Questions tagged [data-recovery]

For questions generally relating to recovery of "plain" data from digital storage, when that storage has been damaged or the credentials securing it are lost.

Data recovery is usually required in one of two cases:

  • Data was stored in a persistent mechanism such as a magnetic medium or flash memory, and that storage media has become damaged so that it cannot be read normally.

  • Data was stored in an obfuscated state, such as having been encrypted, and the key or credentials needed to recover the data have been lost.

In IT Security, questions asked are usually concerned with the second reason; recovery of data from an encrypted or hashed state (questions relating to recovery of data from damaged storage are usually asked on the Super User or Server Fault SE sites). This goal is usually frustrated by the very purpose of such methods; to make it infeasibly difficult to obtain the "plaintext" from the "ciphertext" or "hash".

Some common data encryption systems, especially those used to protect user accounts, have some sort of recovery option built in. This "back door" is designed to allow an administrator an alternate way to retrieve the data using their own credentials or other high-level secrets. However, many systems that place a primary emphasis on account or data security, provide only one efficient way to retrieve the data; know the password. Without a "back door", administrators or other "white hats" attempting to get the data for innocent purposes are limited to using the same "attacks" that someone with nefarious goals would have: "brute-force" cracking, or any documented attacks on the specific encryption scheme used by the system.

186 questions
9
votes
3 answers

Is filling up the empty space in a disk with any data enough measure against file recovery

If I have an important data in a disk (flash, SSD or HDD) and I deleted them, I know it is easy to recover these deleted data (even by using free software like recuva. Now if I fill this disk with any data, let's say a large movie file or so until…
Nean Der Thal
  • 587
  • 2
  • 5
  • 12
9
votes
8 answers

Overwriting hard drive to securely delete a file?

I am working on a computer that I am not allowed to install new software on. It does not have secure delete software installed. Suppose I have a file (or files) that are sensitive that I'd like to delete and prevent (or make it very difficult) to…
Drew
  • 107
  • 1
  • 1
  • 2
9
votes
1 answer

Reversible, recoverable user data encryption scheme

From this earlier question, I have a general need to obfuscate a set of third-party credentials stored in a user account, which are then used in an internal Winforms software client. The scheme from the accepted answer is below: Password Creation…
KeithS
  • 6,678
  • 1
  • 22
  • 38
8
votes
1 answer

Do I need to use the cipher command with a newer SSD to erase files?

I've used Eraser in the past, and recently became aware of the cipher command in Windows 8. Specifically, with the /w flag: /w removes data from portions of the volume it can access and have not been allocated to files or directories. It does not…
Eric
  • 181
  • 1
  • 5
8
votes
1 answer

How isolated are files on a VirtualBox virtual machine from the host filesystem?

When transferring ownership of a computer from one party to another, it's advisable to perform steps to clean out personal data from the hard drive. Depending on needs, the type of data, and/or level of paranoia, this can consist of anything from a…
jmort253
  • 181
  • 6
8
votes
2 answers

GPG/GnuPG secret key passphrase recovery and/or .gnupg/private-keys-v1.d/ file format

Bad news: I forgot a GnuPG secret key passphrase. Good news: I do know the words it is constructed of. So, I can easily use john or similar to recover (too many combinations to do it manually, though). Problem: The secret key is not in the…
Ned64
  • 245
  • 1
  • 2
  • 13
8
votes
1 answer

Cases where DBAN has won

Are there any real life cases where software such as DBAN (to securely erase disks) has beaten government/law enforcement agencies? I found this online which lists each time encryption has beaten investigators, but nothing for secure…
k1308517
  • 1,272
  • 14
  • 27
7
votes
5 answers

How to detect self destructing emails? How to prevent from self destruction?

Recently I came across a gmail extension for Chrome browsers which claims to send self destructive emails. I tested by sending self destructive emails to my email account and it works fine Now my questions are few: Is there any way to determine if…
BlueBerry - Vignesh4303
  • 5,107
  • 13
  • 34
  • 63
7
votes
1 answer

What's the best duration for storing e-mail?

We’ve all become so accustomed to using email in our daily personal and working lives that we really don’t give a whole lot of thought to it. It’s the fastest way to communicate with others in the course of the day, and the emails we send and…
Lamya
  • 103
  • 8
7
votes
2 answers

What type of data can be recovered from the swap file / page file and thumbs file

This question follows on from a previously posted question on recovery of data from a wiped disk. I have been informed that no files have been found on the computer on the hard disk or in the deleted files (unallocated space / slack). Therefore if…
James009
  • 111
  • 1
  • 7
7
votes
1 answer

Is GNU shred relevant for SSDs?

The Gutmann method, which apparently is used by GNU shred, has appeared in 1996, which focused on finding random 5 to 31 patterns and taking into account particular magnetic encoding. Considering that now we have SSDs, I'm guessing that Gutmann…
7
votes
2 answers

How useful are file shredders for nand flash memory (ios memory)

Flash memory uses wear levelling (changing the physical location of data stored) to maximize memory life. Most flash memory has some "spare" space that is unreported that allows it to replace bad parts as they wear out. This means that there may…
user119003
7
votes
2 answers

Is tails os susceptible to a cold boot attack?

I've looked at the documentation and it mentions that upon shutdown the data residing in the ram is overwritten, however it doesn't go into any detail on how it does this. Documentation link:…
Dane
  • 233
  • 1
  • 8
6
votes
2 answers

Data Abstraction Layers in Forensic Imaging

I am a bit confused from various sources about the abstraction level and layers that a file resides in forensic imaging. I have found two slightly different explanations: The first one includes a) Physical Layer (sectors,cylinders etc.) b) Data…
5
votes
1 answer

Does formatting an SSD securely delete all data?

This article on thomas-krenn.com states: Because an ATA trim will be performed by NTFS with Windows 7 or when formatting using Ext4 from mke2fs 1.41.10 or XFS from xfsprogs 3.1.0, the secure erase procedure is no longer necessary [...]. From my…
Matthias Braun
  • 421
  • 3
  • 12
1
2
3
12 13