Recover Data after multi-pass wipe/zeros?

D

dabomb

2[H]4U
Joined
Apr 12, 2001
Messages
2,393
So I have several SATA hard drives that I wiped last year with an older version of BootIT NG. I choose to write 0s and do a bunch of passes (15 maybe)? There is no OS on the drives just data and they haven't been touched since. The main drive I want to recover is 2TB.

Does anyone know of a utility that could possibly recover the data after such an extensive format? I've only tried easeus so far, it took all day on the 2TB and found nothing at all. Thank you.
 
This is not even remotely possible by software.

It is theoretically possible in a lab with expensive equipment.
 
You need some kind of device that can take a "capture" of each cluster's electromagnetic power on each platter/side. Think a very high res scanner that detects magnetic power instead of light. Once that is done then it would need to be put in some kind of image and the software/hardware doing this would have to know how the drive stored data, ex: parallel across all platters or in some other way. Not to mention a way to line it all up...

Since you just wrote 0's in theory you simply reduced the power of all clusters so they all went down linearly. However, each pass brought the "high" ones closer and closer to zero.

At this point I think only the NSA would be able to do it, even recovery companies would not have the equipment and technology to do it and if they did it would probably cost A LOT.

Consider the data gone.
 
I've only heard of this kind of recovery being done on very old (MFM, <1GB, probably <100MB) harddrives.

If anyone has documentation on it being done on newer generations of drives, I'd be curious to see it.
 
You could request a copy of your data from the NSA's servers. Otherwise, it's gone.
 
15 Passes of write zeros? I don't think even the most expensive deep level scanners in a lab would find the data. Since I think even 5 passes would already be impossible to recover something.
 
If it was another country's nuclear football, you *might* be able to persuade the NSA to spend millions of dollars to recover them. Otherwise... let it go man, it's gone.
 
One pass, 15 passes, it doesn't make any difference.

The way those scanners work, is by how long the data you wanted to recover was on the disk for, vs how long the new state is. So if you wiped the disk, and a week later wanted to recover, it would be more likely, but after a year? likely pushing it.
 
It's gone for good. Even if a data recovery lab was hired (not cheap), they would only likely be able to pull useless data fragments, and even that would be miraculous.
 
dabomb said:
So I have several SATA hard drives that I wiped last year with an older version of BootIT NG. I choose to write 0s and do a bunch of passes (15 maybe)? There is no OS on the drives just data and they haven't been touched since. The main drive I want to recover is 2TB.

Does anyone know of a utility that could possibly recover the data after such an extensive format? I've only tried easeus so far, it took all day on the 2TB and found nothing at all. Thank you.
Click to expand...

I set my car on fire. Now I want my car back. Does anyone know a way to get it back? Thank you.
 
DPI said:
I set my car on fire. Now I want my car back. Does anyone know a way to get it back? Thank you.
Click to expand...

Fire is just a chemical reaction. Just need to reverse it and you get your car back. :p

"Firemen hate him!"
 
Funny, considering how simple his wiping method was in comparison to the sophisticated methods used by software like DBAN.

The replies above would suggest that such methods are largely a waste of time if the simple overwriting with zeroes can so thoroughly render a drive unrecoverable that only the NSA would have any chance of reading it.
 
Well, the DOD in the 90's said, that multipass wipes, on modern disks, is not needed, due to the bit density, making a single wipe, as effective as a previous multipass wipe.

The multipass wipe was previously required, due to head alignment over the tracks. But modern disks, the desity is high enough, that it doesn't drift off track enough to worry about, so a single wipe was enough.

Not sure where you got NSA only, it's possible, it's defently not easy, and it's going require a cleanroom. The NSA defently would not bother doing this, there are easier ways to get the info, for them.
 
You must log in or register to reply here.
Back
Top