Questions tagged [data-recovery]
For questions generally relating to recovery of "plain" data from digital storage, when that storage has been damaged or the credentials securing it are lost.
142
questions
0
votes
0answers
54 views
Secure Erase for IOS
The topics about secure erase for IOS on this site is a bit dated. Technology has definitely changed, including the tools used for forensics. Are there any secure erase softwares or techniques that ...
0
votes
1answer
51 views
Can someone bypass/recover/access data to Hard-Drive when Password Protected?
I've decided to designate a separate topic to this question ( even though I've mentioned this in topic: Best practice to secure hard-drive of computer(laptop) in case of Stealing ^ Loss ^ Unauthorized ...
0
votes
0answers
42 views
DBAN alternative [duplicate]
I'm selling my computer (HDD). I had some important data on it. Please don't tell me to physically destroy that drive, I need the money. So I'm looking for some reliable solution that could erase ...
1
vote
0answers
67 views
How long would traces of a disk wipe be visible? [closed]
If a user on normal everyday-use computer wiped the unallocated space on a hard disk drive, how long would it take before analysis of the unallocated space would yield no evidence of a disk wipe? Lets ...
5
votes
1answer
151 views
Recovery of EEPROM data after bulk erase operation
Is there any research into the recovery of data stored in an EEPROM after the high-voltage bulk erase (not bytewise or pagewise erase) operation? I'm wondering about typical low-capacity EEPROMs which ...
2
votes
3answers
172 views
Is it sufficient to use a hard disk magnet to corrupt/erase floppy data?
I would like to make data, in many (more than 250) old floppies, unreadable/unrecoverable.
I have some HDDs that I can take apart. Their magnet is sufficient to do the job to make it unreadable to ...
0
votes
1answer
140 views
Recover corrupted password protected Zip
Good evening.
I have a password protected zip archive (Zip 2.0 CryptoZip) with a .txt file with sensitive info inside. The problem is that I can't extract it.
7Zip:"Data error : Wrong password?"
...
1
vote
1answer
100 views
How can information be recovered after it has been overwritten (single pass) by a secure deletion program? [duplicate]
We know that information can be retreived after it has been deleted. There are several tools for file "undeletion" (Recuva, FTK, some tools contained in Caine, etc.)
I have heard as well, that data ...
2
votes
2answers
90 views
Carve out all scattered pieces of a file from data
If a file is scattered in pieces on a hard drive how is it possible to find all parts of it?
Forensically in a file carving situation where one do not have access to a running OS.
1
vote
1answer
110 views
Can file recovery tools recover deleted small files from SSD drive's NTFS Master File Table?
According to this page and site, small files are kept in Master File Table when filesystem is NTFS.
Let's assume that computer is using Windows 10 and a SSD drive with TRIM support. If a user ...
0
votes
0answers
97 views
What is the method police use to recover deleted data from phone memory?
I am writing a story that involves a cellphone being recovered at a crime scene. The police go through it and find all the non-deleted files and continue until a they do something to obtain the data ...
0
votes
0answers
43 views
Url Storage, History & Personal Data
Just Curious to Know,
Where my information is being stored and how long its kept for
I'm running the latest version of windows 10,
my main Browser being firefox developer edition 68.
I clear my ...
-1
votes
1answer
233 views
How do I recover a deleted file too large to go to recycle bin? [closed]
I mistakenly deleted a very important 50 gb file from my 1 tb hard drive, and the file was too big to go to recycle bin. How do I recover it?
1
vote
2answers
266 views
How to completely destroyed all data from an iPhone before reselling it?
I would wish to know more about how to erase 100% data of a used iPhone.
Basically, technician from Apple Store only said “Erase & Clear” within the iPhone setting could do all the work perfectly ...
1
vote
1answer
137 views
How to get the password from Windows Application?
I have an application call Metatrader 5. I had logged in way before and now I lost my password. The login could be seen but the password is hidden. I want to know if there is a way to get the hidden ...
1
vote
0answers
73 views
Find files with autopsy [closed]
I had an Ubuntu 14 machine. A couple of days I installed Ubuntu 18 on this machine.
I'm trying to recover some files from the previous installation. I'm using autopsy.
I think I'm doing something ...
0
votes
0answers
71 views
Does renaming and emptying all the content of a file before deletion make it unrecoverable?
