Recovering Data From Broken Hard Drives and SSDs (Video)

Russell Chozick owns a small company in Austin. TX, called Flashback Data that recovers data from messed-up hard drives. And SSDs and Flash memory, too. How badly damaged does a drive have to be to defeat Russell and his crew? Apparently, smashed to bits. Not long aqo we did a video about a company that destroys data on hard drives, and we've had at least one Ask Slashdot where the question was, "What's the Best Way To Destroy Hard Drives?" In today's video, Russell is talking about the opposite of destruction -- except that he destroys data upon request, too. Obviously, checking the wrong box on a customer order form could cause big problems at Flashback Data, couldn't it? Let's hope they never do that -- and let's hope we all back up all of our data so we never need to use a data recovery service. You do back up all your data, don't you?

Comments

BS Summary

[gweihir]

Do one overwrite with zeros for magnetic media. They cannot recover that. Open the drive, take out the platters, bend or break them, they cannot recover that. SSDs are more tricky, but one overwrite with random data assures that no more than the spare capacity can be recovered.

Re:BS Summary

[guttentag]

Do one overwrite with zeros for magnetic media.

I just send all my broken storage media to the Nixon Presidential Library, labelled "18 1/2 minutes" in a box with a return address for "Flasback Data Recovery Specialists: We Recover Anything, Confidentiality Guaranteed. Austin, TX." They replace all the 1s and 0s with pure silence. Nothing beats that.

Re:BS Summary

[CanHasDIY]

Thermite, like duct tape, is the solution to damn near everything.

Now, if you'll excuse me, I have some men in black suits and dark glasses at my door, and I think they want to talk to me....

Re:BS Summary

[blueg3]

you can recover 1 overwrite actually....

You cannot. Or rather:
* Nobody has ever demonstrated success of recovering data from a modern hard drive (anything more recent than MFM) that has been overwritten even one time.
* The person who wrote the paper on recovering data from drives after erasure, Gutmann, has said there is no reason to believe that it is possible with modern drives.
* Other people have a quite sound theoretical arguments that it is impossible. (That is, there is a hysteresis effect, but it is so small compared to noise that the statistical probability of getting correct data instead of random data is much, much too small to be of any practical use even in a best-case scenario.)

This is a myth in computer forensics and security that needs to die.

Re:BS Summary

[tibit]

That's incorrect. Current drives store information in individual (as in single) magnetic domains. A magnetic force microscope is of no help there. Once you flip a domain, you've flipped it. There's no history, no layers, nada. You're referring to information that was current 20 years ago.

Re:BS Summary

[Lord Crc]

That paper is from 1996. The updated epilogue contains this quote:

Any modern drive will most likely be a hopeless task, what with ultra-high densities and use of perpendicular recording I don't see how MFM would even get a usable image [...]

Re:BS Summary

[lgw]

Let me pile on with the "no you cannot". Once this was true, back in the days of MFM drives, because there was lots of redundant magnetic media on that drive. But the need to squeeze out every last bit of data density on drives has changed that - any place on the media where leftover traces of previous writes could be found is a place where more bits could be fit on the platter. Still, with older IDE drives you might have wanted to do one pass of random data instead of 0s, if you were worried about an opponent with an electron microscope (I've actually seen bits on tape in an electron microscope image - very cool).

GMR drives took that trend even farther, by using the Z-axis to help store each bit, not just the surface of the platter. With modern drives the media is completely used to store current data.

Re:BS Summary

[SuricouRaven]

You're close. Overwriting media with zeros almost entirely erases everything - there was a time when it was possible for someone with a highly specialised magnetic probe to pick up leftover traces from the space between the tracks, but modern drives have the tracks far too close for that. There is just one place data may survive: Remapped sectors. The drive logic does detect if a sector is going to fail or already failed, and if so will remap it to a spare area, just as SSDs do. The old data gets left behind in the now-disused space.

But all that'll save is the odd little fragment here and there, either 512 bytes or 16k depending on the drive. An attacker would need a lot of luck to find something good in there.

Re:BS Summary

[xtracto]

Nice try NSA guy.

Re:BS Summary

[K. S. Kyosuke]

"Using quantum detection for variations in the strength of the magnetic field (government level equipment) can detect multiple layers."

This sounds like total bullshit to me. We already have to use heavy error-correcting codes on pretty much all modern media to read even the last thing you wrote on them. What makes you think that whatever residual magnetism remains after a mere zeroing (although I'd opt for /dev/urandom instead) is sufficient to restore whatever had been written on it before that?

Best way to destroy the drive...

[TWX]

...is to literally destroy the drive...

A small four-pound sledge and a suitable hard surface to act as an anvil and one can break the aluminum case into bits in a couple minutes and crease and crack the platters to the point that there realistically isn't anything being read from there. If you're REALLY worried, break out the plasma cutter and just cut the platters into bits...

Speaking of bits, Spanish colonial currency were "pieces of eight". "Shave and a Haircut, two bits" is a $0.25 cost. So, eight bits to a full unit... Coincidence for eight bits to a byte, or intentional?

Speaking of Recovering Things

[pitchpipe]

Does this company offer a way to recover a Slashdot that doesn't disguise advertising as a story?

Re:Speaking of Recovering Things

[berashith]

not disguised at all. If the first words of the summary arent " somerandomuser writes" , then I know that it wasnt user submitted, and is being pushed in from above. I only come into the comments of these types of stories to verify that I didnt click through to their ads.

Re:Advertisement within an advertisement?

[EmagGeek]

Just curious, why did you attempt to obscure the word "SHIT" in your post?

Just say it. SHIT. It's a wonderful, useful word, just like FUCK, HELL, TITS, ASS, CUNT, DICK, and so many others that describe Slashdot and those who make it yet another newsvertisement site.

WTF? I thought I had ads diabled??

[gweihir]

Why is this stupid marketing BS still displayed?

Re:Slashdot is vulnerable and should be updated

[ArcadeMan]

Maybe you haven't updated Firefox in a while. Are you still using yesterday's version?

LOL DR Chipper Shredder

[Virtucon]

I doubt after your hard drive goes through a chipper/shredder that they could recover the data.