| 1 |
On Tue, 2006-01-31 at 17:39 -0800, Grant wrote: |
| 2 |
> |
| 3 |
> Almost everyone seems to agree that recovering data from a formatted |
| 4 |
> drive is possible. What is the process by which this is done? I've |
| 5 |
> read here that: |
| 6 |
> |
| 7 |
> 1. The space between tracks contains historical data information. |
| 8 |
> |
| 9 |
> and: |
| 10 |
> |
| 11 |
> 2. There is a difference between a track written with a 0 and then |
| 12 |
> overwritten with a 0 and a track written with a 1 and then overwritten |
| 13 |
> with a 0. |
| 14 |
> |
| 15 |
> Are these the two processes by which this data recovery is made possible? |
| 16 |
|
| 17 |
They both rely on the fact that you can read what _was_ once written to |
| 18 |
the hard drive by examining the spaces. So that's one method. |
| 19 |
|
| 20 |
The other method of recovering data is just to cat /dev/hda, but that |
| 21 |
relies on the hd not being "wiped" (overwritten with 0's and 1's many |
| 22 |
times in a semi-random fashion!). |
| 23 |
-- |
| 24 |
Iain Buchanan <iain at netspace dot net dot au> |
| 25 |
|
| 26 |
Never make anything simple and efficient when a way can be found to |
| 27 |
make it complex and wonderful. |
| 28 |
|
| 29 |
-- |
| 30 |
gentoo-user@g.o mailing list |
Archives