When I delete a file, I rename it to new.txt, open the file in a text editor, press Ctrl+A, Backspace, Ctrl+S to delete all the content and save it as an empty file and then Shift+Delete to ...
0
votes
0answers
49 views
Recover deleted Windows volumes
I have been given an HDD image. I believe the image was taken with dd. I have ingested the file using Autopsy and can see there are 4 volumes, like so
Volume 1 - Unallocated. I believe NOT securely ...
0
votes
0answers
55 views
Using OTAC as authentication to account recovery schemes
I develop a mobile application that is authenticated to a service utilizing a Challenge-Response scheme. During the registration a Device Key asymmetric key is generated and signed using a User Key ...
1
vote
1answer
99 views
Understanding the philosophy of recovering data
It can be understood that if i delete some data, those bytes may not be written by other data can be extracted because the data actually resides on those sectors/cells.
But i wounder how the bytes ...
0
votes
3answers
188 views
How to protect company sensitive data from being deleted by a user when data is on their computer?
There more than 300 computers and more than 400 users are available. We face two incidents recently when critical users(who has critical data) leave from company.We have deleted their data when they ...
5
votes
2answers
196 views
How important is it to delete disk partitions when wiping devices?
The command lsblk returns the following output that lists 4 partitions.
sda 8:0 0 931.5G 0 disk
├─sda1 8:1 0 8M 0 part
├─sda2 8:2 0 40G 0 part /
├─sda3 8:3 0 883.8G ...
-1
votes
1answer
430 views
Can a hacker recover deleted files from my mobile drive? [duplicate]
I deleted some files from my phone (android 5). Can a hacker recover my files?
2
votes
4answers
2k views
SSD is formatted twice and filled twice. Can i recover old deleted data? [duplicate]
I need to recover some old data which were stored on a drive. The data were deleted and the hard drive was formatted twice and filled twice with random data intentionally.
First the drive had a ...
2
votes
2answers
314 views
How to securely destroy old cellphone, to avoid personal data recuperation?
While cleaning I've found an old cellphone. This phone does not turn on, and I'm not sure if contains personal data.
I would like to throw away this phone, but I'm concerted if this data can be ...
0
votes
1answer
366 views
Recovering Data from a 1-Pass Zero'd Hard Disk Drive [duplicate]
I don't want to do this, but I'm wondering how easy it is to do? Or to put it another way, I'm wondering "is a 1-pass zero of a drive enough?"
From what I understand, it's completely wiped from ...
0
votes
1answer
60 views
What does the existence of this file indicate? [closed]
C:\Documents and Settings\Sarah\Recent\DSCN0275.JPG.lnk
on a Microsoft Windows system, and use the xxd program to dump the contents of
this file:
1
vote
1answer
164 views
RAID-1 and low level formatting (or file shredding), more chances of data recovery?
If I have two disks setup as RAID-1. I deleted some files and then made a low level format. made sure the files are not recoverable.
However, if I am to separate them and connect them as separate ...
0
votes
1answer
55 views
How to recover disk image from a smartphone in “bootloop” state?
I've been playing around on data recovery from devices and so far it worked well. Now I got this new situation that I don't know how to proceed in order to put my hands on the data. My old smartphone ...
1
vote
1answer
406 views
Secure way to wipe an entire SSD? [duplicate]
I've read some articles and they appear to suggest the idea of using the dd command to wipe an entire SSD before encrypting it. The drive in question is a Samsung 970 EVO PCIe NVMe V-NAND M.2 2280 ...
1
vote
5answers
421 views
Why can't you and how to take a picture from infected computer?
Let's say I know that there is a computer than is heavily infested with viruses (but I do not know which kind of viruses) and needs to be nuked from orbit. And on that computer is a very important ...
5
votes
0answers
2k views
What type of data can be recovered from the swap file / page file and thumbs file
This question follows on from a previously posted question on recovery of data from a wiped disk. I have been informed that no files have been found on the computer on the hard disk or in the deleted ...
0
votes
1answer
126 views
lost key-files for encrypted files [closed]
I had encrypted a file on my computer but the computer got infected by a virus, so I reinstalled Windows on my computer. All my key-files have gone.
Is there a way to recreate the lost key-files, as ...
