[ale] Drive recovery

[Michael B. Trausch]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: RIPEMD160

tfreeman at intel.digichem.net wrote:
>
> About 10 years or more ago, I used one of those drive recovery services. 
> Yes, expensive, but not all that expensive. Seems like we had a discusion 
> of sorts along the lines of secure deletion a year or two ago. I _still_ 
> like the idea of floating the platters in HF, although there are 
> hazzardous waste issues.
> 

Many of the drive recovery services are capable of much more then you or
I can do with any disk or disk controller available to us within any
sort of reasonable cost range.  For example, some services can read data
that was written and overwritten, and overwritten yet again, by looking
for "ghosts" of data and reassembling it.  Crazy, but (remotely) possible.

However, data recovery *is* possible if it hasn't been overwritten, it
just takes someone with the know-how and the patience.  There is only so
much that *I* can do, for example, and much of it requires that I know
in a fairly detailed fashion, exactly what I'm looking for and what
filesystem revision was holding the data so that I can find what I'm
looking for.  If I lost an OpenOffice document, for example, because I
reformatted a system and it was FAT in the past and the new format is
FAT, there's a good chance I can recover it by looking at the raw disk
itself, and attempting to find portions of the disk that start with the
"magic" number that identifies the file format.  In the case of FATxx,
metadata is in the directory tree, and the file itself will start at the
beginning of a cluster, so knowing information about the filesystem
helps to narrow down the search.

Even then, however, without the FAT image from the old drive, it can be
very hard to find the file itself because it may be fragmented along the
disk, and that makes it harder to find.

	- Mike

- --
Michael B. Trausch                                     fd0man at gmail.com
Web: http://fd0man.theunixplace.com/        Jabber: mtrausch at jabber.com
Phone: +1-(678)-522-7934                  FAX (US Only): 1-866-806-4647
=======================================================================
  Do you have PGP or GPG?  Key at pgp.mit.edu, Please Encrypt E-Mail!

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFCp2w8PXInbkqM7nwRA/z+AJ9/n3ZtHEQWpvWDdLfX8Yy13/pZbgCgkSWz
2QmdZ48WD2rzjhhTWqnniAM=
=d4SM
-----END PGP SIGNATURE-----