Questions tagged [data-recovery]
For questions generally relating to recovery of "plain" data from digital storage, when that storage has been damaged or the credentials securing it are lost.
0
votes
0answers
67 views
Does renaming and emptying all the content of a file before deletion make it unrecoverable?
When I delete a file, I rename it to new.txt, open the file in a text editor, press Ctrl+A, Backspace, Ctrl+S to delete all the content and save it as an empty file and then Shift+Delete to ...
0
votes
0answers
17 views
EFS recovery in windows 7 after reinstalling windows [migrated]
My brother formatted my PC, removed the older version of windows 7 and installed a new version. Before he formatted it, I encrypted some files using EFS in windows 7, I was using an account name: AAAA....
0
votes
0answers
46 views
Recover deleted Windows volumes
I have been given an HDD image. I believe the image was taken with dd. I have ingested the file using Autopsy and can see there are 4 volumes, like so
Volume 1 - Unallocated. I believe NOT securely ...
0
votes
0answers
27 views
Using OTAC as authentication to account recovery schemes
I develop a mobile application that is authenticated to a service utilizing a Challenge-Response scheme. During the registration a Device Key asymmetric key is generated and signed using a User Key ...
0
votes
1answer
77 views
Understanding the philosophy of recovering data
It can be understood that if i delete some data, those bytes may not be written by other data can be extracted because the data actually resides on those sectors/cells.
But i wounder how the bytes ...
0
votes
3answers
162 views
How to protect company sensitive data from being deleted by a user when data is on their computer?
There more than 300 computers and more than 400 users are available. We face two incidents recently when critical users(who has critical data) leave from company.We have deleted their data when they ...
5
votes
2answers
192 views
How important is it to delete disk partitions when wiping devices?
The command lsblk returns the following output that lists 4 partitions.
sda 8:0 0 931.5G 0 disk
├─sda1 8:1 0 8M 0 part
├─sda2 8:2 0 40G 0 part /
├─sda3 8:3 0 883.8G ...
-1
votes
1answer
173 views
Can a hacker recover deleted files from my mobile drive? [duplicate]
I deleted some files from my phone (android 5). Can a hacker recover my files?
2
votes
4answers
806 views
SSD is formatted twice and filled twice. Can i recover old deleted data? [duplicate]
I need to recover some old data which were stored on a drive. The data were deleted and the hard drive was formatted twice and filled twice with random data intentionally.
First the drive had a ...
2
votes
2answers
196 views
How to securely destroy old cellphone, to avoid personal data recuperation?
While cleaning I've found an old cellphone. This phone does not turn on, and I'm not sure if contains personal data.
I would like to throw away this phone, but I'm concerted if this data can be ...
0
votes
1answer
56 views
Recovering Data from a 1-Pass Zero'd Hard Disk Drive [duplicate]
I don't want to do this, but I'm wondering how easy it is to do? Or to put it another way, I'm wondering "is a 1-pass zero of a drive enough?"
From what I understand, it's completely wiped from ...
0
votes
1answer
51 views
What does the existence of this file indicate? [closed]
C:\Documents and Settings\Sarah\Recent\DSCN0275.JPG.lnk
on a Microsoft Windows system, and use the xxd program to dump the contents of
this file:
1
vote
1answer
86 views
RAID-1 and low level formatting (or file shredding), more chances of data recovery?
If I have two disks setup as RAID-1. I deleted some files and then made a low level format. made sure the files are not recoverable.
However, if I am to separate them and connect them as separate ...
0
votes
1answer
41 views
How to recover disk image from a smartphone in “bootloop” state?
I've been playing around on data recovery from devices and so far it worked well. Now I got this new situation that I don't know how to proceed in order to put my hands on the data. My old smartphone ...
1
vote
1answer
196 views
Secure way to wipe an entire SSD? [duplicate]
I've read some articles and they appear to suggest the idea of using the dd command to wipe an entire SSD before encrypting it. The drive in question is a Samsung 970 EVO PCIe NVMe V-NAND M.2 2280 ...
1
vote
5answers
278 views
Why can't you and how to take a picture from infected computer?
Let's say I know that there is a computer than is heavily infested with viruses (but I do not know which kind of viruses) and needs to be nuked from orbit. And on that computer is a very important ...
4
votes
0answers
1k views
What type of data can be recovered from the swap file / page file and thumbs file
This question follows on from a previously posted question on recovery of data from a wiped disk. I have been informed that no files have been found on the computer on the hard disk or in the deleted ...
0
votes
1answer
99 views
lost key-files for encrypted files [closed]
I had encrypted a file on my computer but the computer got infected by a virus, so I reinstalled Windows on my computer. All my key-files have gone.
Is there a way to recreate the lost key-files, as ...
0
votes
1answer
70 views
Working from a USB [closed]
I have a Mac for my work laptop and I would like to work on my xCode project, I can't work on the laptop directly and save the file to computer due to fears that it could one day be recovered & be ...
1
vote
2answers
463 views
Secure erase hard drive [duplicate]
What device/method do you usually use to securely erase a hard drive?
The situation is, we have hard drives that we want to use somewhere else, and don't want any data to get recovered later,
I can ...
0
votes
1answer
73 views
Does zeroing a file on Android work similar to a regular HDD?
On a regular PC hard drive, files aren't actually deleted, so they can still be recovered from the raw data on the drive. So there is the process called zeroing out a file when you delete it so that ...
0
votes
2answers
120 views
Data recovery hardware need
In terms of data recovery, what is the actual technical need for dedicated hardware such as Atola, PC3000 or Deepspar?
What are these devices doing that I cannot achieve using regular Hex/Digital ...
0
votes
1answer
121 views
Retention of IP Address
What is the point of a website deleting IP address logs after a certain period of time? As far as I know, deleted data can be recovered easily, or is there some catch here?
3
votes
1answer
177 views
Best strategy to recover running Macbook “modern” Pro ram
(Take a Macbook Pro 2017 Sierra 10.12.5 for example.)
What I had done was I downloaded osxpmem-2.1.post4.zip (vouched by ponderthebits.com/.., itself by google.com/..), unzipped it with finder, ...
3
votes
1answer
604 views
When do flash drives overwrite previously written data?
Let's say I have a pen drive of maximum capacity 20MB. Does this mean, that after an additional 40MB of data has been written to the drive, the first 20MB of data would be completely overwritten?
...
0
votes
1answer
44 views
Detecting old file extension name of corrupted file [closed]
For example, someone corrupted the file before deleting it.
I opened a Word file via vim, or leafpad and deleted information & then changed the file extension to mp4. And then deleted it.
How ...
46
votes
3answers
7k views
Should we keep logs forever to investigate past data breaches?
Listening to the Secure code lessons from Have I Been Pwned made me really think about logging.
It appears that in the real world a lot of data breaches are discovered long after they happened which ...
1
vote
1answer
53 views
Against what scenarios should I backup my database?
I'm building a website with very sensitive data stored in my database. Losing any of it is not an option, and that's why I'm thinking to do an incremental backup every hour or so. I work on it alone, ...
4
votes
2answers
156 views
Terminated user did something to corrupt OS and data on turned in laptop
I am a senior systems engineer at a mid-sized ASP/hosting company. 9 or 10 months ago we had a large lay off which included our company's marketing director.
None of our upper management thought to ...
1
vote
0answers
100 views
Will overwriting a file before deleting guarantee the destruction of the original file's data [duplicate]
Say I have a file I want to erase. Simply deleting it is not enough. It still resides in the recycle bin. Emptying the recycle bin does little as well, the actual data is not deleted just the pointer, ...
1
vote
1answer
302 views
Recovering truecrypt full disk encryption with wordlist
I'm dusting off an hold drive and unfortunately forget the password. I'm going to run a word list against it using TrueCrack however I'm a little confused on how to extract the volume header to run ...
1
vote
1answer
138 views
Analyzing possible encrypted USB stick
I was given an USB stick which was used to secure some data from a work computer. However - the USB stick seems broken now, or encrypted, which would mean the information might be lost.
So, when ...
-1
votes
1answer
67 views
Securely erase leftovers of files from the bin in OSX
I have made a mistake and deleted a sensitive file by placing it on the bin, and then empty the bin in OSX 10.12 (Sierra). I have heard this is not a secure way to delete sensitive files.
Is there a ...
2
votes
2answers
219 views
Is it possible to browse Windows 7 Previous Versions of an offline hard drive?
Short of buying identical hardware, my sister's computer died and she kept only the hard drive. She moved a file to a USB FD prior to it dying, but she can't find the FD. She knows it was on the ...
1
vote
2answers
220 views
If an OS is protected by full disk encryption (FDE), can recovery software recover deleted files from disk after unlocking FDE?
It seems that full disk encryption entails that files can only be written to disk in an encrypted way.
If a file has been deleted on a system with full disk encryption, can it be recovered if the ...
2
votes
1answer
76 views
Can opening media (e.g. video, image, text, etc) typically leak data to disk and to memory? Are there relatively safe programs to open media?
Let us, for example, take a typical video player program such as VLC. Let us suppose we have an encrypted view of all media.
Does opening a video file only write to memory and not to disk?
If it does ...
0
votes
2answers
64 views
where is data that was not completely received and can it be recovered?
when a server is receiving data from another computer, lets say that that data transmission was incomplete, and half of the file was sent. now where is this stored on a computer and is it stored on ...
-1
votes
1answer
40 views
Is it practical to recover data in a server? [closed]
Deleted Data can be recovered. But can this be done in a server. Secondly can this be done remotely and secretly?
0
votes
1answer
114 views
Are there any real life scenarios where usage of the Gutmann method is appropriate? [duplicate]
Peter Gutmann himself wrote the following:
If you're using a drive which uses encoding technology X, you only
need to perform the passes specific to X, and you never need to
perform all 35 ...
2
votes
2answers
380 views
Is using video editing software to fill SSD with junk video secure?
I'm about to sell an old 128GB external SSD, and I've read various guides saying it's difficult to be sure that data is erased when using traditional zero-fills etc.
I'm on Mac OSx, and I got the ...
1
vote
1answer
153 views
How to look up a file that has been split into segments in a memory snapshot
I have a snapshot of the memory of a device loaded up in FTK Imager.
I also have a file, specifically a picture (JPG) as a file on my computer. I know for a fact that this file is present in the ...
3
votes
1answer
137 views
My local certificates may have been compromised. What to do now? [closed]
My hard drive was accessed by an attacker. I'm concern that my root certificates might have been compromised or a rogue certificate was installed to perform MiTM attacks against my SSL connections ...
1
vote
2answers
419 views
Is it possible to recover wannacry encrypted files through file system recovery?
As I saw wannacry encrypts files and then removes them, I thought it is possible to recover some of the original files by file system recovery using a bootable OS.
Is it possible to use a bootable ...
4
votes
2answers
481 views
Is it possible to revert a steganographic process to reconstruct the original image?
Using, say, outguess, it is possible to hide a secret message inside a JPEG image (LSB method).
Is it possible to undo the steganographic process given the modified image to reconstruct the original ...
0
votes
1answer
157 views
Flash drive returning odd files, and self creating others, any ideas?
I was sanitising a USB drive and after wiping it I ran Recuva to check the results.
It finds a file called [000001].flv which is 113MB. The file starts with FLV and then the data looks random, ...
2
votes
1answer
696 views
Lost my PGP private key when hard drive wiped. Possible to recover? [closed]
I recently made a big mistake of wiping my C drive that held my pgp key ring. Currently the key ring is the only way I can get access to an account with $300 of bitcoin. I've downloaded some recovery ...
4
votes
1answer
4k views
GPG/GnuPG secret key passphrase recovery and/or .gnupg/private-keys-v1.d/ file format
Bad news: I forgot a GnuPG secret key passphrase.
Good news: I do know the words it is constructed of. So, I can easily use john or similar to recover (too many combinations to do it manually, ...
4
votes
2answers
136 views
Is there a standard recommending physical destruction of a machine?
I had a discussion with a customer who requires the physical destruction of the PC (a standard laptop) which is holding their data. After clarification, they mean the destruction of the entire laptop, ...
-3
votes
1answer
48 views
can cloud data be recovered by hacking on the servers? [closed]
i have a problem. i want to ask if cloud service providerss can run test on their storage devices to recover data we delete., and if someone can hack into the servers do recover dat which we have ...
1
vote
2answers
156 views
Distance between main site and Disaster recovery site
i couldn't find any specific requirements for distance between main site and DR at the regulations or best practices only descriptions as “safe distance”
can any one provide reference to something ...
