Re: Interesting One

[Jack Crone <jcrone () jdca com>]

> ...the guy that came to see me said that their
> forensics guys could read data off a hard drive that had been written
over
> up to thirty times. I find this very hard to believe and told him I
thought
> he was mistaken but the guy was adamant that it could be done. My
question
> is, does anyone have any views on this, or, can anyone point me to a
source
> of information where I can get the facts on exactly how much data can be
> retrieved off a hard drive and under what conditions etc etc.

Theoretically it is simple to retrieve overwritten data, particularly if it
has been overwritten just one time. In practice, however, the data comes
back one agonizing bit at a time and with a high error rate. Send the guy a
disk that has been overwritten just once and ask him to retrieve the
original data. Even if he has the ability to do this, he probably won't be
inclined to give you a free sample. The process is just too labor
intensive.

Jack

JD Crone Associates
Computer Forensics