Questions tagged [data-recovery]

For questions generally relating to recovery of "plain" data from digital storage, when that storage has been damaged or the credentials securing it are lost.

Data recovery is usually required in one of two cases:

  • Data was stored in a persistent mechanism such as a magnetic medium or flash memory, and that storage media has become damaged so that it cannot be read normally.

  • Data was stored in an obfuscated state, such as having been encrypted, and the key or credentials needed to recover the data have been lost.

In IT Security, questions asked are usually concerned with the second reason; recovery of data from an encrypted or hashed state (questions relating to recovery of data from damaged storage are usually asked on the Super User or Server Fault SE sites). This goal is usually frustrated by the very purpose of such methods; to make it infeasibly difficult to obtain the "plaintext" from the "ciphertext" or "hash".

Some common data encryption systems, especially those used to protect user accounts, have some sort of recovery option built in. This "back door" is designed to allow an administrator an alternate way to retrieve the data using their own credentials or other high-level secrets. However, many systems that place a primary emphasis on account or data security, provide only one efficient way to retrieve the data; know the password. Without a "back door", administrators or other "white hats" attempting to get the data for innocent purposes are limited to using the same "attacks" that someone with nefarious goals would have: "brute-force" cracking, or any documented attacks on the specific encryption scheme used by the system.

186 questions
211
votes
10 answers

What should you do if you catch encryption ransomware mid-operation?

You boot up your computer one day and while using it you notice that your drive is unusually busy. You check the System Monitor and notice that an unknown process is using the CPU and both reading and writing a lot to the drive. You immediately do a…
Fiksdal
  • 3,076
  • 3
  • 18
  • 29
67
votes
7 answers

Can RAM retain data after removal?

Is it possible for RAM to retain any data after power is removed? I don't mean within a few minutes such as cold boot Attacks but rather 24 hours plus. Working with classified systems the policy always seems to treat RAM the same as disks and must…
MattP
  • 773
  • 1
  • 6
  • 7
47
votes
3 answers

Should we keep logs forever to investigate past data breaches?

Listening to the Secure code lessons from Have I Been Pwned made me really think about logging. It appears that in the real world a lot of data breaches are discovered long after they happened which makes the investigation and recovery much more…
alecxe
  • 1,515
  • 5
  • 19
  • 34
39
votes
7 answers

At what point is deleted data irrecoverable?

From reading around on the internet I get the impression that barring physical damage, deleted data can be always be recovered using sophisticated digital forensics. For this reason the advice is that you should encrypt your data. So at what point…
Yoshi
  • 407
  • 4
  • 3
33
votes
6 answers

Is there any hope of getting my pictures back after an iPhone factory reset some day in the future?

Four months ago I lost all my data after an iTunes update automatically restored my phone to factory defaults. I lost all the pictures of my newborn. I understand that when you do a factory reset the decryption key is discarded so the data is…
Vivi
  • 341
  • 3
  • 7
23
votes
3 answers

What happens when a TPM chip breaks or fails?

I read that a TPM (Trusted Platform Module) has some sort of burnt in key that it uses, along with the password you provide, to encrypt your data. The point is that you cannot decrypt your Hard Disk without the TPM (please correct me if I'm wrong).…
Fresco
  • 333
  • 1
  • 2
  • 4
19
votes
4 answers

Why is writing zeros (or random data) over a hard drive used when writing all ones is more beneficial?

As far as I know, in order to securely delete the hard drive's contents, one should fill it with zeroes or, for added security and harder recoverability, random data first and then all zeroes. In order to get rid of all the data wouldn't be simpler…
Serban Razvan
  • 309
  • 2
  • 5
19
votes
4 answers

Securely erasing personal data from Android phone before selling

I have just sold online my old Nexus 5 (Android Lolipop) and need to post it tomorrow morning. I would like to make sure the new owner can't access my files. What should I do?
user69377
17
votes
2 answers

Is Data Remanence a Myth?

Possible Duplicate: Why is writing zeros (or random data) over a hard drive multiple times better than just doing it once? Multiple overwrites have often been discussed as a secure way of erasing data. Some people say that the only way to…
lynks
  • 10,636
  • 5
  • 29
  • 54
17
votes
3 answers

Is there a real-world example of SSD data recovery?

Secure data deletion is known to be more complicated and elusive on a solid-state drive than for a regular hard drive. For instance, the logical block mapping on the SSD's flash translation layer makes it impossible to reliably overwrite specific…
Arminius
  • 43,922
  • 13
  • 140
  • 136
13
votes
2 answers

Recovery of EEPROM data after bulk erase operation

I am aware of research which shows that single (or sometimes double) random overwrites on a magnetic hard drive is enough to ensure data is not recoverable, but is there any research into the recovery of data stored in an EEPROM after the…
forest
  • 64,616
  • 20
  • 206
  • 257
11
votes
2 answers

Could data be recovered from cut magnetic stripe card?

I know all systems accepting magnetic stripe cards (card readers, access systems, etc) would reject a cut one. But could and expert still get the data that was on it? For the record, I mean "cut in half", as often stated in bank instructions.
Ludwik
  • 221
  • 1
  • 6
10
votes
3 answers

How to erase as much as possible an SSD without ATA Secure Erase?

The question is almost completely answered. However, more details are still needed. See Update 2 down here. I've learnt that the ATA Secure Erase is uncorrectly implemented in SSDs (sources are down here), but I'm still willing to find a way to…
X.LINK
  • 151
  • 1
  • 6
10
votes
2 answers

Magnet to wipe HDD

This question is for HDD, not SDD. Would a Neodymium magnet like this one be strong enough to wipe the contents of a hard disk drive? How long would such an act take to destroy any data so it's not recoverable? Would it be possible to format and…
k1308517
  • 1,272
  • 14
  • 27
9
votes
4 answers

How does forensic software detect deleted files

How does forensic software detect deleted files? When a file is deleted, the pointer from MFT in NTFS system is deleted and the file is no longer accessible from the OS. If our disk is fragmented how can software like Autopsy or Recuva detect where…
user46850
  • 199
  • 3
  • 9
1
2 3
12 13