Questions tagged [data-recovery]
For questions generally relating to recovery of "plain" data from digital storage, when that storage has been damaged or the credentials securing it are lost.
5
votes
2answers
169 views
How important is it to delete disk partitions when wiping devices?
The command lsblk returns the following output that lists 4 partitions.
sda 8:0 0 931.5G 0 disk
├─sda1 8:1 0 8M 0 part
├─sda2 8:2 0 40G 0 part /
├─sda3 8:3 0 883.8G ...
0
votes
0answers
13 views
Accessing files on a hard drive without booting [migrated]
I have a Windows 10 HP laptop. I want to access the files on the hard drive without actually booting the OS. Now the most common answer to this I have seen is booting from a Live CD or USB.
However, ...
-1
votes
1answer
83 views
Can a hacker recover deleted files from my mobile drive? [duplicate]
I deleted some files from my phone (android 5). Can a hacker recover my files?
2
votes
4answers
336 views
SSD is formatted twice and filled twice. Can i recover old deleted data? [duplicate]
I need to recover some old data which were stored on a drive. The data were deleted and the hard drive was formatted twice and filled twice with random data intentionally.
First the drive had a ...
2
votes
2answers
135 views
How to securely destroy old cellphone, to avoid personal data recuperation?
While cleaning I've found an old cellphone. This phone does not turn on, and I'm not sure if contains personal data.
I would like to throw away this phone, but I'm concerted if this data can be ...
0
votes
1answer
41 views
Recovering Data from a 1-Pass Zero'd Hard Disk Drive [duplicate]
I don't want to do this, but I'm wondering how easy it is to do? Or to put it another way, I'm wondering "is a 1-pass zero of a drive enough?"
From what I understand, it's completely wiped from ...
0
votes
1answer
47 views
What does the existence of this file indicate? [closed]
C:\Documents and Settings\Sarah\Recent\DSCN0275.JPG.lnk
on a Microsoft Windows system, and use the xxd program to dump the contents of
this file:
1
vote
1answer
55 views
RAID-1 and low level formatting (or file shredding), more chances of data recovery?
If I have two disks setup as RAID-1. I deleted some files and then made a low level format. made sure the files are not recoverable.
However, if I am to separate them and connect them as separate ...
0
votes
1answer
34 views
How to recover disk image from a smartphone in “bootloop” state?
I've been playing around on data recovery from devices and so far it worked well. Now I got this new situation that I don't know how to proceed in order to put my hands on the data. My old smartphone ...
1
vote
1answer
152 views
Secure way to wipe an entire SSD? [duplicate]
I've read some articles and they appear to suggest the idea of using the dd command to wipe an entire SSD before encrypting it. The drive in question is a Samsung 970 EVO PCIe NVMe V-NAND M.2 2280 ...
1
vote
5answers
243 views
Why can't you and how to take a picture from infected computer?
Let's say I know that there is a computer than is heavily infested with viruses (but I do not know which kind of viruses) and needs to be nuked from orbit. And on that computer is a very important ...
4
votes
0answers
511 views
What type of data can be recovered from the swap file / page file and thumbs file
This question follows on from a previously posted question on recovery of data from a wiped disk. I have been informed that no files have been found on the computer on the hard disk or in the deleted ...
0
votes
1answer
84 views
lost key-files for encrypted files [closed]
I had encrypted a file on my computer but the computer got infected by a virus, so I reinstalled Windows on my computer. All my key-files have gone.
Is there a way to recreate the lost key-files, as ...
0
votes
1answer
70 views
Working from a USB [closed]
I have a Mac for my work laptop and I would like to work on my xCode project, I can't work on the laptop directly and save the file to computer due to fears that it could one day be recovered & be ...
1
vote
2answers
370 views
Secure erase hard drive [duplicate]
What device/method do you usually use to securely erase a hard drive?
The situation is, we have hard drives that we want to use somewhere else, and don't want any data to get recovered later,
I can ...
0
votes
1answer
70 views
Does zeroing a file on Android work similar to a regular HDD?
On a regular PC hard drive, files aren't actually deleted, so they can still be recovered from the raw data on the drive. So there is the process called zeroing out a file when you delete it so that ...
0
votes
2answers
108 views
Data recovery hardware need
In terms of data recovery, what is the actual technical need for dedicated hardware such as Atola, PC3000 or Deepspar?
What are these devices doing that I cannot achieve using regular Hex/Digital ...
0
votes
1answer
104 views
Retention of IP Address
What is the point of a website deleting IP address logs after a certain period of time? As far as I know, deleted data can be recovered easily, or is there some catch here?
3
votes
1answer
153 views
Best strategy to recover running Macbook “modern” Pro ram
(Take a Macbook Pro 2017 Sierra 10.12.5 for example.)
What I had done was I downloaded osxpmem-2.1.post4.zip (vouched by ponderthebits.com/.., itself by google.com/..), unzipped it with finder, ...
3
votes
1answer
300 views
When do flash drives overwrite previously written data?
Let's say I have a pen drive of maximum capacity 20MB. Does this mean, that after an additional 40MB of data has been written to the drive, the first 20MB of data would be completely overwritten?
...
0
votes
1answer
44 views
Detecting old file extension name of corrupted file [closed]
For example, someone corrupted the file before deleting it.
I opened a Word file via vim, or leafpad and deleted information & then changed the file extension to mp4. And then deleted it.
How ...
45
votes
3answers
7k views
Should we keep logs forever to investigate past data breaches?
Listening to the Secure code lessons from Have I Been Pwned made me really think about logging.
It appears that in the real world a lot of data breaches are discovered long after they happened which ...
1
vote
1answer
53 views
Against what scenarios should I backup my database?
I'm building a website with very sensitive data stored in my database. Losing any of it is not an option, and that's why I'm thinking to do an incremental backup every hour or so. I work on it alone, ...
4
votes
2answers
156 views
Terminated user did something to corrupt OS and data on turned in laptop
I am a senior systems engineer at a mid-sized ASP/hosting company. 9 or 10 months ago we had a large lay off which included our company's marketing director.
None of our upper management thought to ...
1
vote
0answers
90 views
Will overwriting a file before deleting guarantee the destruction of the original file's data [duplicate]
Say I have a file I want to erase. Simply deleting it is not enough. It still resides in the recycle bin. Emptying the recycle bin does little as well, the actual data is not deleted just the pointer, ...
1
vote
1answer
268 views
Recovering truecrypt full disk encryption with wordlist
I'm dusting off an hold drive and unfortunately forget the password. I'm going to run a word list against it using TrueCrack however I'm a little confused on how to extract the volume header to run ...
1
vote
1answer
128 views
Analyzing possible encrypted USB stick
I was given an USB stick which was used to secure some data from a work computer. However - the USB stick seems broken now, or encrypted, which would mean the information might be lost.
So, when ...
-1
votes
1answer
65 views
Securely erase leftovers of files from the bin in OSX
I have made a mistake and deleted a sensitive file by placing it on the bin, and then empty the bin in OSX 10.12 (Sierra). I have heard this is not a secure way to delete sensitive files.
Is there a ...
2
votes
2answers
209 views
Is it possible to browse Windows 7 Previous Versions of an offline hard drive?
Short of buying identical hardware, my sister's computer died and she kept only the hard drive. She moved a file to a USB FD prior to it dying, but she can't find the FD. She knows it was on the ...
1
vote
2answers
193 views
If an OS is protected by full disk encryption (FDE), can recovery software recover deleted files from disk after unlocking FDE?
It seems that full disk encryption entails that files can only be written to disk in an encrypted way.
If a file has been deleted on a system with full disk encryption, can it be recovered if the ...
2
votes
1answer
74 views
Can opening media (e.g. video, image, text, etc) typically leak data to disk and to memory? Are there relatively safe programs to open media?
Let us, for example, take a typical video player program such as VLC. Let us suppose we have an encrypted view of all media.
Does opening a video file only write to memory and not to disk?
If it does ...
0
votes
2answers
63 views
where is data that was not completely received and can it be recovered?
when a server is receiving data from another computer, lets say that that data transmission was incomplete, and half of the file was sent. now where is this stored on a computer and is it stored on ...
-1
votes
1answer
40 views
Is it practical to recover data in a server? [closed]
Deleted Data can be recovered. But can this be done in a server. Secondly can this be done remotely and secretly?
0
votes
0answers
43 views
Flash drives : encrypt free space? (anti-recovering) [duplicate]
I heard it's not reliable to erase free space on flash drives, is it possible to encrypt it instead or it's too late ? the data will always be recoverable?
Thanks
0
votes
1answer
96 views
Are there any real life scenarios where usage of the Gutmann method is appropriate? [duplicate]
Peter Gutmann himself wrote the following:
If you're using a drive which uses encoding technology X, you only
need to perform the passes specific to X, and you never need to
perform all 35 ...
2
votes
2answers
367 views
Is using video editing software to fill SSD with junk video secure?
I'm about to sell an old 128GB external SSD, and I've read various guides saying it's difficult to be sure that data is erased when using traditional zero-fills etc.
I'm on Mac OSx, and I got the ...
1
vote
1answer
129 views
How to look up a file that has been split into segments in a memory snapshot
I have a snapshot of the memory of a device loaded up in FTK Imager.
I also have a file, specifically a picture (JPG) as a file on my computer. I know for a fact that this file is present in the ...
3
votes
1answer
134 views
My local certificates may have been compromised. What to do now? [closed]
My hard drive was accessed by an attacker. I'm concern that my root certificates might have been compromised or a rogue certificate was installed to perform MiTM attacks against my SSL connections ...
1
vote
2answers
406 views
Is it possible to recover wannacry encrypted files through file system recovery?
As I saw wannacry encrypts files and then removes them, I thought it is possible to recover some of the original files by file system recovery using a bootable OS.
Is it possible to use a bootable ...
4
votes
2answers
350 views
Is it possible to revert a steganographic process to reconstruct the original image?
Using, say, outguess, it is possible to hide a secret message inside a JPEG image (LSB method).
Is it possible to undo the steganographic process given the modified image to reconstruct the original ...
0
votes
1answer
142 views
Flash drive returning odd files, and self creating others, any ideas?
I was sanitising a USB drive and after wiping it I ran Recuva to check the results.
It finds a file called [000001].flv which is 113MB. The file starts with FLV and then the data looks random, ...
2
votes
1answer
542 views
Lost my PGP private key when hard drive wiped. Possible to recover? [closed]
I recently made a big mistake of wiping my C drive that held my pgp key ring. Currently the key ring is the only way I can get access to an account with $300 of bitcoin. I've downloaded some recovery ...
4
votes
1answer
3k views
GPG/GnuPG secret key passphrase recovery and/or .gnupg/private-keys-v1.d/ file format
Bad news: I forgot a GnuPG secret key passphrase.
Good news: I do know the words it is constructed of. So, I can easily use john or similar to recover (too many combinations to do it manually, ...
3
votes
2answers
134 views
Is there a standard recommending physical destruction of a machine?
I had a discussion with a customer who requires the physical destruction of the PC (a standard laptop) which is holding their data. After clarification, they mean the destruction of the entire laptop, ...
-3
votes
1answer
47 views
can cloud data be recovered by hacking on the servers? [closed]
i have a problem. i want to ask if cloud service providerss can run test on their storage devices to recover data we delete., and if someone can hack into the servers do recover dat which we have ...
1
vote
2answers
126 views
Distance between main site and Disaster recovery site
i couldn't find any specific requirements for distance between main site and DR at the regulations or best practices only descriptions as “safe distance”
can any one provide reference to something ...
0
votes
2answers
120 views
How to store and open files without making them recoverable?
I would like to store and work with some files but simply set a password to my Windows account isn't enough as the hard drive can be removed and the files can be recovered.
I am wondering if I create ...
0
votes
1answer
1k views
Resetting password for stored encrypted data
I'm designing a system to hold protected user objects, potentially using their passwords as in this article Encrypting sensitive data in software and storing/decrypting it on a server.
When a user ...
1
vote
1answer
133 views
Resetting password everytime you login
It is a good idea in terms of security wise, to reset your password everytime you login and just fill your password with a bunch of random symbols,letters and words that you don't memorise?
Since ...
2
votes
2answers
161 views
How much information does an improperly obscured barcode leak? [closed]
Often while sharing information on social media, some people may hide PII and yet still allow some aspect of a barcode to leak.
Question
Is there any research that describes how a damaged/obscured ...
