Questions tagged [data-recovery]
For questions generally relating to recovery of "plain" data from digital storage, when that storage has been damaged or the credentials securing it are lost.
132
questions
0
votes
0answers
82 views
Professional Data Recovery in London [closed]
I'm not sure if this is the right place to post this question so my apologies in advance.
The problem: SSD Seagate beeps and it seems that heads are stuck on the platter. I have 500GB of data on it ...
0
votes
0answers
19 views
How can I create a dummy DB for developer? (original has many tables and values like decimal int text) [migrated]
I want to optimize my SQL queries, which run too slow on my production DB.
To do this efficiently, I was suggested to give access to the SQL developer.
The information on the DB is commercially ...
-1
votes
1answer
105 views
How do I recover a deleted file too large to go to recycle bin? [closed]
I mistakenly deleted a very important 50 gb file from my 1 tb hard drive, and the file was too big to go to recycle bin. How do I recover it?
1
vote
2answers
183 views
How to completely destroyed all data from an iPhone before reselling it?
I would wish to know more about how to erase 100% data of a used iPhone.
Basically, technician from Apple Store only said “Erase & Clear” within the iPhone setting could do all the work perfectly ...
1
vote
1answer
117 views
How to get the password from Windows Application?
I have an application call Metatrader 5. I had logged in way before and now I lost my password. The login could be seen but the password is hidden. I want to know if there is a way to get the hidden ...
1
vote
0answers
61 views
Find files with autopsy [closed]
I had an Ubuntu 14 machine. A couple of days I installed Ubuntu 18 on this machine.
I'm trying to recover some files from the previous installation. I'm using autopsy.
I think I'm doing something ...
0
votes
0answers
68 views
Does renaming and emptying all the content of a file before deletion make it unrecoverable?
When I delete a file, I rename it to new.txt, open the file in a text editor, press Ctrl+A, Backspace, Ctrl+S to delete all the content and save it as an empty file and then Shift+Delete to ...
0
votes
0answers
48 views
Recover deleted Windows volumes
I have been given an HDD image. I believe the image was taken with dd. I have ingested the file using Autopsy and can see there are 4 volumes, like so
Volume 1 - Unallocated. I believe NOT securely ...
0
votes
0answers
36 views
Using OTAC as authentication to account recovery schemes
I develop a mobile application that is authenticated to a service utilizing a Challenge-Response scheme. During the registration a Device Key asymmetric key is generated and signed using a User Key ...
1
vote
1answer
92 views
Understanding the philosophy of recovering data
It can be understood that if i delete some data, those bytes may not be written by other data can be extracted because the data actually resides on those sectors/cells.
But i wounder how the bytes ...
0
votes
3answers
164 views
How to protect company sensitive data from being deleted by a user when data is on their computer?
There more than 300 computers and more than 400 users are available. We face two incidents recently when critical users(who has critical data) leave from company.We have deleted their data when they ...
5
votes
2answers
194 views
How important is it to delete disk partitions when wiping devices?
The command lsblk returns the following output that lists 4 partitions.
sda 8:0 0 931.5G 0 disk
├─sda1 8:1 0 8M 0 part
├─sda2 8:2 0 40G 0 part /
├─sda3 8:3 0 883.8G ...
-1
votes
1answer
247 views
Can a hacker recover deleted files from my mobile drive? [duplicate]
I deleted some files from my phone (android 5). Can a hacker recover my files?
2
votes
4answers
1k views
SSD is formatted twice and filled twice. Can i recover old deleted data? [duplicate]
I need to recover some old data which were stored on a drive. The data were deleted and the hard drive was formatted twice and filled twice with random data intentionally.
First the drive had a ...
2
votes
2answers
223 views
How to securely destroy old cellphone, to avoid personal data recuperation?
While cleaning I've found an old cellphone. This phone does not turn on, and I'm not sure if contains personal data.
I would like to throw away this phone, but I'm concerted if this data can be ...
0
votes
1answer
83 views
Recovering Data from a 1-Pass Zero'd Hard Disk Drive [duplicate]
I don't want to do this, but I'm wondering how easy it is to do? Or to put it another way, I'm wondering "is a 1-pass zero of a drive enough?"
From what I understand, it's completely wiped from ...
