Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Is it possible to recover securely (or wiped out) deleted data from a hard drive using forensics?
Imagine police have arrested a hacker, and that hacker, before getting caught, has removed all information that leads him/her to be found guilty on his/her PC using a secure deleting method. In this case, is it possible for police forensics (or any department) to recover the deleted data?
Your question has a problem with the definitions of the words in it.
If a HDD has been securely wiped, by definition, no recovery is possible. If a HDD has not been securely wiped, by definition, recovery is possible.
Perhaps you mean: How secure are various methods of wiping Hard Drives? Very secure, assuming you're talking about "traditional" drives (with magnetic spinning platters) and you use something reputable like Darik's Boot And Nuke (aka DBAN).
There is some concern about how to securely erase Solid State Drives, because the drives have a built in ability to evenly (and transparently) distribute read and write operations across its entire memory space. This is done to increase lifespan of the drive, but can frustrate secure erase operations.
If you think of a secure wipe in terms of first formatting the drive, then opening the case, running a rare-earth magnet over the platters, working on them with a heavy hammer and a wrench for a couple of minutes, and finally dropping them into a camp fire, then no, police will not be able to recover the data.
If you think of a secure wipe in terms of running some "secure erase h4xOr tool", then sorry, you're out of luck. At least, if whatever you may have on that disk is worth the effort.
It is very well possible (and not hard, just expensive) to reconstruct data from magnetic store even after it has been overwritten a dozen times. That's something that has been done more or less routinely with black boxes since the 1970s. Admittedly, data density has increased a few orders of magnitude since then, and it is very likely that a 100% restoration will not be possible, but you must expect that a sufficient amount can be restored.
It does not matter so much whether it's possible, but whether you (or the data on your disk) are important enough to justify the expense.
Further, modern drives increasingly perform wear levelling (SSDs in particular do that for every single write). Which means that you have little or no control about what data you actually overwrite when doing a secure erase. You might be doing a "secure erase" and the complete data is still on the disk.
SSDs usually encrypt all data to increase the efficiency of wear-levelling (to randomize data, not for security!), but you cannot rely that there is no way for law enforcement to recover the encryption key. All modern drives have a key-erasing unblocking key sequence, there probably exists a secret, non-key-erasing unblocking key sequence for law enforcement use as well.
This is the case for cylinder locks and strongboxes / security containers, it would be unreasonable to assume no such thing exists for disk drives.
That said, even if your hacker used full-disk encryption using the right software (which offers perfect deniability), and the police can't do much to recover the data or even prove that anything is there, that isn't a certain thing.
Again, it only depends how important the data on your drive is, and who is after you.
While it may feel really cool "cuz stupid cops can't prove nuttin", it doesn't feel nearly as cool when you have a sack over your head and are being beaten with a rubber hose or being waterboarded. If someone really wants to know your encryption key, you will tell them. Trust me, you will.
As suggested, If a file is deleted using simple "delete" mechanics, then the data is not actually removed from the drive. Only the directory entry is removed; the data remains and is easily recoverable.
If instead the existing data blocks are overwritten, then forensic recovery is effectively impossible. Some statistical reconstruction is sometimes possible on a small scale with vast amounts of effort, but this is a largely academic pursuit. Actually recovering multiple megabytes of data from modern drives is well beyond the capabilities of any existing lab.
That said, some filesystems (eg: ZFS, BTRFS, sometimes NTFS) as well as some media (eg: SSDs) won't overwrite existing blocks directly, but will instead write updates into new, empty space on the drive, leaving the originals untouched. This further complicates "secure delete" procedures.
Wiping the entire drive in one go at a low level (rather than through the filesystem) circumvents most of these caveats and again makes recovery extremely difficult.
If you take a hard drive that has completely overwritten with zeros from even a single pass to any forensic recovery lab, you'll get a 0.00% recovery rate. In fact, most places won't even accept the challenge if you tell them what has happened.
The magnetic data written to the hard drive can be over-written, but the original data will still be there, at a lower signal level. So with clever software, and also possibly use of special heads, you can read the different levels of magnetisation. Its also only 0 or 1 that is recorded on each bit, which makes recovering the information slightly easier physically.
So, the only way you can really hide the info is to melt the platters.
N.B. if you have a hybrid drive don't forget the flash memory chips.
Nah, once data is overwritten with secure sanitising software that randomly rerecords 0's and 1's in place of original data its like putting a jigsaw back together without a picture to reference. Once its rewritten 35 times, a.k.a. the Gutmann method, it's gone, unless it's an SSD and then you need to plow insane amounts of data onto the SSD over and over again to essentially defrag the drive with new data.
SSD's have a limited lifespan and won't respond well, according to reports, to repeated heavy rerecording. SSD's are usually written once and referred to lots of times. The RAM does all the temporary storing of data so it limits the finite SSD rerecord ability limitation.
Forensics can't recover what is already gone. If a simple delete of old data is done (i.e. delete recycle bin or permanently delete data), the links would be gone but not the data which is still recoverable.
There is lots of free software to download and try to recover the lost data (links) but it won't bring back sanitised data.
