Questions tagged [data-recovery]

For questions generally relating to recovery of "plain" data from digital storage, when that storage has been damaged or the credentials securing it are lost.

Filter by
Sorted by
Tagged with
-2 votes
2 answers
303 views

Can Cellebrite be used to access any phone by the government? What is the point of encryption if they can get into any phone? [closed]

I'm currently studying forensics, and one thing that keeps coming up is the authorities breaking into phones. There are several third party tools they can use, but one of the most popular is '...
Elizabeth Vogue's user avatar
0 votes
0 answers
119 views

What does an exported BitLocker key package contain?

I've learned that a key protector encrypts the VMK (volume master key), then the VMK encrypts the FVEK (full volume encryption key), and finally the FVEK encrypts the actual data blocks. I've also ...
Chris Chen's user avatar
0 votes
1 answer
107 views

Recover deleted (Shift+Delete) One Drive Folder on a bitlocker enabled drive. Should I unencrypt drive before I atempt recovery?

Windows 11, bitlocked C:\ Drive (I have the bitlocker key and can unencrypt drive). Onedrive installed, synced to my Docs folder but not signed in to OneDrive account (never signed in). Uninstalled ...
user85643's user avatar
1 vote
1 answer
269 views

Will it ever be possible to functionally get the encrypted data off of an iphone in recovery mode?

Apparently the data encrypts until the passcode is entered, but my phone (close to 3,500 recordings of my original music) won't boot up. I dropped it and it went into a boot loop then went into ...
SoftserveSodium's user avatar
13 votes
4 answers
5k views

How can data from VirtualBox leak to the host and how to avoid it?

I used a virtual machine (Windows host/Linux mint guest) to store some very sensitive and private data (it shouldn't be uncovered by state-level actors). Today I decided to check how much deleted ...
Sonozaki's user avatar
  • 157
2 votes
0 answers
46 views

AWS sub-accounts to protect against deletion of versioned data in S3

How can administration teams (or software processes) be granted the ability to alter or remove objects from in AWS S3, while prohibiting the permanent deletion of underlying data versions, so as to ...
benjimin's user avatar
  • 155
3 votes
1 answer
124 views

Storage options would give the organization the best chance of recovering data

I am studying information security, I have a question that I need help with. Which of the following storage options would give the organization the best chance of recovering data? A. Encrypted ...
Trung Nguyen's user avatar
0 votes
1 answer
970 views

Can a deleted file on an SSD with trim enabled be recovered? [duplicate]

I'm just wondering from a security stand point if a deleted file on an SSD with trim enabled can be recovered? I've did some research and it would seem it is impossible unless for some reason trim ...
Curt Rand's user avatar
  • 239
1 vote
2 answers
262 views

Data remanence - DDR2

I read "Data Remanence in Semiconductor Devices" by Peter Gutmann, in which it is stated that it is possible to reconstruct the content of an erased SRAM based on changes of properties of ...
Hasbo's user avatar
  • 9
1 vote
1 answer
158 views

Reasons for recovering small amounts of deleted data from SSDs

In their 2018 paper "Solid state drive forensics: Where do we stand?", Vieyra et al. discuss recovering deleted data from SSDs. For their experiments, they wrote large amounts of text to ...
Matthias Braun's user avatar
1 vote
1 answer
356 views

2min for SECURITY ERASE UNIT

Running hdparm -I /dev/sda on a SanDisk SSD PLUS 1000GB produces this: not supported: enhanced erase 2min for SECURITY ERASE UNIT What does that mean? I assume that I could do hdparm --security-erase ...
Matthias Braun's user avatar
2 votes
1 answer
63 views

How do I recover files on a secure sigital internal physical volume - MS-DOS (FAT32) disk?

I have a very old 256 MB SD card (purchased around 2004). The SD card is still working, but some old photos are missing due to a possible unintentional format action on my digital camera. Is there any ...
AGamePlayer's user avatar
1 vote
0 answers
446 views

Suspicious SSD corruption exactly at LUKS encryption header

I am helping with an interesting data recovery issue. The laptop was running Debian 11 Linux with LUKS full disk encryption on a Samsung 970 Evo Plus 2TB SSD for quite many months. Suddenly the LUKS ...
stackrunner's user avatar
0 votes
1 answer
554 views

How to prevent the recovery of deleted files without a full format of external HDD?

How can I securely delete selected files so they can’t be recovered, but without the full format of the external HDD? Is this even possible? I’m using Mac OS.
account name's user avatar
1 vote
0 answers
35 views

Full disk encryption and data recovery capabilities [duplicate]

So I had linux mint with fde, had sensitive files on it, shut down my pc, and reinstalled a new linux mint OS with fde. What are the chances of data recovery from the first OS?
Gateejunle's user avatar
0 votes
3 answers
486 views

How file deletion works?

