught, has removed all information that leads him/her to be found guilty on his/her PC using a secure deleting method. In this case, is it possible for police forensics (or any department) to recover the deleted data?

2
  • 5
    Agreeing with people below: you need to specify "secure wipe" or change the wording: secure by definition means it is not recoverable. Mar 12, 2014 at 21:25
  • DoD says that it is always possible to recover it. Using normal equipment they have specified the multiple-over-write protocols to guard against "bit-walking" where the magnetic domains shift in position slightly. However, with an electron Microscope it is always possible to look down through the layers and see what is underneath. (Hint: expensive) Hence their guidance for total destruction of the drive, whether by thermite or sledgehammer. Our guys who were forced down in China used thermite.
    – SDsolar
    May 23, 2017 at 21:25

5 Answers 5

14

Your question has a problem with the definitions of the words in it.

If a HDD has been securely wiped, by definition, no recovery is possible. If a HDD has not been securely wiped, by definition, recovery is possible.

Perhaps you mean: How secure are various methods of wiping Hard Drives? Very secure, assuming you're talking about "traditional" drives (with magnetic spinning platters) and you use something reputable like Darik's Boot And Nuke (aka DBAN).

There is some concern about how to securely erase Solid State Drives, because the drives have a built in ability to evenly (and transparently) distribute read and write operations across its entire memory space. This is done to increase lifespan of the drive, but can frustrate secure erase operations.

9
  • 4
    Most modern SSDs use hardware AES encryption by default, so they just have to throw away the encryption key...
    – Jingo
    Mar 12, 2014 at 21:31
  • 2
    An excellent point, although it should be noted that it is not always simple to implement correctly. Mar 12, 2014 at 22:13
  • 2
    Not sure this goes for "most" SSDs, and you still need to enable the encryption. Mar 13, 2014 at 5:57
  • 1
    Thanks for the answer.I know if a H.D.D is securely wiped out,there would be no way to recover lost data,but i have heard that it is possible to disassemble H.D.D parts then reconstructing them in order to recover lost securely wiped out data.All i want to know,is it possible to disassemble and reconstruct the H.D.D parts to get lost data recovered?(Imagine i have removed data using the wiping out method.)Thanks.
    – user41890
    Mar 21, 2014 at 13:38
  • 1
    @scuzzy-delta are you sure?this case is so important to me.
    – user41890
    Mar 22, 2014 at 12:37
3

If you think of a secure wipe in terms of first formatting the drive, then opening the case, running a rare-earth magnet over the platters, working on them with a heavy hammer and a wrench for a couple of minutes, and finally dropping them into a camp fire, then no, police will not be able to recover the data.

If you think of a secure wipe in terms of running some "secure erase h4xOr tool", then sorry, you're out of luck. At least, if whatever you may have on that disk is worth the effort.

It is very well possible (and not hard, just expensive) to reconstruct data from magnetic store even after it has been overwritten a dozen times. That's something that has been done more or less routinely with black boxes since the 1970s. Admittedly, data density has increased a few orders of magnitude since then, and it is very likely that a 100% restoration will not be possible, but you must expect that a sufficient amount can be restored.
It does not matter so much whether it's possible, but whether you (or the data on your disk) are important enough to justify the expense.

Further, modern drives increasingly perform wear levelling (SSDs in particular do that for every single write). Which means that you have little or no control about what data you actually overwrite when doing a secure erase. You might be doing a "secure erase" and the complete data is still on the disk.
SSDs usually encrypt all data to increase the efficiency of wear-levelling (to randomize data, not for security!), but you cannot rely that there is no way for law enforcement to recover the encryption key. All modern drives have a key-erasing unblocking key sequence, there probably exists a secret, non-key-erasing unblocking key sequence for law enforcement use as well.
This is the case for cylinder locks and strongboxes / security containers, it would be unreasonable to assume no such thing exists for disk drives.

That said, even if your hacker used full-disk encryption using the right software (which offers perfect deniability), and the police can't do much to recover the data or even prove that anything is there, that isn't a certain thing.
Again, it only depends how important the data on your drive is, and who is after you.
While it may feel really cool "cuz stupid cops can't prove nuttin", it doesn't feel nearly as cool when you have a sack over your head and are being beaten with a rubber hose or being waterboarded. If someone really wants to know your encryption key, you will tell them. Trust me, you will.

26
  • 2
    I read with interest your note claiming that data recovery after 10x overwrite is possible. Do you have a citation? NIST Guidelines for Media Sanitization notes that (pg 6) "...for ATA disk drives manufactured after 2001 (over 15 GB) clearing by overwriting the media once is adequate to protect the media from both keyboard and laboratory attack." Mar 12, 2014 at 22:09
  • DoD standard for "data not classified as secret" already included overwriting at least three times (of which one pattern should be the complement of another) as early 1991, and what NIST publishes isn't always the ultima ratio or even conclusive/transparent (think e.g. final round of the SHA-3 process). Disks admittedly have much higher density nowadays, which makes lab reconstruction more difficult, but lab technology has advanced, too. Recovering information after 10 overwrites is probably very optimistic, but I wouldn't bet my life that it cannot be done, if the information is important.
    – Damon
    Mar 12, 2014 at 23:20
  • You always need to decide how important you and your data are. It's no mistake to operate in full paranoia mode (that is, pretend your disk containes the plans to murder your president). Even if the disk only contains your personal data that is a good approach, since you only know that you weren't careful enough after it's too late. In particular if you don't control what's going on on that drive. A common thief probably won't spend a 5-digit sum to see your holiday photos, but the police might, if you're a criminal suspected of serious enough crimes (OP only said "hacker", could be anything).
    – Damon
    Mar 12, 2014 at 23:28
  • 5
    The number of overwrite passes needed has been going down over time, not up. In 1991, a single bit might be spread over several tens of magnetic domains and a re-write would not reliably erase all of them. Drives made in the past 10-15 years have stored one bit per domain, so a single overwrite pass will wipe everything.
    – Mark
    Mar 13, 2014 at 4:15
  • 1
    Magnets, smashing and low temperature fires should not be assumed effective if overwrite security is insufficient. Hard drive heads are extremely powerful and focused and it is unlikely that even a rare earth magnet will perform better. Smashing results in pieces that are still quite large: Grinding into fine powder would be more effective. Campfires do not get up to high enough temperatures to demagnetise most materials. Consider using a bunsen burner, or if one is not obtainable, an ordinary gas stove instead. If maximal data security is desired the resulting powder should be stored securely
    – timuzhti
    Jan 17, 2017 at 9:57
3

As suggested, If a file is deleted using simple "delete" mechanics, then the data is not actually removed from the drive. Only the directory entry is removed; the data remains and is easily recoverable.

If instead the existing data blocks are overwritten, then forensic recovery is effectively impossible. Some statistical reconstruction is sometimes possible on a small scale with vast amounts of effort, but this is a largely academic pursuit. Actually recovering multiple megabytes of data from modern drives is well beyond the capabilities of any existing lab.

That said, some filesystems (eg: ZFS, BTRFS, sometimes NTFS) as well as some media (eg: SSDs) won't overwrite existing blocks directly, but will instead write updates into new, empty space on the drive, leaving the originals untouched. This further complicates "secure delete" procedures.

Wiping the entire drive in one go at a low level (rather than through the filesystem) circumvents most of these caveats and again makes recovery extremely difficult.

If you take a hard drive that has completely overwritten with zeros from even a single pass to any forensic recovery lab, you'll get a 0.00% recovery rate. In fact, most places won't even accept the challenge if you tell them what has happened.

5
  • @Kiwy If everything hangs on a single 1 or 0, then perhaps.. sometimes.. maybe. But the technique does not lend it self to large-scale data recovery, and often doesn't even work at all on newer media, which strain the areal density so far as to rely heavily on error-correction just to read a working disk.
    – tylerl
    Mar 13, 2014 at 9:07
  • Even very partial data can be useful, but it's true that the very dense hard drive we get now are aharder too read
    – Kiwy
    Mar 13, 2014 at 9:15
  • You mean if you shred even with single pass of replace with zero command your data is practically irrecoverable? Talking wrt askubuntu.com/questions/17640/…
    – Chinmaya B
    Aug 15, 2015 at 19:44
  • @Creator Recovery success is entirely dependent on the properties of the storage medium. But as a rule, yes.
    – tylerl
    Aug 16, 2015 at 19:05
  • What do you mean by properties of storage media?
    – Chinmaya B
    Aug 16, 2015 at 19:26
1

The magnetic data written to the hard drive can be over-written, but the original data will still be there, at a lower signal level. So with clever software, and also possibly use of special heads, you can read the different levels of magnetisation. Its also only 0 or 1 that is recorded on each bit, which makes recovering the information slightly easier physically.

So, the only way you can really hide the info is to melt the platters.

N.B. if you have a hybrid drive don't forget the flash memory chips.

2
  • 1
    I am not sure this data can be recovered without significant degradation even with pretty good hw support. But the theoretical possibility exists.
    – peterh
    Feb 25, 2017 at 11:21
  • wow... This is why I love info security topics. It's a never ending struggle between shield and spear. Anyways this means any software implementation of "Secure Wipe" can't be ultimately secure against someone who's so determined to recover HDD with specially calibrated hardware & software (like the Police). Mar 4, 2022 at 0:46
-3

Nah, once data is overwritten with secure sanitising software that randomly rerecords 0's and 1's in place of original data its like putting a jigsaw back together without a picture to reference. Once its rewritten 35 times, a.k.a. the Gutmann method, it's gone, unless it's an SSD and then you need to plow insane amounts of data onto the SSD over and over again to essentially defrag the drive with new data.

SSD's have a limited lifespan and won't respond well, according to reports, to repeated heavy rerecording. SSD's are usually written once and referred to lots of times. The RAM does all the temporary storing of data so it limits the finite SSD rerecord ability limitation.

Forensics can't recover what is already gone. If a simple delete of old data is done (i.e. delete recycle bin or permanently delete data), the links would be gone but not the data which is still recoverable.

There is lots of free software to download and try to recover the lost data (links) but it won't bring back sanitised data.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .