Security Basics mailing list archives

RE: Interesting One


From: Michael Cunningham <crayola () optonline net>
Date: Tue, 29 Oct 2002 14:42:53 -0500


Anyway, to get to the point, the guy that came to see me said that their
forensics guys could read data off a hard drive that had been written
over
up to thirty times. I find this very hard to believe and told him I
thought
he was mistaken but the guy was adamant that it could be done.

Yes, it can be done.. it would cost about 100k per drive and the ability to
access an electron scanning microscope. At 30 times I highly doubt they
could recover anything of any value anyway. Using most commercially
available products like "Encase", you can recover files that have been
deleted, but not overwritten. Once the data is overwritten you are getting
into using tools which are not available to the general public
as far as I am aware.

Mike


Current thread: