On Tue, Oct 31, 2006 at 01:27:29PM -0000, [EMAIL PROTECTED] wrote: > I agree. It is more of a myth then reality. Physically, the magnetic > fluxes have been changed when the data is overwritten. Then, only the new > data patterns will be read. Although it may seem possible, I have never > seen or heard of it being done successfully. All of the data recovery > companies I've seen always claim some form of physical, logical, or > deleted data recovery and not specifically overwritten data recovery.
One thing which might be of interest here: in the old days, with smaller drives and older technology, data was stored on the drive in a much more discrete fashion: "there's a 1" and "there's a 0" (as seen by the spook-type tools). It may well have been straightforward - but tedious - to get back overwritten data for these kinds of devices. But modern drives operating in the hundreds of gigabytes use much, much more advanced magnetic mechanisms that do things like overlapping of bits which require statistical methods to recover. This is to get back *their own* bits which have not been overwritten. ECC is at the center of this universe here. I once talked with a Western Digital firmware engineer, who told me that the push for higher/cheaper capacity and performance has required acts of magnetics that are just on the edge of violating the laws of physics. It would be wise to check the publication date and reported drive capacity before extrapolating from previous efforts to modern products. Steve -- Stephen J Friedl | Security Consultant | UNIX Wizard | +1 714 544-6561 www.unixwiz.net | Tustin, Calif. USA | Microsoft MVP | [EMAIL PROTECTED]