If deleting files just removes the references then why not just delete the actual files instead of just removing the references? Just removing the references leaves the file intact until it is ...
moongazer 07's user avatar
0 votes
1 answer
126 views

Can you teach scalpel to recognize a file

I have a few drives that have been reformatted that I need to retrieve data from. A friend told me that an app like scalpel might be a good option for doing this. After some research it looks like a ...
Andrew Pullins's user avatar
0 votes
1 answer
1k views

Does full disk encryption securely remove data?

I was just catching up on best practices for securely erasing data from a Mac. At one point I remember reading: For SSD drives it is no longer recommended to fully write ones/zeroes/random bits on the ...
Dennis Jaheruddin's user avatar
1 vote
0 answers
148 views

When the phone breaks and I regret encryption

I believe most new Android phones have full encryption enabled by default, so even if I just download some PDF weather report from the internet, it will sit encrypted on my phone's SSD. Now, suppose ...
bobuhito's user avatar
  • 240
1 vote
1 answer
230 views

Can SD cards on mobile phones and tablets truly be erased?

When performing a factory reset on Android devices, it is my understanding that the pointers to the data located in the SD card are simply erased while the data itself remains intact, waiting for ...
Anon1337's user avatar
0 votes
0 answers
222 views

Encrypting file = Overwriting file?

When thinking of encrypting a file (also how I implemented it in a program of mine), I think of getting the data of a file, encrypting it, and writing it back into the file (overwriting the file). But ...
Dahlin's user avatar
  • 1
2 votes
1 answer
153 views

What should I do if my sensitive information is potentially leaked?

I sold an laptop recently, but didn’t care to do a secure erase to make sure there wasn’t any data left. After a long time, I suddenly realized that I shouldn’t have be so careless and began to worry ...
Rukord's user avatar
  • 23
2 votes
0 answers
149 views

Is "drag-drop files" computer backup sufficient to avoid most malware/ have all my files?

I'm debating dragging all my files onto an external hard drive manually - rather than a time machine backup - and then pulling over any specific files I need if I ever need them. Afterwards, I'll ...
Jonas's user avatar
  • 21
0 votes
1 answer
155 views

If I move a file within the same drive or partition and then shred that file with a file shredder, would it still be recoverable?

If I move a file within the same drive or partition, suppose from one folder to another, and then shred that file with a file shredder, would it still be recoverable? Is there still some trace of that ...
Musa's user avatar
  • 1
0 votes
1 answer
187 views

Does data recovery of file depends on its extension?

Most free to use data recovery tools (Recuva, Easus, MiniTools) offers good recovery with known file extensions for picutres, videos and documents (.png, .xlsx etc). But lesser known file extensions, ...
msinfo's user avatar
  • 103
3 votes
3 answers
3k views

How to get PGP key passphrase out of Thunderbird?

I set up Thunderbird to use PGP a while ago, so I can sign and decrypt messages now. But I have forgotten my private passphrase for my private key, but since Thunderbird can do it anyway, it has it ...
zvavybir's user avatar
0 votes
0 answers
170 views

Securely deleting Volume Shadow Service (VSS) in Windows 10

Suppose that VSS is enabled and snapshots exist. If I run a program to wipe the free disk space on my drive, would this delete the VSS snapshots? It might do since the program works by filling up the ...
useraccount001's user avatar
-1 votes
1 answer
275 views

If SSDs cannot be securely wiped then why can't we recover files after crypto virus attack?

It is my understanding that SSDs do not allow user to overwrite any specific file completely (wear-leveling). So in case of ransomware attack such as CryptoLocker, doesn't that mean there is still, ...
Mr. Engineer's user avatar
1 vote
1 answer
452 views

Print sensitive info without leaving data on the printer

I'm not sure if there is already a question here about this because I can't find anything. But I'm wondering if there are any "safer" ways to print sensitive information without leaving ...
reed's user avatar
  • 15.8k
-1 votes
1 answer
258 views

Can data be stored anywhere else on a MacBook besides the SSD?

Imagine the following scenario: There exist all kinds of information on my SSD. Now I take away the SSD of my MacBook Pro, replace it, and reboot. I should have a MacBook that is on factory settings, ...
iamaghost's user avatar
1 vote
1 answer
195 views

How do I destroy references to wiped files?

I partially wiped my hard drive using the null-fill method through command prompt by copying a 1 Gigabyte file filled with NULL over and over until I ran out of space. After that I tried recovering ...
user252028's user avatar
1 vote
0 answers
136 views

How Can I Backup App Data In Android/iOS Devices?

