Is it possible to recover securely (or wiped out) deleted data from a hard drive using forensics?

Imagine police have arrested a hacker, and that hacker, before getting caught, has removed all information that leads him/her to be found guilty on his/her PC using a secure deleting method. In this case, is it possible for police forensics (or any department) to recover the deleted data?

  • 5
    Agreeing with people below: you need to specify "secure wipe" or change the wording: secure by definition means it is not recoverable. – user3244085 Mar 12 '14 at 21:25
  • DoD says that it is always possible to recover it. Using normal equipment they have specified the multiple-over-write protocols to guard against "bit-walking" where the magnetic domains shift in position slightly. However, with an electron Microscope it is always possible to look down through the layers and see what is underneath. (Hint: expensive) Hence their guidance for total destruction of the drive, whether by thermite or sledgehammer. Our guys who were forced down in China used thermite. – SDsolar May 23 '17 at 21:25

Your question has a problem with the definitions of the words in it.

If a HDD has been securely wiped, by definition, no recovery is possible. If a HDD has not been securely wiped, by definition, recovery is possible.

Perhaps you mean: How secure are various methods of wiping Hard Drives? Very secure, assuming you're talking about "traditional" drives (with magnetic spinning platters) and you use something reputable like Darik's Boot And Nuke (aka DBAN).

There is some concern about how to securely erase Solid State Drives, because the drives have a built in ability to evenly (and transparently) distribute read and write operations across its entire memory space. This is done to increase lifespan of the drive, but can frustrate secure erase operations.

  • 4
    Most modern SSDs use hardware AES encryption by default, so they just have to throw away the encryption key... – Jingo Mar 12 '14 at 21:31
  • 2
    An excellent point, although it should be noted that it is not always simple to implement correctly. – scuzzy-delta Mar 12 '14 at 22:13
  • 2
    Not sure this goes for "most" SSDs, and you still need to enable the encryption. – user3244085 Mar 13 '14 at 5:57
  • 1
    Thanks for the answer.I know if a H.D.D is securely wiped out,there would be no way to recover lost data,but i have heard that it is possible to disassemble H.D.D parts then reconstructing them in order to recover lost securely wiped out data.All i want to know,is it possible to disassemble and reconstruct the H.D.D parts to get lost data recovered?(Imagine i have removed data using the wiping out method.)Thanks. – user41890 Mar 21 '14 at 13:38
  • 1
    @scuzzy-delta are you sure?this case is so important to me. – user41890 Mar 22 '14 at 12:37

If you think of a secure wipe in terms of first formatting the drive, then opening the case, running a rare-earth magnet over the platters, working on them with a heavy hammer and a wrench for a couple of minutes, and finally dropping them into a camp fire, then no, police will not be able to recover the data.

If you think of a secure wipe in terms of running some "secure erase h4xOr tool", then sorry, you're out of luck. At least, if whatever you may have on that disk is worth the effort.

It is very well possible (and not hard, just expensive) to reconstruct data from magnetic store even after it has been overwritten a dozen times. That's something that has been done more or less routinely with black boxes since the 1970s. Admittedly, data density has increased a few orders of magnitude since then, and it is very likely that a 100% restoration will not be possible, but you must expect that a sufficient amount can be restored.
It does not matter so much whether it's possible, but whether you (or the data on your disk) are important enough to justify the expense.

Further, modern drives increasingly perform wear levelling (SSDs in particular do that for every single write). Which means that you have little or no control about what data you actually overwrite when doing a secure erase. You might be doing a "secure erase" and the complete data is still on the disk.
SSDs usually encrypt all data to increase the efficiency of wear-levelling (to randomize data, not for security!), but you cannot rely that there is no way for law enforcement to recover the encryption key. All modern drives have a key-erasing unblocking key sequence, there probably exists a secret, non-key-erasing unblocking key sequence for law enforcement use as well.
This is the case for cylinder locks and strongboxes / security containers, it would be unreasonable to assume no such thing exists for disk drives.

That said, even if your hacker used full-disk encryption using the right software (which offers perfect deniability), and the police can't do much to recover the data or even prove that anything is there, that isn't a certain thing.
Again, it only depends how important the data on your drive is, and who is after you.
While it may feel really cool "cuz stupid cops can't prove nuttin", it doesn't feel nearly as cool when you have a sack over your head and are being beaten with a rubber hose or being waterboarded. If someone really wants to know your encryption key, you will tell them. Trust me, you will.

