Questions tagged [data-recovery]

For questions generally relating to recovery of "plain" data from digital storage, when that storage has been damaged or the credentials securing it are lost.

Data recovery is usually required in one of two cases:

  • Data was stored in a persistent mechanism such as a magnetic medium or flash memory, and that storage media has become damaged so that it cannot be read normally.

  • Data was stored in an obfuscated state, such as having been encrypted, and the key or credentials needed to recover the data have been lost.

In IT Security, questions asked are usually concerned with the second reason; recovery of data from an encrypted or hashed state (questions relating to recovery of data from damaged storage are usually asked on the Super User or Server Fault SE sites). This goal is usually frustrated by the very purpose of such methods; to make it infeasibly difficult to obtain the "plaintext" from the "ciphertext" or "hash".

Some common data encryption systems, especially those used to protect user accounts, have some sort of recovery option built in. This "back door" is designed to allow an administrator an alternate way to retrieve the data using their own credentials or other high-level secrets. However, many systems that place a primary emphasis on account or data security, provide only one efficient way to retrieve the data; know the password. Without a "back door", administrators or other "white hats" attempting to get the data for innocent purposes are limited to using the same "attacks" that someone with nefarious goals would have: "brute-force" cracking, or any documented attacks on the specific encryption scheme used by the system.

186 questions
0
votes
1 answer

Can someone bypass/recover/access data to Hard-Drive when Password Protected?

I've decided to designate a separate topic to this question ( even though I've mentioned this in topic: Best practice to secure hard-drive of computer(laptop) in case of Stealing ^ Loss ^ Unauthorized access? ), so this question is not duplicate. If…
T.Todua
  • 2,677
  • 4
  • 19
  • 28
0
votes
1 answer

Recover corrupted password protected Zip

Good evening. I have a password protected zip archive (Zip 2.0 CryptoZip) with a .txt file with sensitive info inside. The problem is that I can't extract it. 7Zip:"Data error : Wrong password?" WinRar:"CRC failed in the encrypted file. Corrupt…
0
votes
1 answer

Can file recovery tools recover deleted small files from SSD drive's NTFS Master File Table?

According to this page and site, small files are kept in Master File Table when filesystem is NTFS. Let's assume that computer is using Windows 10 and a SSD drive with TRIM support. If a user manually deletes a file smaller than 1kb from ssd will…
ccccc1cc
  • 11
  • 3
0
votes
0 answers

What is the method police use to recover deleted data from phone memory?

I am writing a story that involves a cellphone being recovered at a crime scene. The police go through it and find all the non-deleted files and continue until a they do something to obtain the data that was recently deleted. I want to know how they…
0
votes
0 answers

Url Storage, History & Personal Data

Just Curious to Know, Where my information is being stored and how long its kept for I'm running the latest version of windows 10, my main Browser being firefox developer edition 68. I clear my history regularly, as it clogs up memory and is…
Ryan Stone
  • 101
  • 2
0
votes
0 answers

Does renaming and emptying all the content of a file before deletion make it unrecoverable?

When I delete a file, I rename it to new.txt, open the file in a text editor, press Ctrl+A, Backspace, Ctrl+S to delete all the content and save it as an empty file and then Shift+Delete to permanently delete the file. Can someone now recover the…
user203050
0
votes
0 answers

Recover deleted Windows volumes

I have been given an HDD image. I believe the image was taken with dd. I have ingested the file using Autopsy and can see there are 4 volumes, like so Volume 1 - Unallocated. I believe NOT securely deleted Volume 2 - NTFS / exFAT. Windows Vista,…
0
votes
3 answers

How to protect company sensitive data from being deleted by a user when data is on their computer?

There more than 300 computers and more than 400 users are available. We face two incidents recently when critical users(who has critical data) leave from company.We have deleted their data when they return their laptop or desktop PC. To help protect…
Infra
  • 650
  • 1
  • 6
  • 19
0
votes
1 answer

Recovering Data from a 1-Pass Zero'd Hard Disk Drive

I don't want to do this, but I'm wondering how easy it is to do? Or to put it another way, I'm wondering "is a 1-pass zero of a drive enough?" From what I understand, it's completely wiped from anyone that would try to recover data by connecting the…
l008com
  • 111
  • 4
0
votes
1 answer

What does the existence of this file indicate?

C:\Documents and Settings\Sarah\Recent\DSCN0275.JPG.lnk on a Microsoft Windows system, and use the xxd program to dump the contents of this file:
0
votes
1 answer

How to recover disk image from a smartphone in "bootloop" state?

I've been playing around on data recovery from devices and so far it worked well. Now I got this new situation that I don't know how to proceed in order to put my hands on the data. My old smartphone just crashed and entered in a bootloop. I…
Fnr
  • 206
  • 1
  • 6
0
votes
1 answer

lost key-files for encrypted files

I had encrypted a file on my computer but the computer got infected by a virus, so I reinstalled Windows on my computer. All my key-files have gone. Is there a way to recreate the lost key-files, as I know what the password was? Can I decrypt my…
0
votes
1 answer

Working from a USB

I have a Mac for my work laptop and I would like to work on my xCode project, I can't work on the laptop directly and save the file to computer due to fears that it could one day be recovered & be property of the company, but would it be possible to…
0
votes
1 answer

Does zeroing a file on Android work similar to a regular HDD?

On a regular PC hard drive, files aren't actually deleted, so they can still be recovered from the raw data on the drive. So there is the process called zeroing out a file when you delete it so that the chuck of binary space on the HDD is set to all…
ComputerWhiz
  • 21
  • 1
  • 3
0
votes
2 answers

Data recovery hardware need

In terms of data recovery, what is the actual technical need for dedicated hardware such as Atola, PC3000 or Deepspar? What are these devices doing that I cannot achieve using regular Hex/Digital Forensic methods? I am deeply worried about the…
geminus
  • 1
  • 1