Re: [gentoo-user] {OT} Recovering data from a formatted hard disk

[Iain Buchanan]

On Tue, 2006-01-31 at 07:27 +0000, Stroller wrote:
> On 31 Jan 2006, at 01:03, Grant wrote:
>
> > Hello!  I've heard that data can be recovered from a formatted hard
> > disk.
>
> Yes, it's fairly trivial, for someone who cares enough to try, to
> retrieve data from a disk that's merely been formatted. Although I've
> never tried to do so myself I regularly `shred /dev/hda` on
> customers' scrap PCs (see `info shred`) and a data recovery
> specialist last year offered to return 17gigs worth of data from a
> hard drive that had died containing only 8 gigs of files.

I once deleted my partition table, created new partitions over the top
(different sizes) but I _didn't _ run mkfs on any of it.  I was able to
use a tool to see where old partition boundaries were, and I recovered
all the data intact :)  It was many hours of farting around, but I did
it :)

If you use ext3, it is hard to recover the data, sure you could use grep
over /dev/hda, but you don't know where the pieces are.  If you're happy
to put a 100000000000 piece jigsaw puzzle back together, then go for it.

If you "shred" or "wipe" the data (run random data over the disk many
times, with a bit of magic formulas thrown in) then apparently the FBI /
CIA / KGB / WTFC has a magnetic data recovery tool to see what bit was
written before the current bit (don't ask me how).

So, it depends what you mean by format, and who has the time / money to
bother trying to recover it.

I've heard of government departments filing down the old HD's into
little pieces, then mixing them in cement for the next building project.
Could be an urban legend though.

All of the above is subject to my own bad memory :)
-- 
Iain Buchanan <iain at netspace dot net dot au>

It's easy to solve the halting problem with a shotgun.   :-)
             -- Larry Wall in <199801151836.KAA14656@××××.org>

-- 
gentoo-user@g.o mailing list