Questions tagged [data-recovery]

For questions generally relating to recovery of "plain" data from digital storage, when that storage has been damaged or the credentials securing it are lost.

Filter by
Sorted by
Tagged with
1 vote
0 answers
99 views

Is there any way to get the BitLocker password from the laptop? [migrated]

I have a personal hard disk of 1TB with lot of data. I connected it to my office laptop and the drive got bitlocked automatically within a second. I talk to the office administrators and we ran the ...
user avatar
  • 111
0 votes
1 answer
26 views

Can you teach scalpel to recognize a file

I have a few drives that have been reformatted that I need to retrieve data from. A friend told me that an app like scalpel might be a good option for doing this. After some research it looks like a ...
user avatar
0 votes
1 answer
93 views

Does full disk encryption securely remove data?

I was just catching up on best practices for securely erasing data from a Mac. At one point I remember reading: For SSD drives it is no longer recommended to fully write ones/zeroes/random bits on the ...
user avatar
0 votes
0 answers
63 views

When the phone breaks and I regret encryption

I believe most new Android phones have full encryption enabled by default, so even if I just download some PDF weather report from the internet, it will sit encrypted on my phone's SSD. Now, suppose ...
user avatar
  • 230
1 vote
1 answer
112 views

Can SD cards on mobile phones and tablets truly be erased?

When performing a factory reset on Android devices, it is my understanding that the pointers to the data located in the SD card are simply erased while the data itself remains intact, waiting for ...
user avatar
0 votes
0 answers
92 views

Encrypting file = Overwriting file?

When thinking of encrypting a file (also how I implemented it in a program of mine), I think of getting the data of a file, encrypting it, and writing it back into the file (overwriting the file). But ...
user avatar
  • 1
2 votes
1 answer
118 views

What should I do if my sensitive information is potentially leaked?

I sold an laptop recently, but didn’t care to do a secure erase to make sure there wasn’t any data left. After a long time, I suddenly realized that I shouldn’t have be so careless and began to worry ...
user avatar
  • 23
2 votes
0 answers
68 views

Is "drag-drop files" computer backup sufficient to avoid most malware/ have all my files?

I'm debating dragging all my files onto an external hard drive manually - rather than a time machine backup - and then pulling over any specific files I need if I ever need them. Afterwards, I'll ...
user avatar
  • 21
0 votes
1 answer
112 views

If I move a file within the same drive or partition and then shred that file with a file shredder, would it still be recoverable?

If I move a file within the same drive or partition, suppose from one folder to another, and then shred that file with a file shredder, would it still be recoverable? Is there still some trace of that ...
user avatar
  • 1
0 votes
0 answers
130 views

Is there a fullproof way to safely erase SSD data, without physically destroying it?

During my search for an answer to this question I found that TRIM may not be reliable(https://blog.elcomsoft.com/2019/01/life-after-trim-using-factory-access-mode-for-imaging-ssd-drives/)as well as ...
user avatar
0 votes
1 answer
101 views

Does data recovery of file depends on its extension?

Most free to use data recovery tools (Recuva, Easus, MiniTools) offers good recovery with known file extensions for picutres, videos and documents (.png, .xlsx etc). But lesser known file extensions, ...
user avatar
  • 103
2 votes
2 answers
743 views

How to get PGP key passphrase out of Thunderbird?

I set up Thunderbird to use PGP a while ago, so I can sign and decrypt messages now. But I have forgotten my private passphrase for my private key, but since Thunderbird can do it anyway, it has it ...
user avatar
0 votes
0 answers
98 views

Securely deleting Volume Shadow Service (VSS) in Windows 10

Suppose that VSS is enabled and snapshots exist. If I run a program to wipe the free disk space on my drive, would this delete the VSS snapshots? It might do since the program works by filling up the ...
user avatar
-1 votes
1 answer
219 views

If SSDs cannot be securely wiped then why can't we recover files after crypto virus attack?

It is my understanding that SSDs do not allow user to overwrite any specific file completely (wear-leveling). So in case of ransomware attack such as CryptoLocker, doesn't that mean there is still, ...
user avatar
1 vote
1 answer
150 views

Print sensitive info without leaving data on the printer

I'm not sure if there is already a question here about this because I can't find anything. But I'm wondering if there are any "safer" ways to print sensitive information without leaving ...
user avatar
  • 15.3k
-1 votes
1 answer
140 views

Can data be stored anywhere else on a MacBook besides the SSD?

Imagine the following scenario: There exist all kinds of information on my SSD. Now I take away the SSD of my MacBook Pro, replace it, and reboot. I should have a MacBook that is on factory settings, ...
user avatar
1 vote
1 answer
158 views

How do I destroy references to wiped files?

I partially wiped my hard drive using the null-fill method through command prompt by copying a 1 Gigabyte file filled with NULL over and over until I ran out of space. After that I tried recovering ...
user avatar
1 vote
0 answers
103 views

How Can I Backup App Data In Android/iOS Devices?

After my other post I'm looking over some other possibilities to do what I'm trying to do. How To Recover End-To-End Encrypted Data After Losing Private Key? If I save user data in server, in order to ...
user avatar
  • 247
4 votes
1 answer
440 views

Data recovery from TRIMmed SSDs

Assuming a given SSD supports TRIM, and is on a physical bus that supports sending that command, and the connected computer is running an OS that is aware of TRIM: If the drive is formatted, or has ...
user avatar
0 votes
1 answer
89 views

DBAN under PC for an HDD using MAC OSx

A HDD with OSx installed removed from mac and used DBAN to wipe it under a PC. Does all the data is lost even if we put it back on a mac machine ?
user avatar
  • 1
0 votes
1 answer
173 views

Recover data after multiple wipe

I have a company laptop where I had many of my personal files and pictures. Now, I'm leaving for a new opportunity and I need to give them back the machine. So I used DBAN to wipe the hard drive. I'm ...
user avatar
  • 1
5 votes
1 answer
319 views

What's the DRAT word of my SSD?

This article on forensicfocus.com says the following about Deterministic Read After TRIM (emphasis mine): As a result, the data returned by SSD drives supporting DRAT as opposed to DZAT can be all ...
user avatar
5 votes
1 answer
864 views

Does formatting an SSD securely delete all data?

This article on thomas-krenn.com states: Because an ATA trim will be performed by NTFS with Windows 7 or when formatting using Ext4 from mke2fs 1.41.10 or XFS from xfsprogs 3.1.0, the secure erase ...
user avatar
0 votes
3 answers
211 views

How many overwrites make a drive undesirable?

I wanted to wipe free disk space of my PC, as I had accidentally deleted confidential data permanently without securely deleting them. So wiping the entire free disk seems to be the only option now. I ...
user avatar
  • 339
34 votes
6 answers
8k views

Is there any hope of getting my pictures back after an iPhone factory reset some day in the future?

Four months ago I lost all my data after an iTunes update automatically restored my phone to factory defaults. I lost all the pictures of my newborn. I understand that when you do a factory reset the ...
user avatar
  • 351
0 votes
1 answer
140 views

Can I recover files that I had on windows from a SSD that I converted to apfs (mac) and which method or tool to use?

I had some files that I want to recover from windows, but I formatted the ssd drive to macos (apfs)? Is there a tool or method to recover those files?
user avatar
  • 1
1 vote
2 answers
761 views

Is a BIOS password enough to prevent someone from hacking into my laptop if they have physical access?

Would my laptop be secure against physical access if I set up a bios password and full disk encryption ? If not then is there any way to secure your laptop from someone with physical access? How hard ...
user avatar
0 votes
2 answers
278 views

How to secure file delete/wipe on mobile phones?

With old HDD to secure delete a file you need to use Gutmann standard, but with new HDD you can use only 1 pass overwrite I'm not sure what hard drives mobile phones use and don't know how many passes ...
user avatar
  • 1
2 votes
1 answer
432 views

I snapped my micro SD card into 8 pieces before throwing it away. Should I be worried that someone can get my data?

The card was a 16gb SanDisk micro SD card (monolithic).
user avatar
0 votes
0 answers
110 views

Destroying data on storage drives via overwrite methods really doesn't work?

I'm going to sell a computer hard drive on the Internet, it's a 500GB SATA hard drive, I really used it 3 or 2 years ago, I never used it again, I used about 20 or 40% of the space. I have read about ...
user avatar
  • 239
1 vote
1 answer
355 views

Can deleted snapchat messages be recovered? [closed]

If there are chats that have been deleted, is there a way to recover these with any recovery tools, or are they gone forever?
user avatar
  • 21
39 votes
7 answers
8k views

At what point is deleted data irrecoverable?

From reading around on the internet I get the impression that barring physical damage, deleted data can be always be recovered using sophisticated digital forensics. For this reason the advice is ...
user avatar
  • 407
1 vote
0 answers
165 views

Secure deletion on Android

My understanding is if I delete photo001.jpg, this deletes the index and assigns it to the free space to be overwritten. So this brings me onto my next scenarios. If I have a device capable of 8gb ...
user avatar
1 vote
1 answer
100 views

How to verify secure erasure of Android and Apple mobile devices

I'm aware of how to securely sanitise and verify the sanitisation of data from both HDDs and SSDs, but mobile phones complicate this due to being there a lot of proprietary layers standing between the ...
user avatar
1 vote
1 answer
237 views

Is it possible to recover data from a Western Digital TRIM supporting disks (not SSD) after quick format?

I have a western digital blue disk, which is one of the SMR variations. I've heard that they support TRIM command. The disk is accidentally quick formatted on Windows 10, and now seems to be all zero. ...
user avatar
  • 61
1 vote
0 answers
117 views

How to retrieve deleted data from Iphone? [closed]

My data got deleted from iPhone. I tried to recover all images and videos using some third party softwares like dr.fone, stellar, etc but all these apps allow only preview of the data but can't ...
user avatar
0 votes
0 answers
17 views

Is it possible to delete all traces and files on a mac? [duplicate]

Is it possible to delete all traces and files on a mac, so no one can recover files and there will be no traces at all for this files or any activity?
user avatar
0 votes
2 answers
116 views

Does software based file recovey solutions have the same results on real physical device vs dd image file?

I have a flash drive and I want to recover some files from it. Can I take a dd image of the device and perform the recovery operation on dd image instead? Does it have the same results when performing ...
user avatar
  • 17
1 vote
3 answers
100 views

What are the best practices in a manufacturing/production facility for data retention?

My scenario: A production facility that uses data sets provided by customer(s) to produce personalized goods in bulk. Data sets can range from 100,000 to 2,000,000 names and addresses in the US. ...
user avatar
0 votes
2 answers
336 views

How to trace the remains of deleted files?

My question is not about the recovery of deleted file, nor is it about the complete wiping of a disk; it's to ask about the traces deleted files leave, and how I could possibly 'see' them or visualise ...
user avatar
2 votes
1 answer
88 views

Can any tools/tactics produce a higher confidence in a clean system than Microsoft Security Scanner?

In the process of trying to recover data in bulk from what I assumed was a failing hard drive, Windows Security kindly notified me it had found a handful of malicious items among the recovered files. ...
user avatar
0 votes
0 answers
119 views

Secure Erase for IOS

The topics about secure erase for IOS on this site is a bit dated. Technology has definitely changed, including the tools used for forensics. Are there any secure erase softwares or techniques that ...
user avatar
0 votes
1 answer
180 views

Can someone bypass/recover/access data to Hard-Drive when Password Protected?

I've decided to designate a separate topic to this question ( even though I've mentioned this in topic: Best practice to secure hard-drive of computer(laptop) in case of Stealing ^ Loss ^ Unauthorized ...
user avatar
  • 2,667
1 vote
0 answers
123 views

How long would traces of a disk wipe be visible? [closed]

If a user on normal everyday-use computer wiped the unallocated space on a hard disk drive, how long would it take before analysis of the unallocated space would yield no evidence of a disk wipe? Lets ...
user avatar
14 votes
2 answers
845 views

Recovery of EEPROM data after bulk erase operation

I am aware of research which shows that single (or sometimes double) random overwrites on a magnetic hard drive is enough to ensure data is not recoverable, but is there any research into the recovery ...
user avatar
  • 63.9k
3 votes
3 answers
2k views

Is it sufficient to use a hard disk magnet to corrupt/erase floppy data?

I would like to make data, in many (more than 250) old floppies, unreadable/unrecoverable. I have some HDDs that I can take apart. Their magnet is sufficient to do the job to make it unreadable to ...
user avatar
  • 33
0 votes
1 answer
2k views

Recover corrupted password protected Zip

Good evening. I have a password protected zip archive (Zip 2.0 CryptoZip) with a .txt file with sensitive info inside. The problem is that I can't extract it. 7Zip:"Data error : Wrong password?" ...
user avatar
1 vote
1 answer
240 views

How can information be recovered after it has been overwritten (single pass) by a secure deletion program? [duplicate]

We know that information can be retreived after it has been deleted. There are several tools for file "undeletion" (Recuva, FTK, some tools contained in Caine, etc.) I have heard as well, that data ...
user avatar
2 votes
2 answers
148 views

Carve out all scattered pieces of a file from data

If a file is scattered in pieces on a hard drive how is it possible to find all parts of it? Forensically in a file carving situation where one do not have access to a running OS.
user avatar
  • 195
1 vote
1 answer
365 views

Can file recovery tools recover deleted small files from SSD drive's NTFS Master File Table?

According to this page and site, small files are kept in Master File Table when filesystem is NTFS. Let's assume that computer is using Windows 10 and a SSD drive with TRIM support. If a user ...
user avatar