Questions tagged [data-recovery]

For questions generally relating to recovery of "plain" data from digital storage, when that storage has been damaged or the credentials securing it are lost.

Data recovery is usually required in one of two cases:

  • Data was stored in a persistent mechanism such as a magnetic medium or flash memory, and that storage media has become damaged so that it cannot be read normally.

  • Data was stored in an obfuscated state, such as having been encrypted, and the key or credentials needed to recover the data have been lost.

In IT Security, questions asked are usually concerned with the second reason; recovery of data from an encrypted or hashed state (questions relating to recovery of data from damaged storage are usually asked on the Super User or Server Fault SE sites). This goal is usually frustrated by the very purpose of such methods; to make it infeasibly difficult to obtain the "plaintext" from the "ciphertext" or "hash".

Some common data encryption systems, especially those used to protect user accounts, have some sort of recovery option built in. This "back door" is designed to allow an administrator an alternate way to retrieve the data using their own credentials or other high-level secrets. However, many systems that place a primary emphasis on account or data security, provide only one efficient way to retrieve the data; know the password. Without a "back door", administrators or other "white hats" attempting to get the data for innocent purposes are limited to using the same "attacks" that someone with nefarious goals would have: "brute-force" cracking, or any documented attacks on the specific encryption scheme used by the system.

186 questions
3
votes
2 answers

Is there a standard recommending physical destruction of a machine?

I had a discussion with a customer who requires the physical destruction of the PC (a standard laptop) which is holding their data. After clarification, they mean the destruction of the entire laptop, not the disk only (the disk is removable so it…
WoJ
  • 8,957
  • 2
  • 32
  • 51
3
votes
5 answers

How to securely sanitize data tapes, and audit the results?

I work at an electronics recycling facility and we were just presented with an offer from a client that would like to buy our used data tapes. Our problem is that we have never sanitized data tapes as we have only shredded them in the past. I need…
3
votes
2 answers

Best practice for encrypted file (or password) recovery

I am writing an app (Java) that stores potentially sensitive data in the cloud using a provider chosen by the user. So I am encrypting the files using AES/EAX + PBKDF2. That's the easy part, or so it seems. I live in fear of the inevitable question:…
RabidMutant
  • 133
  • 3
3
votes
2 answers

What is a proper way of destroying data remotely?

After watching a Defcon talk about data destruction, I became interested in the subject of how I would go around remotely destroying all my data on all my systems. I got to a point where I figured out how to arrange everything so a script would be…
Slava Knyazev
  • 716
  • 5
  • 12
3
votes
2 answers

Does typing something in Notepad but not saving it leave any trace?

Sometimes, if I'm having trouble typing a long password, I'll open up Notepad, type it in there (so I can make sure what I'm typing is correct), and then copy+paste it into the form, and then close the Notepad file without saving anything. Assuming…
TMH
  • 207
  • 1
  • 8
3
votes
1 answer

How to decrypt a microSD card after a factory reset of the device used to encrypt it?

Two month ago, I encrypted my Micro SD card in my Android device (Samsung Galaxy S5) for security purposes, and yesterday I forgot to decrypt it whilst removing the card I and factory resetting the device. Is there any way to decrypt it by using the…
Honey
  • 31
  • 1
  • 1
  • 2
3
votes
4 answers

how much time does it take to fully destroy a deleted video from SD card?

I have deleted a video from my SD card six months ago. How much time does it take to fully destroy this video file on the SD card? If I wanted to recover this video, is it possible to recover?
2
votes
1 answer

Data recovery from file collections

I am presently working as a summer intern. My first objective is, given a collection of files, recover and identify the file types present in it. To download sample pseudo-forensics data I have been using: Digital Corpora To recover files I have…
Manu
  • 21
  • 2
2
votes
3 answers

Creating a custom restore disk to prevent data mining?

I work in commercial telecoms and one part of our business is the leasing of computer equipment to call centers. If the customer for whatever reason gives us the equipment back (non-payment, out of business, downsizing) we lease out these same…
Adam
  • 131
  • 3
2
votes
2 answers

Is there any way of recover a locked drive using TPM?

Just reading I learned about the TPM technology and how it works. However, it make me wonder... if the motherboard crashes, is the data lost forever? Because you can't use the drive in other system due to the unique RSA key used by the TPM.
The Illusive Man
  • 10,487
  • 16
  • 56
  • 88
2
votes
1 answer

What should I do if my sensitive information is potentially leaked?

I sold an laptop recently, but didn’t care to do a secure erase to make sure there wasn’t any data left. After a long time, I suddenly realized that I shouldn’t have be so careless and began to worry about my data since it could be easily recovered.…
2
votes
0 answers

Is "drag-drop files" computer backup sufficient to avoid most malware/ have all my files?

I'm debating dragging all my files onto an external hard drive manually - rather than a time machine backup - and then pulling over any specific files I need if I ever need them. Afterwards, I'll factory reset my computer, as I'm concerned it…
Jonas
  • 21
  • 1
2
votes
1 answer

Windows 7 EFS - connot decrypt

I have some files on my laptop that were accidentally encrypted, I think by Visual Studio. I didn't even know that was possible. Anyway, the way I discovered they were encrypted was that I changed my password and thus could no longer access said…
Matt
  • 123
  • 3
2
votes
2 answers

How to get PGP key passphrase out of Thunderbird?

I set up Thunderbird to use PGP a while ago, so I can sign and decrypt messages now. But I have forgotten my private passphrase for my private key, but since Thunderbird can do it anyway, it has it stored somewhere. How can I get it? I already…
2
votes
1 answer

GPG encryption date or GPG version recoverable?

Is there a way to determine the date of encryption or the GPG version of a GPG-encrypted file (with symmetric encryption)? I lost the password but some rough information about when the file was encrypted would help me. (The oldest could be 5-7…
noozoph
  • 21
  • 1