>===== Original Message From John Daniele <[EMAIL PROTECTED]> ===== >Could you point me towards SOFTWARE (not STM equipment) that would be able >to recover data that had been OVERWRITTEN from a sector of a drive? >i.e. dd if=/dev/zero of=/dev/dsk/c0t0* >Read each physical sector of the drive and explain to me how meaningful >data is recovered from 00's using software recovery tools? >John Daniele
I think all-inclusive statements, such as that by John in an earlier post, that a one-time pass will make data "unrecoverable" with standard forensic recovery methods is simply wrong. It's not a matter of which software could - or couldn't. It's a matter of what you mean by "standard" forensic recovery methods. You did not make clear what you meant by "standard" methods. If you mean Norton or McAfee Undelete when you speak of "forensic" methods - well then, we're talking different ball parks. Standard "forensic recovery methods" by big city US Police Departments and the FBI include more in their arsenal than simple data recovery programs. I am sure (or assume) the true is in Canada as well. The USA Dept. Of Defense (as you know) has protocols that are acceptable --- a three-pass method, a seven-pass method, and then there's the Gutmann method, which is acceptable to anybody, except maybe the Marines - who must blow their old drives to bits! (Pardon the pun).....But a one-time pass? Not acceptable for true security. And what good does it do to call something "unrecoverable" and NOT take into account slack space? Again, it comes back to the term "standard" -- I think the definition may be different in Canada than the United States. - Mike Donovan
