Recommendations on the best Data recovery Software?

Discussion in 'privacy technology' started by Cutting_Edgetech, Feb 26, 2009.

Thread Status:
Not open for further replies.
  1. Cutting_Edgetech

    Cutting_Edgetech Registered Member

    Joined:
    Mar 30, 2006
    Posts:
    4,951
    Location:
    USA
    Give some recommendations on strong data recovery software for data that has been deleted? No system restoring software like Acronis, Rollback RX, or FirstDefense-ISR. Recovery for overwritten data?
     
  2. traxx75

    traxx75 Registered Member

    Joined:
    Jun 23, 2008
    Posts:
    106
  3. yashau

    yashau Registered Member

    Joined:
    Oct 13, 2008
    Posts:
    151
    Runtime GetDataBack is good.
     
  4. Cutting_Edgetech

    Cutting_Edgetech Registered Member

    Joined:
    Mar 30, 2006
    Posts:
    4,951
    Location:
    USA
    Thanks for the recommendations! I want to see how well these products hold up. I'm going to use eraser to erase some data. Its going to be interesting to see how much i can recover. I seriously doubt that i will recover any data i've overwritten using 7 passes or more. Lucky to recover anything using 3, but i would like to see. I will delete a few things using standard deletion that comes with windows, and then try all the different methods eraser offers starting at the bottom, and working my way up to Gutmann 35 passes. I don't have a hardware device for recovery, but it would be neat if i did.
     
  5. Warlockz

    Warlockz Registered Member

    Joined:
    Oct 30, 2008
    Posts:
    642
    Why? Haven't you read other posts in this forum about this subject?

    I guarantee you wont recover any file that has been overwritten 1 time Pseudo Random with eraser using any data recovery software period!

    I know you will recover any file that has been deleted using the default delete method in windows though!

    I guess when you realize you cant recover any file after the 1 wipe pseudo random you will stop trying as their will be no need to test a stronger Algorithm against any software recovery tool!
     
    Last edited: Feb 27, 2009
  6. LockBox

    LockBox Registered Member

    Joined:
    Nov 20, 2004
    Posts:
    2,275
    Location:
    Here, There and Everywhere
    Just so you know, so-called "hardware recovery" is 99.9% myth, an idea based on Peter Gutmann's paper back in 1996 presenting a theory that certain data can be retrieved using an electron microscope. Nobody has ever actually done it to anyone's knowledge. Gutmann later wrote another paper (about eight years ago) presenting the theory, but with less certainty that it could be done by anyone except possibly the best of the intelligence agencies in the world.

    In short, "hardware recovery" is mostly myth. There are no documented cases of data being retrieved through use of electron microscopes and it is still, alas, a theory. As for other "hardware recovery" methods: there are none. Yet, data erasers of all kinds continue to label their products and certain wiping algorithms as being recoverable by "software" and "hardware" means. It's all marketing. Even the various methods (3-pass, 7-pass) used by US government agencies are forward prevention methods only. Meaning, they are to protect against future technology.

    So don't worry, an electron microscope or so-called "hardware recovery" would do you no good as it has never been documented to retreive a single solitary readable file overwritten even once.
     
  7. Warlockz

    Warlockz Registered Member

    Joined:
    Oct 30, 2008
    Posts:
    642
    Their was this one case though!

    http://radsoft.net/rants/20031027,00.shtml

    One should consider using at least a 3 wipe pass for super private data, and at least a 1 wipe Pseudo Random pass for everything else considered private, I don't care what kind of Theory's and mind sets the net provides on this subject in the current date, but you never know what they can come up with tomorrow, and the government has set guidelines for a reason, Not because it is impossible to recover data using 1 simple overwrite? But because it is better to be safe than sorry!

    I live by 1 motto, I never want to have one of those days where I Should a, Could a, Would a, it is beyond myself to live by anything else when the only thing standing between the 2 are pure laziness and an extra 5 minutes of my time!

    Hard Drives are a dime a dozen, but freedom and time is Priceless!
     
    Last edited: Feb 27, 2009
  8. Nebulus

    Nebulus Registered Member

    Joined:
    Jan 20, 2007
    Posts:
    1,582
    Location:
    European Union
  9. Warlockz

    Warlockz Registered Member

    Joined:
    Oct 30, 2008
    Posts:
    642
    Yup o_O :cautious: o_O .. but I would rather be 100% If I had something to hide, not 99.9% or as they say!

    Again:

    You never know what they can come up with tomorrow, and the government has set guidelines for a reason, Not because it is so called impossible to recover data using 1 simple overwrite? But because it is better to be safe than sorry!

    :DI live by 1 motto, I never want to have one of those days where I Should a, Could a, Would a, it is beyond myself to live by anything else when the only thing standing between the 2 are pure laziness and an extra 5 minutes of my time!

    Hard Drives are a dime a dozen, but freedom and time is Priceless!

    If you feel 1 simple overwrite is 100% effective than more power to you, your the only one that has to fill your own shoes, not me!

    Please: Feel free to contact the DA in Marc Watzman's case, and explain to them it should have been impossible for them to recover the 200.000 pics they recovered after he used a software to overwrite them with 1 simple pass!

    Have a nice day!

    ...................................................................................................................................
     
    Last edited: Feb 27, 2009
  10. LockBox

    LockBox Registered Member

    Joined:
    Nov 20, 2004
    Posts:
    2,275
    Location:
    Here, There and Everywhere
    Warlockz, I believe the point from Radsoft (in your provided link) is that the deletion was not done properly due to faulty coding from Robin Hood, not that a properly executed overwrite of data from a reputable piece of software is not enough. In other words, the same thing you argued in post #5. The recovery was obviously simple software recovery tools as, again, so-called "hardware recovery" is not used by LEA, or by anyone successfully (see my post #6 in this thread.)
     
  11. Warlockz

    Warlockz Registered Member

    Joined:
    Oct 30, 2008
    Posts:
    642
    No matter how hard we try we will never reach an agreement on this issue, so our best bet is to let the reader/s decide what he or she is comfortable using to which makes them feel Secure or not!;)
     
  12. Cutting_Edgetech

    Cutting_Edgetech Registered Member

    Joined:
    Mar 30, 2006
    Posts:
    4,951
    Location:
    USA
    Thanks for the info! I bank, shop, and file taxes on line. So its a good ideal to secure delete data. I had not read the earlier threads on eraser.
     
  13. No1UKnow

    No1UKnow Registered Member

    Joined:
    Mar 2, 2009
    Posts:
    4

    Dont know about overwritten data, but here are the tools I use:

    Basic recovery: Emergency Undelete (Single exe, no installation required)

    RStudio: Great app, has lots of features, like quick scan, full scan, network bootable. I have never lost data using RStudio. I have even preformed a format and recovered the data from the drive - I lost the file structure (and some filenames), but was able to capture all the actual files.

    Zero Assumption Recovery (ZAR): Similar to RStudio, but only allows full scans, which can be a PITA. Again, great at recovering data, however.

    For a simple recovery of deleted files, I goto Emerg Undelete, run from a USB stick, for damaged hardware, formats, jacked file tables and other errors I go to RStudio. ZAR I generally only use as a failback if RStudio doesnt see a drive, which is rare.
     
  14. No1UKnow

    No1UKnow Registered Member

    Joined:
    Mar 2, 2009
    Posts:
    4
    Speaking of...any recommendations on good FREE recovery software for memory cards?

    I used to have a great one for pulling pictures off corrupt cards, but I cant remember what I used.
     
  15. caspian

    caspian Registered Member

    Joined:
    Jun 17, 2007
    Posts:
    2,301
    Location:
    Oz
    If you use Sandboxie default browser with Eraser configured to wipe the dat file that it leaves behind, there will be nothing left to wipe....as far as surfing online is concerned. Unless I am missing something.
     
  16. dantz

    dantz Registered Member

    Joined:
    Jan 19, 2007
    Posts:
    991
    Location:
    Hawaii
    What you are attempting to do is by no means a simple task, and casually running a few data-recovery programs to see how much (if any) wiped data can be recovered isn't going to prove anything of consequence. You would need to have the skills, knowledge and toolset of a professional forensic examiner in order to draw any meaningful conclusions from this type of testing. Also, at the very least you should be using a hex editor such as WinHex, and possibly some forensics data acquisition and recovery software such as EnCase.

    The first thing to get clear on is the type of threat you're defending against. If you're trying to prevent your personal and financial data from falling into the hands of a computer thief then merely wiping the obsolete data off your hard drive will not be particularly helpful, since your hard drive will likely still contain all of your current personal and financial data. In a case like this you would be much better served by the use of strong data encryption.

    Of course, you must also focus on online security in order to protect your online usernames and passwords from being captured.
     
  17. MrBrian

    MrBrian Registered Member

    Joined:
    Feb 24, 2008
    Posts:
    6,032
    Location:
    USA
    These are my recommendations amongst free software:

    I recommend to use Recuva first, with the 'Deep Scan' option turned off, recovering only deleted files in 'Excellent' state. If this doesn't recover all the file(s) you wanted, then try PhotoRec. PhotoRec will take much longer because it ignores the filesystem and instead looks at the underlying data, a process called file carving. There are situations where the filesystem has been damaged or formatted, and thus file carving is needed for recovery. Recuva with the 'Deep Scan' option turned on also does file carving, but PhotoRec may be a better choice for file carving as of this writing because it may be able to carve more types of files than Recuva. See http://www.cgsecurity.org/wiki/File_Formats_Recovered_By_PhotoRec for a list of file formats that PhotoRec can carve. See http://www.recuva.com/download/version-history for a list of some of the file formats that Recuva can carve.
     
Loading...
Thread Status:
Not open for further replies.