> ...the guy that came to see me said that their > forensics guys could read data off a hard drive that had been written over > up to thirty times. I find this very hard to believe and told him I thought > he was mistaken but the guy was adamant that it could be done. My question > is, does anyone have any views on this, or, can anyone point me to a source > of information where I can get the facts on exactly how much data can be > retrieved off a hard drive and under what conditions etc etc.
Theoretically it is simple to retrieve overwritten data, particularly if it has been overwritten just one time. In practice, however, the data comes back one agonizing bit at a time and with a high error rate. Send the guy a disk that has been overwritten just once and ask him to retrieve the original data. Even if he has the ability to do this, he probably won't be inclined to give you a free sample. The process is just too labor intensive. Jack JD Crone Associates Computer Forensics
