Re: Resources required to retrieved wiped disk



On Mon, 22 May 2006 23:14:39 GMT, Bryan Olson
<fakeaddress@xxxxxxxxxxx> wrote:

Douglas A. Gwyn wrote:
"Johnny P." wrote:

I thought law enforcement usually makes a duplicate copy of seized
harddrives to preserve the evidence. At what point do they start
modifying the hardrware?


Duplication preserves only the main recorded track, not any
spillover nor subcritical differences in magnetization level,
which is where the remaining information is after a "wipe"
pass. One needs to analyze the original medium.

You can inquire aboyt the cost by asking one of the commercial
"data recovery services".

An hour of searching on that term should disabuse one of the notion
that such services recover physically over-written data from hard
disks.

If I get the gist of your point made several times in this thread:

It is that current hard drives ,which actually have extremely high
data densities compared to drives even a few years ago, are no longer
good candidates for the kind of techniques which involve removing the
platters and examining them under "electronic microscopes" to discern
previous "writes" after the data has been "overwritten" even once.


.