News   Jun 28, 2024
Streetsville Centre Plaza Redevelopment Proposed North of GO Station in Mississauga
 5.2K     6 
News   Jun 28, 2024
GALA Developments Unveils Danny Danforth in Toronto's East End
 2.1K     3 
News   Jun 28, 2024
News Roundup for June 28, 2024
 736     1 

Rob Ford's Toronto

Status
Not open for further replies.
retailestate said:
If they pulled the platters on that hard drive they will be able to recover just about anything...
Click to expand...

Dismantling the drive? That's pretty much the last thing you want to do if you want to recover data from it. For a start, you'd need to do it under clean-room conditions. It's possible, sure, but it's not something a hobbyist could attempt. Even drive manufacturers may send their own failed drives to specialists for data recovery. It's expensive, time-consuming and expert-level work.

See here for a useful discussion and lots more detail.
 
SecretSquirrel said:
Dismantling the drive? That's pretty much the last thing you want to do if you want to recover data from it. For a start, you'd need to do it under clean-room conditions. It's possible, sure, but it's not something a hobbyist could attempt. Even drive manufacturers may send their own failed drives to specialists for data recovery. It's expensive, time-consuming and expert-level work.

See here for a useful discussion and lots more detail.
Click to expand...

Well ya? Actually the "clean room" guys Geek Squad send their drives (sorry - platters) out to be pulled is the same outfit the TPS uses @ $1700 per drive (what GSquad quotes). I think they are called "something"-EX.
 
Last edited:
You mean even for the debate, no one has tried to teach him the difference between an LRT and a streetcar???
 
They have probably tried, but he's really not much of a quick learner. Good for Socknaki for calling him out on that
 
retailestate said:
If they pulled the platters on that hard drive they will be able to recover just about anything...
Click to expand...

Not really. If the information has been just normally deleted, then you can retrieve it easily, because the info is still on the surface, just marked as being available.

If it's then been overwritten, once or a number of times, either because the OS just needs to use the space for something new, or because you've used a special overwriting program, then the info is gone baby gone. Previous purely theoretical approaches to getting information you may have heard about (residual magnetic whatevers) were thrown around years ago when density was a tenth or less of what we have now. Practical applications of recovering files that way never actually existed that I know of (so that were available to anyone other than the NSA) and certainly wouldn't still work for modern data densities. Any kind of physical destruction that people advise about is overkill from a purely infosec perspective.

The specialized take the platter out of the drive and recover info places are doing so because your hard drive has crashed or burned. In other words, the information has never been overwritten, or even deleted, it's just that the mechanism or electronics to read it has been incinerated or just developed a fault. Completely different use cases.

Also, I've been told that if you could recover the information off a drive in some sort of weird way like that, it wouldn't be applicable as evidence, because you need to physically change the original device, which means that it's no longer available for examination. Digital forensic standards require that you do a bit-for-bit copy of a device, and do any of your analysis on that, so any magic memories of information that used to be on drives wouldn't make it to the new working copy for analysis anyway.
 
Status
Not open for further replies.

Back
Top