Dan Farmer and Wietse Venema, the authors of the book "Forensic
Discovery" wrote in chapter 7.2
(http://www.porcupine.org/forensics/forensic-discovery/chapter7.html)
about an investigation using a electron-microscope to find back traces
of old information on magnetic media by searching for the side-track
in the magnetic media. The references to this investigations are
mentioned in the chapter.

Besides this, i can recommend everybody to read this book, it's very
usefull, allthough mostly pointed to unix-machines.

Bart

On 10/31/06, Mike Peppard <mpeppard (at) impole (dot) com [email concealed]> wrote:
> Formatting isn't overwriting. A format overwrites the files headers,
> just like a "deletion", but only overwrites a small random amount of the
> data as a test. Depending on which format you use, windows97, bsd etc 57
> formats might or might not be recoverable. I don't know the article he's
> looking for, but it might be interesting if someone found it.
>
> -Mike
>
> Simson Garfinkel wrote:
> > I think that the article you are referring to was my article in which
> > I recovered data from 150+ hard drives purchased on eBay. But the data
> > was recovered with standard forensic tools.
> >
> > There is no publicly available evidence that overwritten data has ever
> > been recovered from a hard drive that was manufactured after 1995.
> >
> > -Simson
> >
> >
> >
> > On Oct 24, 2006, at 5:12 PM, michael (at) impactonline (dot) com [email concealed] wrote:
> >
> >> I am looking for an article I read sometime between 2002 and 2005.
> >> The content discussed how a research lab (maybe MIT or another large
> >> tech university) was able to recover data from a hard drive after
> >> over 50 formats (or it may have been data overwrites or even a
> >> combination of both) (I seem to remember the key number as 57
> >> "deletion" operations). I think the article mentioned the use of a
> >> scanning electron microscope, magnetic force scanning, or something
> >> similar or more high-tech. This might have been published to a tech
> >> Web news site or a tech e-mail newsletter. I've searched for hours
> >> and I can't seem to locate it again.
> >>
> >> In my search I've come across numerous papers and articles about how
> >> this recovery concept is not possible. So, it may have been a figment
> >> of my imagination, a hoax, or misleading news reporting.
> >>
> >> In any case, I really only need to hear from those of you who know
> >> the location of this specific article rather than rebutals to the
> >> possibility of the topic.
> >>
> >> I appreciate any assistance provided.
> >> - James Michael Stewart
> >>
> >
> >
> >
>

[ reply ]