I believe the DOD level is 7 overwrites before the data is deemed unrecoverable. Bear in mind however that the DOD practise is to burn the hard drive as part of the disposal procedure.
I used @Stake autopsy and found it very quick and easy to use for recovery of deleted files. BackByte is another good tool but not free like Autopsy. The 30 overwrites and still getting data I don't believe however. I would imagine the disk was used again about 30 times but the recovered data was on a section of disk that had not been reused. I don't rule out that it can be done but not by anything on the market. If you are really unsure try posting your query to the people at Vogon. www.vogon.co.uk They are the best at this stuff bar none. Read some of their news stories for just how realistic computer forensics is. Trevor Cushen Sysnet Ltd www.sysnet.ie Tel: +353 1 2983000 Fax: +353 1 2960499 -----Original Message----- From: Michael Cunningham [mailto:crayola@;optonline.net] Sent: 29 October 2002 19:43 To: Dave Adams; [EMAIL PROTECTED] Subject: RE: Interesting One > Anyway, to get to the point, the guy that came to see me said that > their forensics guys could read data off a hard drive that had been > written over up to thirty times. I find this very hard to believe and > told him I thought > he was mistaken but the guy was adamant that it could be done. Yes, it can be done.. it would cost about 100k per drive and the ability to access an electron scanning microscope. At 30 times I highly doubt they could recover anything of any value anyway. Using most commercially available products like "Encase", you can recover files that have been deleted, but not overwritten. Once the data is overwritten you are getting into using tools which are not available to the general public as far as I am aware. Mike ************************************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this message in error please notify SYSNET Ltd., at telephone no: +353-1-2983000 or [EMAIL PROTECTED] **************************************************************************************
