RE: Interesting One

["Rory Savage" <rsavage () nandomedia com>]

Yeah Norton disk edit (disk doctor) allowed you to do this
back in Dos 4.0 :)


-----Original Message-----
From: Michael Cunningham [mailto:crayola () optonline net]
Sent: Tuesday, October 29, 2002 2:43 PM
To: Dave Adams; security-basics () security-focus com
Subject: RE: Interesting One



> Anyway, to get to the point, the guy that came to see me said that their
> forensics guys could read data off a hard drive that had been written
> over
> up to thirty times. I find this very hard to believe and told him I
> thought
> he was mistaken but the guy was adamant that it could be done.

Yes, it can be done.. it would cost about 100k per drive and the ability to
access an electron scanning microscope. At 30 times I highly doubt they
could recover anything of any value anyway. Using most commercially
available products like "Encase", you can recover files that have been
deleted, but not overwritten. Once the data is overwritten you are getting
into using tools which are not available to the general public
as far as I am aware.

Mike