General discussion

Locked

Is it Possible?

By susan5_in7 ·
My judgement is that,
1. If a DBF(Foxpro)file emptied from Recycle Bin and after perform all HDD Scaning, the file should not be recovered from the HDD. But some softwares are able to recover the file. Is it Possible?
2. In the above file, if a date has been edited as prior date from the current date, it displays the edited date but the previous date remain same as an image and it could be seen easily by any well skilled software professional. Is it possible?

This conversation is currently closed to new comments.

6 total posts (Page 1 of 1)  
| Thread display: Collapse - | Expand +

All Comments

Collapse -

Is it Possible?

by carollong In reply to Is it Possible?

Simply: Yes you can recover deleted files in some cases.

Depending on your version of Windows, recovering a deleted file (emptied from the recycle bin) can be really easy if done quickly. Early versions of windows are based on DOS file handling. There are many tools that allow you to undelete files in that environment. With the later versions NT and later) that are based on NTAS file handling, there are less tools but it may be possible.

When a file is deleted, it is not scrubbed off the hard drive. All that happens is a marker is placed on the "index" for the disk space to say that area can be used for news files. This space will be used if you add new files or physically move files around the disk (e.g. defrag). Moving files to a different folder doesn't physically moved them just updates the "index". If the released space has not been used for new or moved files, any tool that can update the "index" can be used to recover the file. You may even be able to recover part of the file if some of the space has been used.

Thus if you want to really delete a file (e.g. if you have data you want to keep secure after it is not needed) , you must use a special tool that will overwrite the disk space used by that file withsomething else.

Collapse -

Is it Possible?

by carollong In reply to Is it Possible?

Simply: Yes you can see both the date a file was created, and when it was last modified, and (for later versions of windows) when it was last openned.

This information is stored in the way Windows handles files. This part of the disk space "index" is not changed after a file is emptied from the recycle bin. So if you have the tools to look at this index, you can see these dates.

In later versions of Windows, anybody can see this information for all active and Recycle Bin files.

e.g. Windows XP open My Documents, click once on a file to select it, right click and select properties from the menu, on the General tab (towards the bottom of the tab) there are 3 dates. This gives the date the file was created, the date the file waslast changed (modified) and when it was last updated.

Folders only have one date: the date they are created.

Collapse -

Is it Possible?

by TheChas In reply to Is it Possible?

1. Unless you write over the specific area on the hard drive where the file was, it will remain recoverable.
Many file security programs can be set to delete a file, and write over the clusters that the file was stored in.

2. If you are referring to file dates, there are several dates in the properties of each file.
Date created,
Date last accessed,
Date last modified

A skilled individual CAN change ANY of the dates with a binary file editor.

You can use the clock settings and scandisk to force a change on some of the dates.

Chas

Collapse -

Is it Possible?

by fred07 In reply to Is it Possible?

Hi and YES, after spending 3 weeks recovering 'deleted' files for a customer, I had recovered files from as far back as 3 years. Although many of the files were only partial and incomplete. After the company I recovered them for had BACKEDUP everything they wanted I then did a " drive" and did a full gov wipe of HD to assure no recovery could be further made by anyone.

Collapse -

Is it Possible?

by AirHockeyNinja In reply to Is it Possible?

What you are describing is absolutely possible. There are several commercially available forensics/data recovery packages which can be used to do this. I hate to inform you guys, but I have successfully recovered data from IDE drives that had been written over 11 times (these were two .jpg, two .doc, two .pdf, and two .mp3 files, and only the .mp3 files were dammaged beyond repair- but still recognizable), and have seen software that will allow even deeper recovery. See the problem is that modern hard drives store data magnetically- The longer the data is on the drive, the stronger the magnetic signature, so all you need is an algorythm(sp?) which is capable of piecing it back together. GetDataBackNTSF/DOS is one such product which I have used to recover data that was overwritten three times with a random wipe. Encase forensics software has enabled me to recover data randomly overwritten 11 times.
The IRS and MOST government agencies for this very reason implelment a very strict set of rules for handling defunct hard drives; 1) The hard drive is placed on a powerful electromagnet and magnetized (there by 'blowing out' all magnetic signature on the disk), 2) the defunct drive is then smashed with a sledgehammer.
Step one will usually also render the drive's circuit board useless, and step two ensures that even IF there were still data on the disk, it would be completely unretrieveable.
Then there are industrial solutions such as www.drivesavers.com - go have a look thru their website and read about some of the drives THEY have recovered data from.
Continued in next post..................

Collapse -

Is it Possible?

by AirHockeyNinja In reply to Is it Possible?

Continued from previous post.........

For the truely paranoid (or just security concious) there are products that will perform a three stage wipe, with (that I have seen) up to 127 passes- www.steganos.com (steganos security suite).
Data forensics can be a scary thing, and unfortunately it is not openly discussed as a security issue- how many people do you know who have just thrown out a 10GB hard drive when they bought a new one, or taken their computer to a repair facility and never eventhought to ask for the old drive back? How many businesses just format the hard drive in old machines before selling them, giving them to employees, or giving them to charities? There have been several documented cases of identity theives buying used computers/hard drives for this purpose.

Sleep well! ;-)

Joe

Back to Security Forum
6 total posts (Page 1 of 1)  

Related Discussions

Related Forums