Questions tagged [data-recovery]
For questions generally relating to recovery of "plain" data from digital storage, when that storage has been damaged or the credentials securing it are lost.
199
questions
0
votes
0
answers
7
views
How can I restore data from a USB thumbstick in Windows 10? It is not recognized in the command line or disk management? [migrated]
I'm facing an issue with my USB thumbstick in Windows 10. It's not showing up in the command line or disk management, and I need to restore some important data from it. Can anyone please guide me on ...
0
votes
0
answers
4
views
Recovering a formatted drive that used to be encrypted with Bitlocker [migrated]
I'm dual booting Windows and Mint on my laptop and I have a separate NTFS hard drive that I use to store my personal data. The hard drive used to be compatible with Mint, even though it was encrypted ...
- 101
1
vote
0
answers
40
views
Photos are recoverable but videos are not on my vivo x27 phone [closed]
In order to test data recovery apps, I have conducted experiments where I took photos and videos, deleted them permanently, then attempted to recover them immediately. The photos can be recovered ...
- 11
-2
votes
2
answers
407
views
Can Cellebrite be used to access any phone by the government? What is the point of encryption if they can get into any phone? [closed]
I'm currently studying forensics, and one thing that keeps coming up is the authorities breaking into phones.
There are several third party tools they can use, but one of the most popular is '...
0
votes
0
answers
143
views
What does an exported BitLocker key package contain?
I've learned that a key protector encrypts the VMK (volume master key), then the VMK encrypts the FVEK (full volume encryption key), and finally the FVEK encrypts the actual data blocks.
I've also ...
- 181
0
votes
1
answer
120
views
Recover deleted (Shift+Delete) One Drive Folder on a bitlocker enabled drive. Should I unencrypt drive before I atempt recovery?
Windows 11, bitlocked C:\ Drive (I have the bitlocker key and can unencrypt drive).
Onedrive installed, synced to my Docs folder but not signed in to OneDrive account (never signed in).
Uninstalled ...
1
vote
1
answer
309
views
Will it ever be possible to functionally get the encrypted data off of an iphone in recovery mode?
Apparently the data encrypts until the passcode is entered, but my phone (close to 3,500 recordings of my original music) won't boot up. I dropped it and it went into a boot loop then went into ...
13
votes
4
answers
5k
views
How can data from VirtualBox leak to the host and how to avoid it?
I used a virtual machine (Windows host/Linux mint guest) to store some very sensitive and private data (it shouldn't be uncovered by state-level actors). Today I decided to check how much deleted ...
- 157
2
votes
0
answers
61
views
AWS sub-accounts to protect against deletion of versioned data in S3
How can administration teams (or software processes) be granted the ability to alter or remove objects from in AWS S3, while prohibiting the permanent deletion of underlying data versions, so as to ...
- 155
3
votes
1
answer
140
views
Storage options would give the organization the best chance of recovering data
I am studying information security, I have a question that I need help with.
Which of the following storage options would give the organization the
best chance of recovering data?
A. Encrypted ...
- 33
0
votes
1
answer
1k
views
Can a deleted file on an SSD with trim enabled be recovered? [duplicate]
I'm just wondering from a security stand point if a deleted file on an SSD with trim enabled can be recovered? I've did some research and it would seem it is impossible unless for some reason trim ...
- 239
1
vote
2
answers
279
views
Data remanence - DDR2
I read "Data Remanence in Semiconductor Devices" by Peter Gutmann, in which it is stated that it is possible to reconstruct the content of an erased SRAM based on changes of properties of ...
- 9
1
vote
1
answer
174
views
Reasons for recovering small amounts of deleted data from SSDs
In their 2018 paper "Solid state drive forensics: Where do we stand?", Vieyra et al. discuss recovering deleted data from SSDs.
For their experiments, they wrote large amounts of text to ...
- 497
1
vote
1
answer
402
views
2min for SECURITY ERASE UNIT
Running hdparm -I /dev/sda on a SanDisk SSD PLUS 1000GB produces this:
not supported: enhanced erase
2min for SECURITY ERASE UNIT
What does that mean?
I assume that I could do hdparm --security-erase ...
- 497
2
votes
1
answer
76
views
How do I recover files on a secure sigital internal physical volume - MS-DOS (FAT32) disk?
I have a very old 256 MB SD card (purchased around 2004).
The SD card is still working, but some old photos are missing due to a possible unintentional format action on my digital camera.
Is there any ...
- 123
1
vote
0
answers
477
views
Suspicious SSD corruption exactly at LUKS encryption header
I am helping with an interesting data recovery issue. The laptop was running Debian 11 Linux with LUKS full disk encryption on a Samsung 970 Evo Plus 2TB SSD for quite many months. Suddenly the LUKS ...
- 11
0
votes
1
answer
640
views
How to prevent the recovery of deleted files without a full format of external HDD?
How can I securely delete selected files so they can’t be recovered, but without the full format of the external HDD? Is this even possible?
I’m using Mac OS.
1
vote
0
answers
37
views
Full disk encryption and data recovery capabilities [duplicate]
So I had linux mint with fde, had sensitive files on it, shut down my pc, and reinstalled a new linux mint OS with fde. What are the chances of data recovery from the first OS?
- 11
0
votes
3
answers
575
views
How file deletion works?
If deleting files just removes the references then why not just delete the actual files instead of just removing the references?
Just removing the references leaves the file intact until it is ...
0
votes
1
answer
149
views
Can you teach scalpel to recognize a file
I have a few drives that have been reformatted that I need to retrieve data from. A friend told me that an app like scalpel might be a good option for doing this. After some research it looks like a ...
- 101
0
votes
1
answer
2k
views
Does full disk encryption securely remove data?
I was just catching up on best practices for securely erasing data from a Mac. At one point I remember reading:
For SSD drives it is no longer recommended to fully write ones/zeroes/random bits on the ...
- 1,705
1
vote
0
answers
164
views
When the phone breaks and I regret encryption
I believe most new Android phones have full encryption enabled by default, so even if I just
download some PDF weather report from the internet, it will sit encrypted on my phone's SSD.
Now, suppose ...
- 240
1
vote
1
answer
244
views
Can SD cards on mobile phones and tablets truly be erased?
When performing a factory reset on Android devices, it is my understanding that the pointers to the data located in the SD card are simply erased while the data itself remains intact, waiting for ...
- 11
0
votes
0
answers
236
views
Encrypting file = Overwriting file?
When thinking of encrypting a file (also how I implemented it in a program of mine), I think of getting the data of a file, encrypting it, and writing it back into the file (overwriting the file).
But ...
- 1
2
votes
1
answer
167
views
What should I do if my sensitive information is potentially leaked?
I sold an laptop recently, but didn’t care to do a secure erase to make sure there wasn’t any data left. After a long time, I suddenly realized that I shouldn’t have be so careless and began to worry ...
- 23
2
votes
0
answers
166
views
Is "drag-drop files" computer backup sufficient to avoid most malware/ have all my files?
I'm debating dragging all my files onto an external hard drive manually - rather than a time machine backup - and then pulling over any specific files I need if I ever need them.
Afterwards, I'll ...
- 21
0
votes
1
answer
166
views
If I move a file within the same drive or partition and then shred that file with a file shredder, would it still be recoverable?
If I move a file within the same drive or partition, suppose from one folder to another, and then shred that file with a file shredder, would it still be recoverable? Is there still some trace of that ...
- 1
0
votes
1
answer
210
views
Does data recovery of file depends on its extension?
Most free to use data recovery tools (Recuva, Easus, MiniTools) offers good recovery with known file extensions for picutres, videos and documents (.png, .xlsx etc). But lesser known file extensions, ...
- 103
3
votes
3
answers
3k
views
How to get PGP key passphrase out of Thunderbird?
I set up Thunderbird to use PGP a while ago, so I can sign and decrypt messages now. But I have forgotten my private passphrase for my private key, but since Thunderbird can do it anyway, it has it ...
- 89
0
votes
0
answers
184
views
Securely deleting Volume Shadow Service (VSS) in Windows 10
Suppose that VSS is enabled and snapshots exist. If I run a program to wipe the free disk space on my drive, would this delete the VSS snapshots? It might do since the program works by filling up the ...
-1
votes
1
answer
285
views
If SSDs cannot be securely wiped then why can't we recover files after crypto virus attack?
It is my understanding that SSDs do not allow user to overwrite any specific file completely (wear-leveling). So in case of ransomware attack such as CryptoLocker, doesn't that mean there is still, ...
- 684
1
vote
1
answer
520
views
Print sensitive info without leaving data on the printer
I'm not sure if there is already a question here about this because I can't find anything. But I'm wondering if there are any "safer" ways to print sensitive information without leaving ...
- 15.8k
-1
votes
1
answer
282
views
Can data be stored anywhere else on a MacBook besides the SSD?
Imagine the following scenario: There exist all kinds of information on my SSD. Now I take away the SSD of my MacBook Pro, replace it, and reboot. I should have a MacBook that is on factory settings, ...
1
vote
1
answer
203
views
How do I destroy references to wiped files?
I partially wiped my hard drive using the null-fill method through command prompt by
copying a 1 Gigabyte file filled with NULL over and over until I ran out of space.
After that I tried recovering ...
- 11
1
vote
0
answers
146
views
How Can I Backup App Data In Android/iOS Devices?
After my other post I'm looking over some other possibilities to do what I'm trying to do.
How To Recover End-To-End Encrypted Data After Losing Private Key?
If I save user data in server, in order to ...
- 257
4
votes
1
answer
2k
views
Data recovery from TRIMmed SSDs
Assuming a given SSD supports TRIM, and is on a physical bus that supports sending that command, and the connected computer is running an OS that is aware of TRIM:
If the drive is formatted, or has ...
- 143
0
votes
1
answer
143
views
DBAN under PC for an HDD using MAC OSx
A HDD with OSx installed removed from mac and used DBAN to wipe it under a PC. Does all the data is lost even if we put it back on a mac machine ?
- 11
1
vote
1
answer
345
views
Recover data after multiple wipe
I have a company laptop where I had many of my personal files and pictures. Now, I'm leaving for a new opportunity and I need to give them back the machine. So I used DBAN to wipe the hard drive.
I'm ...
- 11
6
votes
1
answer
792
views
What's the DRAT word of my SSD?
This article on forensicfocus.com says the following about Deterministic Read After TRIM (emphasis mine):
As a result, the data returned by SSD drives supporting DRAT as opposed to DZAT can be all ...
- 497
5
votes
1
answer
2k
views
Does formatting an SSD securely delete all data?
This article on thomas-krenn.com states:
Because an ATA trim will be performed by NTFS with Windows 7 or when formatting using Ext4 from mke2fs 1.41.10 or XFS from xfsprogs 3.1.0, the secure erase ...
- 497
0
votes
3
answers
1k
views
How many overwrites make a drive undesirable?
I wanted to wipe free disk space of my PC, as I had accidentally deleted confidential data permanently without securely deleting them. So wiping the entire free disk seems to be the only option now.
I ...
- 339
33
votes
7
answers
9k
views
Is there any hope of getting my pictures back after an iPhone factory reset some day in the future?
Four months ago I lost all my data after an iTunes update automatically restored my phone to factory defaults. I lost all the pictures of my newborn.
I understand that when you do a factory reset the ...
- 341
1
vote
1
answer
215
views
Can I recover files that I had on windows from a SSD that I converted to apfs (mac) and which method or tool to use? [closed]
I had some files that I want to recover from windows, but I formatted the ssd drive to macos (apfs)? Is there a tool or method to recover those files?
- 11
1
vote
2
answers
2k
views
Is a BIOS password enough to prevent someone from hacking into my laptop if they have physical access?
Would my laptop be secure against physical access if I set up a bios password and full disk encryption ?
If not then is there any way to secure your laptop from someone with physical access?
How hard ...
- 261
0
votes
2
answers
1k
views
How to secure file delete/wipe on mobile phones?
With old HDD to secure delete a file you need to use Gutmann standard, but with new HDD you can use only 1 pass overwrite
I'm not sure what hard drives mobile phones use and don't know how many passes ...
- 1
2
votes
1
answer
1k
views
I snapped my micro SD card into 8 pieces before throwing it away. Should I be worried that someone can get my data?
The card was a 16gb SanDisk micro SD card (monolithic).
user242798
0
votes
0
answers
144
views
Destroying data on storage drives via overwrite methods really doesn't work?
I'm going to sell a computer hard drive on the Internet, it's a 500GB SATA hard drive, I really used it 3 or 2 years ago, I never used it again, I used about 20 or 40% of the space.
I have read about ...
- 249
1
vote
1
answer
2k
views
Can deleted snapchat messages be recovered? [closed]
If there are chats that have been deleted, is there a way to recover these with any recovery tools, or are they gone forever?
- 31
39
votes
7
answers
11k
views
At what point is deleted data irrecoverable?
From reading around on the internet I get the impression that barring physical damage, deleted data can be always be recovered using sophisticated digital forensics.
For this reason the advice is ...
- 407
1
vote
0
answers
303
views
Secure deletion on Android
My understanding is if I delete photo001.jpg, this deletes the index and assigns it to the free space to be overwritten. So this brings me onto my next scenarios.
If I have a device capable of 8gb ...