0
votes
1answer
70 views
Working from a USB [closed]
I have a Mac for my work laptop and I would like to work on my xCode project, I can't work on the laptop directly and save the file to computer due to fears that it could one day be recovered & be ...
1
vote
2answers
579 views
Secure erase hard drive [duplicate]
What device/method do you usually use to securely erase a hard drive?
The situation is, we have hard drives that we want to use somewhere else, and don't want any data to get recovered later,
I can ...
0
votes
1answer
82 views
Does zeroing a file on Android work similar to a regular HDD?
On a regular PC hard drive, files aren't actually deleted, so they can still be recovered from the raw data on the drive. So there is the process called zeroing out a file when you delete it so that ...
0
votes
2answers
143 views
Data recovery hardware need
In terms of data recovery, what is the actual technical need for dedicated hardware such as Atola, PC3000 or Deepspar?
What are these devices doing that I cannot achieve using regular Hex/Digital ...
0
votes
1answer
150 views
Retention of IP Address
What is the point of a website deleting IP address logs after a certain period of time? As far as I know, deleted data can be recovered easily, or is there some catch here?
3
votes
1answer
200 views
Best strategy to recover running Macbook “modern” Pro ram
(Take a Macbook Pro 2017 Sierra 10.12.5 for example.)
What I had done was I downloaded osxpmem-2.1.post4.zip (vouched by ponderthebits.com/.., itself by google.com/..), unzipped it with finder, ...
3
votes
1answer
1k views
When do flash drives overwrite previously written data?
Let's say I have a pen drive of maximum capacity 20MB. Does this mean, that after an additional 40MB of data has been written to the drive, the first 20MB of data would be completely overwritten?
...
0
votes
1answer
45 views
Detecting old file extension name of corrupted file [closed]
For example, someone corrupted the file before deleting it.
I opened a Word file via vim, or leafpad and deleted information & then changed the file extension to mp4. And then deleted it.
How ...
47
votes
3answers
8k views
Should we keep logs forever to investigate past data breaches?
Listening to the Secure code lessons from Have I Been Pwned made me really think about logging.
It appears that in the real world a lot of data breaches are discovered long after they happened which ...
1
vote
1answer
57 views
Against what scenarios should I backup my database?
I'm building a website with very sensitive data stored in my database. Losing any of it is not an option, and that's why I'm thinking to do an incremental backup every hour or so. I work on it alone, ...
4
votes
2answers
159 views
Terminated user did something to corrupt OS and data on turned in laptop
I am a senior systems engineer at a mid-sized ASP/hosting company. 9 or 10 months ago we had a large lay off which included our company's marketing director.
None of our upper management thought to ...
1
vote
0answers
142 views
Will overwriting a file before deleting guarantee the destruction of the original file's data [duplicate]
Say I have a file I want to erase. Simply deleting it is not enough. It still resides in the recycle bin. Emptying the recycle bin does little as well, the actual data is not deleted just the pointer, ...
1
vote
1answer
336 views
Recovering truecrypt full disk encryption with wordlist
I'm dusting off an hold drive and unfortunately forget the password. I'm going to run a word list against it using TrueCrack however I'm a little confused on how to extract the volume header to run ...
1
vote
1answer
153 views
Analyzing possible encrypted USB stick
I was given an USB stick which was used to secure some data from a work computer. However - the USB stick seems broken now, or encrypted, which would mean the information might be lost.
So, when ...
-1
votes
1answer
69 views
Securely erase leftovers of files from the bin in OSX
I have made a mistake and deleted a sensitive file by placing it on the bin, and then empty the bin in OSX 10.12 (Sierra). I have heard this is not a secure way to delete sensitive files.
Is there a ...
2
votes
2answers
255 views
Is it possible to browse Windows 7 Previous Versions of an offline hard drive?
Short of buying identical hardware, my sister's computer died and she kept only the hard drive. She moved a file to a USB FD prior to it dying, but she can't find the FD. She knows it was on the ...
1
vote
2answers
270 views
If an OS is protected by full disk encryption (FDE), can recovery software recover deleted files from disk after unlocking FDE?
It seems that full disk encryption entails that files can only be written to disk in an encrypted way.
If a file has been deleted on a system with full disk encryption, can it be recovered if the ...
