Are there programs recover all data written on a drive since purchased

[Thebeholder]

Hi everyone.

I only saw that all data recovery programs I used them(such as,Testdisk, Mini power data recovery, recovery my files and so on) recover the most recent data formated, deleted from a partition.

Are there any programs to recover all data written on a drive since it was purchased?

In other words,

First, I have data on a partition. Then, I formated it. After that, I wrote other data on the same partition. Next, I formated a partition.
Finally, when I used any data recovery programs, it would only recover the final data written on a partition.
I would like to ask if there programs to let all data(data and data, and so on) be recovered.

 

[fireberd]

Programs can recover data if there has not been anything written to the drive sectors where the data was. However, if something has been written to the drive sector(s) then it can't be recovered with recovery software available to most users.

Government and law (police) agencies have software that can read (recover) data that has been overwritten on hard drives.

 

[Alejandro85]

You may need a professional service with specialized techniques to do such a recover. It's not entirely impossible to undelete files a few reformats ago, depending on how much you've used the HD, but it's not cheap either. Regular home programs can't simply go beyond what has been overwritten.

 

[LMiller7]

Software recovery methods can only recover data that has not been overwritten. Once data has been overwritten it is impossible to recover with any software.

In theory data might be recovered from the residual magnetic information left when a file is overwritten. This based on a paper written by Peter Gutman of Auckland University in 1996. But it is a matter of controversy how much data, if any, was ever actually recovered by such methods. In any event it would require very specialized (and equally expensive) equipment and very high level of skill and knowledge. That pretty much limits it to organizations such as the FBI. Commercial recovery, if possible at all, would be extremely expensive.

But that was 1996 when hard drives used quite different technology than now. There is considerable doubt that such recovery techniques, if they ever worked, have any relevance to modern hard drives. It has no relevance to SSDs.

See these articles for more information:
Can Intelligence Agencies Read Overwritten Data?
Is overwritten data really unrecoverable? | Computerworld Blogs

The best way to secure your data is not data recovery but maintaining backups. Files of any importance require at least one backup copy while those of particular importance require 2 or backup copies. Having no backups is asking for trouble.

 

[gigagiggles]

"Data" is somewhat generic and vague. The bits "0" and "1" can be cloned from one device to another. In that sense, it's recoverable. What's needed is a program that has algorithms which make sense of the sequences of "0" and "1". As I understand it, file formats have digital headers and other info to indicate the common file extensions and how the rest of the file's contents are organized. The algorithms are written to look for such headers and other info. Unfortunately, if the files are fragmented and there is no recoverable master file table structure for the device, then such files are partially recovered. And if the format is non-standard, then there wouldn't be an algorithm written to look for such headers. Of course, deep pockets can overcome such obstacles.

 

[Dsprague]

Software recovery methods can only recover data that has not been overwritten. Once data has been overwritten it is impossible to recover with any software.

In theory data might be recovered from the residual magnetic information left when a file is overwritten. This based on a paper written by Peter Gutman of Auckland University in 1996. But it is a matter of controversy how much data, if any, was ever actually recovered by such methods. In any event it would require very specialized (and equally expensive) equipment and very high level of skill and knowledge. That pretty much limits it to organizations such as the FBI. Commercial recovery, if possible at all, would be extremely expensive.

But that was 1996 when hard drives used quite different technology than now. There is considerable doubt that such recovery techniques, if they ever worked, have any relevance to modern hard drives. It has no relevance to SSDs.

See these articles for more information:
Can Intelligence Agencies Read Overwritten Data?
Is overwritten data really unrecoverable? | Computerworld Blogs

The best way to secure your data is not data recovery but maintaining backups. Files of any importance require at least one backup copy while those of particular importance require 2 or backup copies. Having no backups is asking for trouble.

Fore reference the former CFO of the company that I work for accidentally Wiped his drive a few times and asked us to get the data back from it (still to this day have no idea what he was doing) the cost for having the drive recovered was some where in the range of 700 - 1000 US dollars so unless your willing to pay a hefty price to get that data back its not going to happen granted those prices may be completely wrong this was about three years back.

 

[bobafetthotmail]

Government and law (police) agencies have software that can read (recover) data that has been overwritten on hard drives.

That can require also expensive hardware as well, like clean rooms to disassemble the disk and semi-magical devices to read the disk platters without using the drive's own heads.
It's murderously expensive.

 

[A Guy]

Law enforcement agencies have various software that they use for forensic data recovery off supposedly wiped drives. Programs such as EnCase, not readily available to individuals. Overwritten data is not easily recovered, but it can be done. A Guy

 

[logicearth]

..Overwritten data is not easily recovered, but it can be done...

I hope you guys know the real world is nothing like it is on TV, those CSI shows for example a lot of the things they do are fake. Recovering data from a hard drive, overwritten data, is just theories. There is no real practical evidence showing that it is even remotely possible (even by the CIA/FBI).

You would be lucky to get anything that is not gibberish back. Be sure to take into consideration the data density of today's hard drive. We can fit 1 TB of data onto a single platter for a 3.5" HDD. Compare that to a 5 GB 3.5" HDD before 2001. The bits on modern HDDs are extremely tiny, not leaving much room for "residue".

For further research see: http://en.wikipedia.org/wiki/Data_erasure#Number_of_overwrites_needed

 

[bobafetthotmail]

which is why I said clean rooms and semi-magical disk platter reading devices. The drive's own read/write heads aren't able to pick up so faint traces.

Now I admit it's not horribly up-to-date info, but I'm pretty sure it did work around 5 years ago.

 

[logicearth]

It didn't even work 5 years ago...NIST did their study in 2006, 7 years ago, modern HDDs from 2000 and 2001 where very much impossible to recover any useful information from overwritten data even with the most advance set of tools. The heads on HDDs are very precise, they need to be to read the high density drives we have today, far more then you give them credit for.

 

[A Guy]

Well, I don't watch CSI But this is apparently one of those "read it enough times" you take it as true. Especially coupled with news of recovered data used in trials etc. But the catch here is overwritten data. Apparently even normally overwritten data is almost completely unrecoverable. And specifically formatted data unrecoverable. My personal belief was aided by various programs having various "methods" to erase data, including some labeled as "stop hardware recovery DOD", and the Gutmann method. This Gutmann being the one who started all of this it looks like.

Can Intelligence Agencies Read Overwritten Data?

I can remember a forum where there was discussion of a member who had "obtained" a copy of EnCase and the training. It was assumed that this was somehow capable, and that a tunneling microscope could even more easily do it. Looks like that is also false. The "evidence" recovered in trials must have been data that was deleted, and assumed gone, but not overwritten. Or partially overwritten. So I will say I was wrong, and it was just assumed. A Guy

 

[edee]

..Overwritten data is not easily recovered, but it can be done...

I hope you guys know the real world is nothing like it is on TV, those CSI shows for example a lot of the things they do are fake. Recovering data from a hard drive, overwritten data, is just theories. There is no real practical evidence showing that it is even remotely possible (even by the CIA/FBI).

You would be lucky to get anything that is not gibberish back. Be sure to take into consideration the data density of today's hard drive. We can fit 1 TB of data onto a single platter for a 3.5" HDD. Compare that to a 5 GB 3.5" HDD before 2001. The bits on modern HDDs are extremely tiny, not leaving much room for "residue".

For further research see: Data erasure - Wikipedia, the free encyclopedia

First I don't know any reason one would want to recover deleted items off a HDD since the date of the computers purchase. Unless you bought the pc used and are looking to retrieve information that really does not pertain to you.

Second, don't go and discount those CSI shows, sure most of what they do is more than likely fabricated and far fetched. Although I do assume the feds have the technology that can recover items even if partial and even if it may be overwritten, do you really think they would make it public knowledge if they did?
It would probably cost them a boat load of money to do it and I assume they would only use those techniques on high profile cases where a conviction depended on it and even then it would be much easier for them to get a warrant to tap into your IP address, get in your system through an open port to get what they want before it is over written.
If the feds have the technology to zero in on a wifi connection to within a few feet in a matter of minutes, they have the technology to recover data, overwritten or not.

It all come down to is that the technology is there but how much are you willing to spend to get it?

This is why when I sell a pc, it never goes with the HDD that I used on it. I take out the used HDD and purchase a new one of equivalent size and reinstall the OS before I sell it to the new buyer.
When I have a HDD crash or is rendered unusable, I don't just throw it in the trash, I will take the time to disassemble it, remove and destroy the entire internal mechanisms and platters and what can be burnt gets burnt.

And just to go one step further, I NEVER store any personal or sensitive information on the OS's main drive, everything like that goes to an external drive which is backed up to another external drive and synced and encrypted, in the event I am to go on vacation or will be away from home for an extended period of time, the externals get unplugged and stored in a safe place in the event of a burglary or if I need the info on the drives they come with me.
So if my computer gets stolen while I am away there is no sensitive info on the main drive, also if it did get stolen they would not be able to logon to my system anyway because without the usb logon key that has a 56 character combo password on it which is with me at all times, they are not getting into it, I think the crack time on the combination for my Windows login is something like 73 billion years. So even if they wanted info off my drive they would have to do it by means that thieves do not have and even if they did , it would put a smile on my face knowing they'd be wasting their time and would get nothing. Now I know there are ways around the 56 character password (that I will not discuss here) even without the usb key but most thieves don't have the common sense to know how to do it, and even if they did, still, there is nothing there but the OS.

You probably think I am just paranoid or have something to hide .....
No, I do not have anything to hide other than maybe some sensitive pictures of me and the wife that does not need to be plastered all over the web, but identity theft is running rampant through this country these days and one needs to take measures to protect themselves because lets face it, those Life Lock commercials are a bunch of BS, they have been sued more times than you know. So if you get robbed of that item that contains 99% of all the personal info in your life, you need to make it as hard as possible for anyone to get to it.

So to answer your question, is there a way to do it? I certainly believe so, anything is possible but I really do not think you could afford it, I know I couldn't. Unless you personally know a Federal agent who is willing to put his / her job and career on the line just to recover information off a HDD for a friend, which I don't think would happen either unless there was probable cause for him / her to do so.

I could see trying to recover some accidently deleted files from a few weeks or even a month ago, but to try and recover everything from the entire life of the HDD ...... Hmmm, doesn't sound right to me. :sarc: