To all, EnCase will not perform recovery of overwritten data - that is - *physically* overwritten by the read/write head. That is the arena of Magnetic Force Microscopy (MFM). EnCase *will* "undelete" deleted files, and recover file slack (a 2.5K file overwriting a 4K file when block size = 2K will leave 1.5K of the original file exposed on the disk). We will leave it up to Mr. Polo to build a scanning tunneling microscope to accomplish the task behind his original question. Shannon O'Neil mailto:secguruat_private -----Original Message----- From: wim.remes [mailto:wim.remesat_private] Sent: Tuesday, October 02, 2001 08:50 To: forensics; Javi Polo Subject: RE: Recovering data from a wiped HD I've used Encase a few times to perform jobs like this...but I don't have a deep understanding of the product ... you can find information on the product on http://www.encase.com cheers, Wim >===== Original Message From Javi Polo <javipoloat_private> ===== >What technics could be used for recovery of an HD, floppy or whatever >magnetic device from a ... let's say, completely overwritten by zeroes, or >random stuff ... :? > >I've heard that this can be done, so it's just curiosity on how could I wipe >more securely data ... I suppose that by refilling severall times the same >sectors, it does hardens the recovernig process .. :? > >Does anybody know of this? > >-- >Javi Polo - DrSlump - Registered Linux User #97502 >Proud member of the Panda Gey Community (powered by linux) >http://javipolo.ivworlds.org/ - Fidonet 2:347/1.1 > >----------------------------------------------------------------- >This list is provided by the SecurityFocus ARIS analyzer service. >For more information on this free incident handling, management >and tracking system please see: http://aris.securityfocus.com ----------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com ----------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
This archive was generated by hypermail 2b30 : Tue Oct 02 2001 - 09:47:59 PDT