Questions tagged [data-recovery]

For questions generally relating to recovery of "plain" data from digital storage, when that storage has been damaged or the credentials securing it are lost.

Data recovery is usually required in one of two cases:

  • Data was stored in a persistent mechanism such as a magnetic medium or flash memory, and that storage media has become damaged so that it cannot be read normally.

  • Data was stored in an obfuscated state, such as having been encrypted, and the key or credentials needed to recover the data have been lost.

In IT Security, questions asked are usually concerned with the second reason; recovery of data from an encrypted or hashed state (questions relating to recovery of data from damaged storage are usually asked on the Super User or Server Fault SE sites). This goal is usually frustrated by the very purpose of such methods; to make it infeasibly difficult to obtain the "plaintext" from the "ciphertext" or "hash".

Some common data encryption systems, especially those used to protect user accounts, have some sort of recovery option built in. This "back door" is designed to allow an administrator an alternate way to retrieve the data using their own credentials or other high-level secrets. However, many systems that place a primary emphasis on account or data security, provide only one efficient way to retrieve the data; know the password. Without a "back door", administrators or other "white hats" attempting to get the data for innocent purposes are limited to using the same "attacks" that someone with nefarious goals would have: "brute-force" cracking, or any documented attacks on the specific encryption scheme used by the system.

186 questions
5
votes
2 answers

How important is it to delete disk partitions when wiping devices?

The command lsblk returns the following output that lists 4 partitions. sda 8:0 0 931.5G 0 disk ├─sda1 8:1 0 8M 0 part ├─sda2 8:2 0 40G 0 part / ├─sda3 8:3 0 883.8G 0 part /home └─sda4 8:4 0 7.7G 0 part…
Motivated
  • 1,493
  • 1
  • 14
  • 25
4
votes
2 answers

How to securely encrypt data with a public-private key encryption scheme, but also allow decryption if the private key is lost?

This question is a followup question to Storing plaintext passwords for cameras - Security concerns?. In that question, I posed what I thought was a simple question, which actually turned out to have various security holes. Thanks to the answers,…
Pimgd
  • 291
  • 1
  • 12
4
votes
4 answers

Can files deleted from a true crypt volume be recovered?

I have a True Crypt volume that's set as a file. When I mount the volume and delete a file within the container, windows asks if I'd like to send the file to the recycle bin. While the volume is mounted I see the file in the recycle bin but when it…
Julian
  • 133
  • 1
  • 2
  • 5
4
votes
1 answer

Is there any way to crack a Bitlocker drive?

We have disk drive that encrypt with BitLocker. My key is lost, and we haven't any backup of the data. Is there any way to hack or crack and recover our data?
saber tabatabaee yazdi
  • 1,038
  • 5
  • 16
  • 26
4
votes
1 answer

Data recovery from TRIMmed SSDs

Assuming a given SSD supports TRIM, and is on a physical bus that supports sending that command, and the connected computer is running an OS that is aware of TRIM: If the drive is formatted, or has had its files erased, will the data be…
craig65535
  • 143
  • 4
4
votes
1 answer

What's the DRAT word of my SSD?

This article on forensicfocus.com says the following about Deterministic Read After TRIM (emphasis mine): As a result, the data returned by SSD drives supporting DRAT as opposed to DZAT can be all zeroes or other words of data, or it could be the…
Matthias Braun
  • 421
  • 3
  • 12
4
votes
1 answer

Best strategy to recover running Macbook "modern" Pro ram

(Take a Macbook Pro 2017 Sierra 10.12.5 for example.) What I had done was I downloaded osxpmem-2.1.post4.zip (vouched by ponderthebits.com/.., itself by google.com/..), unzipped it with finder, created a folder Memory_Captures and: sudo chown -R…
Pacerier
  • 3,253
  • 6
  • 34
  • 61
4
votes
2 answers

Terminated user did something to corrupt OS and data on turned in laptop

I am a senior systems engineer at a mid-sized ASP/hosting company. 9 or 10 months ago we had a large lay off which included our company's marketing director. None of our upper management thought to take the time to look through his emails or laptop…
user165597
  • 41
  • 1
4
votes
2 answers

How are SSDs different from HDDs from the privacy point of view?

How are SSDs different from HDDs from the privacy point of view? Is it easier or harder to recover traces of deleted and/or wiped (overwritten) files from an SSD than from a HDD?
Ivan
  • 351
  • 2
  • 8
3
votes
1 answer

How can I recover a GPG private key from a PC which has died?

Long story short - PC with kleopatra processor died, and I only have a backup of my public key. I've gone into the HDD and tried to re-jig kleopatra in the hope it would remember everything for me on another machine but that hasn't gone well... Do I…
cam
  • 31
  • 1
  • 2
3
votes
3 answers

Use truecrypt to make data unrecoverable

If I format all my drivers c,d,e,f and then make a truecrypt volumes equal to drive size then delete it 'the voulme' will that make the old data unrecoverable ex. d:= 30g i use truecrypt to make 30g volume on d then delete it. and at the end do the…
illsecure
  • 157
  • 3
  • 9
3
votes
3 answers

Is it sufficient to use a hard disk magnet to corrupt/erase floppy data?

I would like to make data, in many (more than 250) old floppies, unreadable/unrecoverable. I have some HDDs that I can take apart. Their magnet is sufficient to do the job to make it unreadable to the general public? How much time it will the…
Kintaro
  • 33
  • 5
3
votes
4 answers

SSD is formatted twice and filled twice. Can i recover old deleted data?

I need to recover some old data which were stored on a drive. The data were deleted and the hard drive was formatted twice and filled twice with random data intentionally. First the drive had a Windows 7 installed. Then it was formatted twice with…
Vini7
  • 659
  • 6
  • 15
3
votes
1 answer

When do flash drives overwrite previously written data?

Let's say I have a pen drive of maximum capacity 20MB. Does this mean, that after an additional 40MB of data has been written to the drive, the first 20MB of data would be completely overwritten? Assume that it's never completely filled. At any…
God San
  • 33
  • 1
  • 5
3
votes
2 answers

Is it possible to revert a steganographic process to reconstruct the original image?

Using, say, outguess, it is possible to hide a secret message inside a JPEG image (LSB method). Is it possible to undo the steganographic process given the modified image to reconstruct the original one? I want to obtain the same bits of the…
m0bius
  • 33
  • 5
1 2
3
12 13