0
votes
1answer
53 views
What does the existence of this file indicate? [closed]
C:\Documents and Settings\Sarah\Recent\DSCN0275.JPG.lnk
on a Microsoft Windows system, and use the xxd program to dump the contents of
this file:
1
vote
1answer
112 views
RAID-1 and low level formatting (or file shredding), more chances of data recovery?
If I have two disks setup as RAID-1. I deleted some files and then made a low level format. made sure the files are not recoverable.
However, if I am to separate them and connect them as separate ...
0
votes
1answer
43 views
How to recover disk image from a smartphone in “bootloop” state?
I've been playing around on data recovery from devices and so far it worked well. Now I got this new situation that I don't know how to proceed in order to put my hands on the data. My old smartphone ...
1
vote
1answer
240 views
Secure way to wipe an entire SSD? [duplicate]
I've read some articles and they appear to suggest the idea of using the dd command to wipe an entire SSD before encrypting it. The drive in question is a Samsung 970 EVO PCIe NVMe V-NAND M.2 2280 ...
1
vote
5answers
298 views
Why can't you and how to take a picture from infected computer?
Let's say I know that there is a computer than is heavily infested with viruses (but I do not know which kind of viruses) and needs to be nuked from orbit. And on that computer is a very important ...
4
votes
0answers
2k views
What type of data can be recovered from the swap file / page file and thumbs file
This question follows on from a previously posted question on recovery of data from a wiped disk. I have been informed that no files have been found on the computer on the hard disk or in the deleted ...
0
votes
1answer
105 views
lost key-files for encrypted files [closed]
I had encrypted a file on my computer but the computer got infected by a virus, so I reinstalled Windows on my computer. All my key-files have gone.
Is there a way to recreate the lost key-files, as ...
0
votes
1answer
70 views
Working from a USB [closed]
I have a Mac for my work laptop and I would like to work on my xCode project, I can't work on the laptop directly and save the file to computer due to fears that it could one day be recovered & be ...
1
vote
2answers
501 views
Secure erase hard drive [duplicate]
What device/method do you usually use to securely erase a hard drive?
The situation is, we have hard drives that we want to use somewhere else, and don't want any data to get recovered later,
I can ...
0
votes
1answer
74 views
Does zeroing a file on Android work similar to a regular HDD?
On a regular PC hard drive, files aren't actually deleted, so they can still be recovered from the raw data on the drive. So there is the process called zeroing out a file when you delete it so that ...
0
votes
2answers
123 views
Data recovery hardware need
In terms of data recovery, what is the actual technical need for dedicated hardware such as Atola, PC3000 or Deepspar?
What are these devices doing that I cannot achieve using regular Hex/Digital ...
0
votes
1answer
124 views
Retention of IP Address
What is the point of a website deleting IP address logs after a certain period of time? As far as I know, deleted data can be recovered easily, or is there some catch here?
3
votes
1answer
180 views
Best strategy to recover running Macbook “modern” Pro ram
(Take a Macbook Pro 2017 Sierra 10.12.5 for example.)
What I had done was I downloaded osxpmem-2.1.post4.zip (vouched by ponderthebits.com/.., itself by google.com/..), unzipped it with finder, ...
3
votes
1answer
728 views
When do flash drives overwrite previously written data?
Let's say I have a pen drive of maximum capacity 20MB. Does this mean, that after an additional 40MB of data has been written to the drive, the first 20MB of data would be completely overwritten?
...
0
votes
1answer
44 views
Detecting old file extension name of corrupted file [closed]
For example, someone corrupted the file before deleting it.
I opened a Word file via vim, or leafpad and deleted information & then changed the file extension to mp4. And then deleted it.
How ...
46
votes
3answers
7k views
Should we keep logs forever to investigate past data breaches?
Listening to the Secure code lessons from Have I Been Pwned made me really think about logging.
It appears that in the real world a lot of data breaches are discovered long after they happened which ...
1
vote
1answer
53 views
Against what scenarios should I backup my database?
I'm building a website with very sensitive data stored in my database. Losing any of it is not an option, and that's why I'm thinking to do an incremental backup every hour or so. I work on it alone, ...
4
votes
2answers
158 views
Terminated user did something to corrupt OS and data on turned in laptop
I am a senior systems engineer at a mid-sized ASP/hosting company. 9 or 10 months ago we had a large lay off which included our company's marketing director.
None of our upper management thought to ...
1
vote
0answers
109 views
Will overwriting a file before deleting guarantee the destruction of the original file's data [duplicate]
Say I have a file I want to erase. Simply deleting it is not enough. It still resides in the recycle bin. Emptying the recycle bin does little as well, the actual data is not deleted just the pointer, ...
1
vote
1answer
316 views
Recovering truecrypt full disk encryption with wordlist
I'm dusting off an hold drive and unfortunately forget the password. I'm going to run a word list against it using TrueCrack however I'm a little confused on how to extract the volume header to run ...
1
vote
1answer
140 views
Analyzing possible encrypted USB stick
I was given an USB stick which was used to secure some data from a work computer. However - the USB stick seems broken now, or encrypted, which would mean the information might be lost.
So, when ...
-1
votes
1answer
67 views
Securely erase leftovers of files from the bin in OSX
I have made a mistake and deleted a sensitive file by placing it on the bin, and then empty the bin in OSX 10.12 (Sierra). I have heard this is not a secure way to delete sensitive files.
Is there a ...
2
votes
2answers
226 views
Is it possible to browse Windows 7 Previous Versions of an offline hard drive?
Short of buying identical hardware, my sister's computer died and she kept only the hard drive. She moved a file to a USB FD prior to it dying, but she can't find the FD. She knows it was on the ...
1
vote
2answers
233 views
If an OS is protected by full disk encryption (FDE), can recovery software recover deleted files from disk after unlocking FDE?
It seems that full disk encryption entails that files can only be written to disk in an encrypted way.
If a file has been deleted on a system with full disk encryption, can it be recovered if the ...
2
votes
1answer
76 views
Can opening media (e.g. video, image, text, etc) typically leak data to disk and to memory? Are there relatively safe programs to open media?
Let us, for example, take a typical video player program such as VLC. Let us suppose we have an encrypted view of all media.
Does opening a video file only write to memory and not to disk?
If it does ...
0
votes
2answers
64 views
where is data that was not completely received and can it be recovered?
when a server is receiving data from another computer, lets say that that data transmission was incomplete, and half of the file was sent. now where is this stored on a computer and is it stored on ...
-1
votes
1answer
40 views
Is it practical to recover data in a server? [closed]
Deleted Data can be recovered. But can this be done in a server. Secondly can this be done remotely and secretly?
0
votes
1answer
115 views
Are there any real life scenarios where usage of the Gutmann method is appropriate? [duplicate]
Peter Gutmann himself wrote the following:
If you're using a drive which uses encoding technology X, you only
need to perform the passes specific to X, and you never need to
perform all 35 ...
2
votes
2answers
385 views
Is using video editing software to fill SSD with junk video secure?
I'm about to sell an old 128GB external SSD, and I've read various guides saying it's difficult to be sure that data is erased when using traditional zero-fills etc.
I'm on Mac OSx, and I got the ...
1
vote
1answer
158 views
How to look up a file that has been split into segments in a memory snapshot
I have a snapshot of the memory of a device loaded up in FTK Imager.
I also have a file, specifically a picture (JPG) as a file on my computer. I know for a fact that this file is present in the ...
2
votes
1answer
138 views
My local certificates may have been compromised. What to do now? [closed]
My hard drive was accessed by an attacker. I'm concern that my root certificates might have been compromised or a rogue certificate was installed to perform MiTM attacks against my SSL connections ...
1
vote
2answers
421 views
Is it possible to recover wannacry encrypted files through file system recovery?
As I saw wannacry encrypts files and then removes them, I thought it is possible to recover some of the original files by file system recovery using a bootable OS.
Is it possible to use a bootable ...
3
votes
2answers
511 views
Is it possible to revert a steganographic process to reconstruct the original image?
Using, say, outguess, it is possible to hide a secret message inside a JPEG image (LSB method).
Is it possible to undo the steganographic process given the modified image to reconstruct the original ...
0
votes
1answer
164 views
Flash drive returning odd files, and self creating others, any ideas?
I was sanitising a USB drive and after wiping it I ran Recuva to check the results.
It finds a file called [000001].flv which is 113MB. The file starts with FLV and then the data looks random, ...