After my other post I'm looking over some other possibilities to do what I'm trying to do. How To Recover End-To-End Encrypted Data After Losing Private Key? If I save user data in server, in order to ...
Eagleclaw's user avatar
  • 257
4 votes
1 answer
2k views

Data recovery from TRIMmed SSDs

Assuming a given SSD supports TRIM, and is on a physical bus that supports sending that command, and the connected computer is running an OS that is aware of TRIM: If the drive is formatted, or has ...
craig65535's user avatar
0 votes
1 answer
129 views

DBAN under PC for an HDD using MAC OSx

A HDD with OSx installed removed from mac and used DBAN to wipe it under a PC. Does all the data is lost even if we put it back on a mac machine ?
August's user avatar
  • 11
1 vote
1 answer
331 views

Recover data after multiple wipe

I have a company laptop where I had many of my personal files and pictures. Now, I'm leaving for a new opportunity and I need to give them back the machine. So I used DBAN to wipe the hard drive. I'm ...
August's user avatar
  • 11
6 votes
1 answer
767 views

What's the DRAT word of my SSD?

This article on forensicfocus.com says the following about Deterministic Read After TRIM (emphasis mine): As a result, the data returned by SSD drives supporting DRAT as opposed to DZAT can be all ...
Matthias Braun's user avatar
5 votes
1 answer
2k views

Does formatting an SSD securely delete all data?

This article on thomas-krenn.com states: Because an ATA trim will be performed by NTFS with Windows 7 or when formatting using Ext4 from mke2fs 1.41.10 or XFS from xfsprogs 3.1.0, the secure erase ...
Matthias Braun's user avatar
0 votes
3 answers
1k views

How many overwrites make a drive undesirable?

I wanted to wipe free disk space of my PC, as I had accidentally deleted confidential data permanently without securely deleting them. So wiping the entire free disk seems to be the only option now. I ...
Jay Shah's user avatar
  • 339
33 votes
7 answers
9k views

Is there any hope of getting my pictures back after an iPhone factory reset some day in the future?

Four months ago I lost all my data after an iTunes update automatically restored my phone to factory defaults. I lost all the pictures of my newborn. I understand that when you do a factory reset the ...
Vivi's user avatar
  • 341
1 vote
1 answer
202 views

Can I recover files that I had on windows from a SSD that I converted to apfs (mac) and which method or tool to use?

I had some files that I want to recover from windows, but I formatted the ssd drive to macos (apfs)? Is there a tool or method to recover those files?
George's user avatar
  • 11
1 vote
2 answers
2k views

Is a BIOS password enough to prevent someone from hacking into my laptop if they have physical access?

Would my laptop be secure against physical access if I set up a bios password and full disk encryption ? If not then is there any way to secure your laptop from someone with physical access? How hard ...
Linux_user0987's user avatar
0 votes
2 answers
948 views

How to secure file delete/wipe on mobile phones?

With old HDD to secure delete a file you need to use Gutmann standard, but with new HDD you can use only 1 pass overwrite I'm not sure what hard drives mobile phones use and don't know how many passes ...
u u 's user avatar
  • 1
2 votes
1 answer
1k views

I snapped my micro SD card into 8 pieces before throwing it away. Should I be worried that someone can get my data?

The card was a 16gb SanDisk micro SD card (monolithic).
user avatar
0 votes
0 answers
135 views

Destroying data on storage drives via overwrite methods really doesn't work?

I'm going to sell a computer hard drive on the Internet, it's a 500GB SATA hard drive, I really used it 3 or 2 years ago, I never used it again, I used about 20 or 40% of the space. I have read about ...
Julián's user avatar
  • 249
1 vote
1 answer
2k views

Can deleted snapchat messages be recovered? [closed]

If there are chats that have been deleted, is there a way to recover these with any recovery tools, or are they gone forever?
MP115's user avatar
  • 31
39 votes
7 answers
10k views

At what point is deleted data irrecoverable?

From reading around on the internet I get the impression that barring physical damage, deleted data can be always be recovered using sophisticated digital forensics. For this reason the advice is ...
Yoshi's user avatar
  • 407
1 vote
0 answers
282 views

Secure deletion on Android

My understanding is if I delete photo001.jpg, this deletes the index and assigns it to the free space to be overwritten. So this brings me onto my next scenarios. If I have a device capable of 8gb ...
Shaun Wilson's user avatar
1 vote
1 answer
156 views

How to verify secure erasure of Android and Apple mobile devices

I'm aware of how to securely sanitise and verify the sanitisation of data from both HDDs and SSDs, but mobile phones complicate this due to being there a lot of proprietary layers standing between the ...
Hashim Aziz's user avatar
1 vote
1 answer
360 views

Is it possible to recover data from a Western Digital TRIM supporting disks (not SSD) after quick format?

I have a western digital blue disk, which is one of the SMR variations. I've heard that they support TRIM command. The disk is accidentally quick formatted on Windows 10, and now seems to be all zero. ...
Sheric's user avatar
  • 61
1 vote
0 answers
209 views

How to retrieve deleted data from Iphone? [closed]

My data got deleted from iPhone. I tried to recover all images and videos using some third party softwares like dr.fone, stellar, etc but all these apps allow only preview of the data but can't ...
manivarma indukuri's user avatar