Questions tagged [data-recovery]

For questions generally relating to recovery of "plain" data from digital storage, when that storage has been damaged or the credentials securing it are lost.

Data recovery is usually required in one of two cases:

  • Data was stored in a persistent mechanism such as a magnetic medium or flash memory, and that storage media has become damaged so that it cannot be read normally.

  • Data was stored in an obfuscated state, such as having been encrypted, and the key or credentials needed to recover the data have been lost.

In IT Security, questions asked are usually concerned with the second reason; recovery of data from an encrypted or hashed state (questions relating to recovery of data from damaged storage are usually asked on the Super User or Server Fault SE sites). This goal is usually frustrated by the very purpose of such methods; to make it infeasibly difficult to obtain the "plaintext" from the "ciphertext" or "hash".

Some common data encryption systems, especially those used to protect user accounts, have some sort of recovery option built in. This "back door" is designed to allow an administrator an alternate way to retrieve the data using their own credentials or other high-level secrets. However, many systems that place a primary emphasis on account or data security, provide only one efficient way to retrieve the data; know the password. Without a "back door", administrators or other "white hats" attempting to get the data for innocent purposes are limited to using the same "attacks" that someone with nefarious goals would have: "brute-force" cracking, or any documented attacks on the specific encryption scheme used by the system.

186 questions
0
votes
1 answer

Does full disk encryption securely remove data?

I was just catching up on best practices for securely erasing data from a Mac. At one point I remember reading: For SSD drives it is no longer recommended to fully write ones/zeroes/random bits on the disk. Use encryption instead. Now, I am thinking…
Dennis Jaheruddin
  • 1,715
  • 11
  • 17
0
votes
0 answers

When the phone breaks and I regret encryption

I believe most new Android phones have full encryption enabled by default, so even if I just download some PDF weather report from the internet, it will sit encrypted on my phone's SSD. Now, suppose my phone breaks and loses power, such that just…
bobuhito
  • 230
  • 1
  • 8
0
votes
0 answers

Encrypting file = Overwriting file?

When thinking of encrypting a file (also how I implemented it in a program of mine), I think of getting the data of a file, encrypting it, and writing it back into the file (overwriting the file). But actually, is that the usual way of encrypting a…
Dahlin
  • 1
0
votes
1 answer

If I move a file within the same drive or partition and then shred that file with a file shredder, would it still be recoverable?

If I move a file within the same drive or partition, suppose from one folder to another, and then shred that file with a file shredder, would it still be recoverable? Is there still some trace of that file left in the previous location it was…
Musa
  • 1
  • 1
0
votes
1 answer

Does data recovery of file depends on its extension?

Most free to use data recovery tools (Recuva, Easus, MiniTools) offers good recovery with known file extensions for picutres, videos and documents (.png, .xlsx etc). But lesser known file extensions, are having some unusual names, with missing…
msinfo
  • 103
  • 2
0
votes
0 answers

Securely deleting Volume Shadow Service (VSS) in Windows 10

Suppose that VSS is enabled and snapshots exist. If I run a program to wipe the free disk space on my drive, would this delete the VSS snapshots? It might do since the program works by filling up the drive by creating a growing file, and once the…
0
votes
1 answer

DBAN under PC for an HDD using MAC OSx

A HDD with OSx installed removed from mac and used DBAN to wipe it under a PC. Does all the data is lost even if we put it back on a mac machine ?
August
  • 11
  • 2
0
votes
3 answers

How many overwrites make a drive undesirable?

I wanted to wipe free disk space of my PC, as I had accidentally deleted confidential data permanently without securely deleting them. So wiping the entire free disk seems to be the only option now. I know that generally 1 overwrite is enough and no…
Jay Shah
  • 339
  • 2
  • 4
  • 10
0
votes
1 answer

Can I recover files that I had on windows from a SSD that I converted to apfs (mac) and which method or tool to use?

I had some files that I want to recover from windows, but I formatted the ssd drive to macos (apfs)? Is there a tool or method to recover those files?
George
  • 1
0
votes
2 answers

How to secure file delete/wipe on mobile phones?

With old HDD to secure delete a file you need to use Gutmann standard, but with new HDD you can use only 1 pass overwrite I'm not sure what hard drives mobile phones use and don't know how many passes will be okay for secure deleting files on…
u u
  • 1
0
votes
0 answers

Destroying data on storage drives via overwrite methods really doesn't work?

I'm going to sell a computer hard drive on the Internet, it's a 500GB SATA hard drive, I really used it 3 or 2 years ago, I never used it again, I used about 20 or 40% of the space. I have read about various tools and used Hardwipe, first I deleted…
Julián
  • 249
  • 1
  • 4
  • 10
0
votes
0 answers

Is it possible to delete all traces and files on a mac?

Is it possible to delete all traces and files on a mac, so no one can recover files and there will be no traces at all for this files or any activity?
0
votes
2 answers

Does software based file recovey solutions have the same results on real physical device vs dd image file?

I have a flash drive and I want to recover some files from it. Can I take a dd image of the device and perform the recovery operation on dd image instead? Does it have the same results when performing recovery using software on physical flash drive?
Rembo
  • 17
  • 4
0
votes
2 answers

How to trace the remains of deleted files?

My question is not about the recovery of deleted file, nor is it about the complete wiping of a disk; it's to ask about the traces deleted files leave, and how I could possibly 'see' them or visualise them? I'm very much interested in the right to…
0
votes
0 answers

Secure Erase for IOS

The topics about secure erase for IOS on this site is a bit dated. Technology has definitely changed, including the tools used for forensics. Are there any secure erase softwares or techniques that someone could use to prevent any data recovery?…
Cudi
  • 1
  • 1