  • 1
    I read with interest your note claiming that data recovery after 10x overwrite is possible. Do you have a citation? NIST Guidelines for Media Sanitization notes that (pg 6) "...for ATA disk drives manufactured after 2001 (over 15 GB) clearing by overwriting the media once is adequate to protect the media from both keyboard and laboratory attack." – scuzzy-delta Mar 12 '14 at 22:09
  • DoD standard for "data not classified as secret" already included overwriting at least three times (of which one pattern should be the complement of another) as early 1991, and what NIST publishes isn't always the ultima ratio or even conclusive/transparent (think e.g. final round of the SHA-3 process). Disks admittedly have much higher density nowadays, which makes lab reconstruction more difficult, but lab technology has advanced, too. Recovering information after 10 overwrites is probably very optimistic, but I wouldn't bet my life that it cannot be done, if the information is important. – Damon Mar 12 '14 at 23:20
  • You always need to decide how important you and your data are. It's no mistake to operate in full paranoia mode (that is, pretend your disk containes the plans to murder your president). Even if the disk only contains your personal data that is a good approach, since you only know that you weren't careful enough after it's too late. In particular if you don't control what's going on on that drive. A common thief probably won't spend a 5-digit sum to see your holiday photos, but the police might, if you're a criminal suspected of serious enough crimes (OP only said "hacker", could be anything). – Damon Mar 12 '14 at 23:28
  • Even for a completely innocent person (like I assume you are), full paranoia mode is adequate -- data can far too easliy be abused. – Damon Mar 12 '14 at 23:31
  • 4
    The number of overwrite passes needed has been going down over time, not up. In 1991, a single bit might be spread over several tens of magnetic domains and a re-write would not reliably erase all of them. Drives made in the past 10-15 years have stored one bit per domain, so a single overwrite pass will wipe everything. – Mark Mar 13 '14 at 4:15

As suggested, If a file is deleted using simple "delete" mechanics, then the data is not actually removed from the drive. Only the directory entry is removed; the data remains and is easily recoverable.

If instead the existing data blocks are overwritten, then forensic recovery is effectively impossible. Some statistical reconstruction is sometimes possible on a small scale with vast amounts of effort, but this is a largely academic pursuit. Actually recovering multiple megabytes of data from modern drives is well beyond the capabilities of any existing lab.

That said, some filesystems (eg: ZFS, BTRFS, sometimes NTFS) as well as some media (eg: SSDs) won't overwrite existing blocks directly, but will instead write updates into new, empty space on the drive, leaving the originals untouched. This further complicates "secure delete" procedures.

Wiping the entire drive in one go at a low level (rather than through the filesystem) circumvents most of these caveats and again makes recovery extremely difficult.

If you take a hard drive that has completely overwritten with zeros from even a single pass to any forensic recovery lab, you'll get a 0.00% recovery rate. In fact, most places won't even accept the challenge if you tell them what has happened.

  • @Kiwy If everything hangs on a single 1 or 0, then perhaps.. sometimes.. maybe. But the technique does not lend it self to large-scale data recovery, and often doesn't even work at all on newer media, which strain the areal density so far as to rely heavily on error-correction just to read a working disk. – tylerl Mar 13 '14 at 9:07
  • Even very partial data can be useful, but it's true that the very dense hard drive we get now are aharder too read – Kiwy Mar 13 '14 at 9:15
  • You mean if you shred even with single pass of replace with zero command your data is practically irrecoverable? Talking wrt askubuntu.com/questions/17640/… – Chinmaya B Aug 15 '15 at 19:44
  • @Creator Recovery success is entirely dependent on the properties of the storage medium. But as a rule, yes. – tylerl Aug 16 '15 at 19:05
  • What do you mean by properties of storage media? – Chinmaya B Aug 16 '15 at 19:26

The magnetic data written to the hard drive can be over-written, but the original data will still be there, at a lower signal level. So with clever software, and also possibly use of special heads, you can read the different levels of magnetisation. Its also only 0 or 1 that is recorded on each bit, which makes recovering the information slightly easier physically.

So, the only way you can really hide the info is to melt the platters.

N.B. if you have a hybrid drive don't forget the flash memory chips.

  • 1
    I am not sure this data can be recovered without significant degradation even with pretty good hw support. But the theoretical possibility exists. – peterh Feb 25 '17 at 11:21

With regards to the security of wiping, refer to tylerl answer.

I just wanted to point out one thing: if you use full disk encryption wiping is much easier, because then you only need to wipe the part that contains the key, and in contrast to plaintext data, in which even a partial recovery would be a problem, with crypto it's all or nothing: if your key is safely erased, there is simply no way to recover the data.

  • If the key is erased isn't it possible to decrypt data (if the encryption method is lame), or at least try to brute-force with expensive machines which gives 50% chances for recovery. – Chinmaya B Aug 15 '15 at 19:51
  • If the encryption is half decent (e.g.: Truecrypt, dmcrypt,...) it's beyond bruteforce... – miniBill Aug 16 '15 at 18:53

No, it is not possible to recover data after using wiping software. Various erasing software like Bitraser, Diskwipe, Data shredder is also claiming same, which even I tested from my end. I can't able to recovered lost data from any data recovery software.

  • 1
    This is a response to a very old question and i'm not sure it adds much in its current state. Can you add any evidence or elaborate further on your statement? – iainpb Jan 17 '17 at 9:44

Nah, once data is overwritten with secure sanitising software that randomly rerecords 0's and 1's in place of original data its like putting a jigsaw back together without a picture to reference. Once its rewritten 35 times, a.k.a. the Gutmann method, it's gone, unless it's an SSD and then you need to plow insane amounts of data onto the SSD over and over again to essentially defrag the drive with new data.

SSD's have a limited lifespan and won't respond well, according to reports, to repeated heavy rerecording. SSD's are usually written once and referred to lots of times. The RAM does all the temporary storing of data so it limits the finite SSD rerecord ability limitation.

Forensics can't recover what is already gone. If a simple delete of old data is done (i.e. delete recycle bin or permanently delete data), the links would be gone but not the data which is still recoverable.

There is lots of free software to download and try to recover the lost data (links) but it won't bring back sanitised data.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.