No practical evidence...overwritten data can be recovered

[Non scrivetemi]

http://en.wikipedia.org/wiki/Data_recovery

When data have been physically overwritten on a hard disk it is
generally assumed that the previous data are no longer possible to
recover. In 1996, Peter Gutmann, a respected computer scientist,
presented a paper that suggested overwritten data could be recovered
through the use of Scanning transmission electron microscopy.[4] In
2001, he presented another paper on a similar topic.[5] Substantial
criticism has followed, primarily dealing with the lack of any concrete
examples of significant amounts of overwritten data being
recovered.[6][7] To guard against this type of data recovery, he and
Colin Plumb designed the Gutmann method, which is used by several disk
scrubbing software packages.

Although Gutmann's theory may be correct, there's no practical evidence
that overwritten data can be recovered. Moreover, there are good
reasons to think that it cannot.[8]

[anon]

http://sourceforge.net/project/showfiles.php?group_id=37015

> http://en.wikipedia.org/wiki/Data_recovery
>
> When data have been physically overwritten on a hard disk it is
> generally assumed that the previous data are no longer possible to
> recover. In 1996, Peter Gutmann, a respected computer scientist,
> presented a paper that suggested overwritten data could be recovered
> through the use of Scanning transmission electron microscopy.[4] In
> 2001, he presented another paper on a similar topic.[5] Substantial
> criticism has followed, primarily dealing with the lack of any concrete
> examples of significant amounts of overwritten data being
> recovered.[6][7] To guard against this type of data recovery, he and
> Colin Plumb designed the Gutmann method, which is used by several disk
> scrubbing software packages.
>
> Although Gutmann's theory may be correct, there's no practical evidence
> that overwritten data can be recovered. Moreover, there are good
> reasons to think that it cannot.[8]

[Unruh]

"Non scrivetemi" <nonscrivetemi@pboxmix.winstonsmith.info> writes:

>http://en.wikipedia.org/wiki/Data_recovery

>When data have been physically overwritten on a hard disk it is
>generally assumed that the previous data are no longer possible to
>recover. In 1996, Peter Gutmann, a respected computer scientist,
>presented a paper that suggested overwritten data could be recovered
>through the use of Scanning transmission electron microscopy.[4] In
>2001, he presented another paper on a similar topic.[5] Substantial
>criticism has followed, primarily dealing with the lack of any concrete
>examples of significant amounts of overwritten data being
>recovered.[6][7] To guard against this type of data recovery, he and
>Colin Plumb designed the Gutmann method, which is used by several disk
>scrubbing software packages.

>Although Gutmann's theory may be correct, there's no practical evidence
>that overwritten data can be recovered. Moreover, there are good
>reasons to think that it cannot.[8]


Disks now try to use all of the real estate on thedisk to store data, and use
highly efficient algorithms to use all of the information on the disk
productively, trather than redundantly. Ie, If it were possible to recover the
data, that dual level of data ( both the current data and the previous data are
recoverable) could be used to store current data. And manufacturers try very very
hard not to waste storage capacity.

[My Name]

Unruh <unruh-spam@physics.ubc.ca> related news:Ls8Nl.26209$Db2.22171@edtnps83:

> "Non scrivetemi" <nonscrivetemi@pboxmix.winstonsmith.info> writes:
>
>>http://en.wikipedia.org/wiki/Data_recovery
>
>>When data have been physically overwritten on a hard disk it is
>>generally assumed that the previous data are no longer possible to
>>recover. In 1996, Peter Gutmann, a respected computer scientist,
>>presented a paper that suggested overwritten data could be recovered
>>through the use of Scanning transmission electron microscopy.[4] In
>>2001, he presented another paper on a similar topic.[5] Substantial
>>criticism has followed, primarily dealing with the lack of any concrete
>>examples of significant amounts of overwritten data being
>>recovered.[6][7] To guard against this type of data recovery, he and
>>Colin Plumb designed the Gutmann method, which is used by several disk
>>scrubbing software packages.
>
>>Although Gutmann's theory may be correct, there's no practical evidence
>>that overwritten data can be recovered. Moreover, there are good
>>reasons to think that it cannot.[8]
>
>
> Disks now try to use all of the real estate on thedisk to store data, and use
> highly efficient algorithms to use all of the information on the disk
> productively, trather than redundantly. Ie, If it were possible to recover the
> data, that dual level of data ( both the current data and the previous data are
> recoverable) could be used to store current data. And manufacturers try very very
> hard not to waste storage capacity.

http://www.altavista.com/web/results?itag=ody&pg=aq&aqmode=s&aqa=ntfs&aqp=slack+space&aqo=&aqn=&kgs=1&kls=0&dt=tmperiod&d2=0&dfr%5Bd%5D=1&dfr%5Bm%5D=1&dfr%5By%5D=1980&dto%5Bd%5D=8&dto%5Bm%5D=5&dto%5By%5D=2009&filetype=&rc=dmn&swd=&lh=&nbq=50
--
A government, of Israel, by Israel, and, for: Israel.
But all things that are reproved are made manifest by the light:
for whatsoever doth make manifest is light.
The light shineth in darkness;
and the darkness comprehended it not.
The light of the body is the eye: if therefore thine eye be single,
thy whole body shall be full of light.
But if thine eye be evil, thy whole body shall be full of darkness.
If therefore the light that is in thee be darkness, how great is that darkness!
Awake thou that sleepest, and arise from the dead,
and Christ shall give thee light.

[Frank Merlott]

>
> Although Gutmann's theory may be correct, there's no practical evidence
> that overwritten data can be recovered. Moreover, there are good
> reasons to think that it cannot.[8]

Although overwritten data may not be recovered, Windows has the habit
of backing up your data for no reason inside the most unsuspected
places. And that can be recovered.

--
Privacylover: http://www.privacylover.com

[Mike Jones]

Responding to Non scrivetemi:

> http://en.wikipedia.org/wiki/Data_recovery
>
> When data have been physically overwritten on a hard disk it is
> generally assumed that the previous data are no longer possible to
> recover. In 1996, Peter Gutmann, a respected computer scientist,
> presented a paper that suggested overwritten data could be recovered
> through the use of Scanning transmission electron microscopy.[4] In
> 2001, he presented another paper on a similar topic.[5] Substantial
> criticism has followed, primarily dealing with the lack of any concrete
> examples of significant amounts of overwritten data being
> recovered.[6][7] To guard against this type of data recovery, he and
> Colin Plumb designed the Gutmann method, which is used by several disk
> scrubbing software packages.
>
> Although Gutmann's theory may be correct, there's no practical evidence
> that overwritten data can be recovered. Moreover, there are good reasons
> to think that it cannot.[8]


Overwritten data does not need to be recovered for legal purposes. All
that may be required is enough trace of preceding data patterns on a
platter to confirm an accusation "to an acceptable degree" (this to be
decided by a court with a poor understanding of the technology). This
throws the burden of evidence to the contrary onto the planitif.

While reconstructing a whole HDD might be unfeasable, creating a whole
can 'o whupass from nothing is very likely within the reach of a
prosecution.

Physical destruction is the only sure way to delete a disk.

Either that, or not putting anything that /could/ be seen (in forensic
retrospect) as potentially incriminating on it in the first place could
be a good strategy.

--
*===( http://www.400monkeys.com/God/
*===( http://principiadiscordia.com/
*===( http://www.slackware.com/

[Gerard Bok]

On Sat, 09 May 2009 05:24:59 GMT, Unruh
<unruh-spam@physics.ubc.ca> wrote:

>"Non scrivetemi" <nonscrivetemi@pboxmix.winstonsmith.info> writes:

>>When data have been physically overwritten on a hard disk it is
>>generally assumed that the previous data are no longer possible to
>>recover.
>Disks now try to use all of the real estate on thedisk to store data, and use
>highly efficient algorithms to use all of the information on the disk
>productively, trather than redundantly. Ie, If it were possible to recover the
>data, that dual level of data ( both the current data and the previous data are
>recoverable) could be used to store current data. And manufacturers try very very
>hard not to waste storage capacity.

True. But you are missing a vital ingredient here: money.

Disk manufacturers have no incentive to put 'as many data as
physically possible' on a disk. They (and we all) go for 'as many
data for a buck as feasable'.
Which means in current terms that 1 TB goes for say $ 100.
While it might cost another $ 100.000 to retreive 'the previous 1
TB from that same disk'.
Law enforcement and secret service operate by standards, quite
different from a disk manufacturer's.
A security officer you should keep that in mind :-)

--
Kind regards,
Gerard Bok

[Unruh]

bok118@zonnet.nl (Gerard Bok) writes:

>On Sat, 09 May 2009 05:24:59 GMT, Unruh
><unruh-spam@physics.ubc.ca> wrote:

>>"Non scrivetemi" <nonscrivetemi@pboxmix.winstonsmith.info> writes:

>>>When data have been physically overwritten on a hard disk it is
>>>generally assumed that the previous data are no longer possible to
>>>recover.
>>Disks now try to use all of the real estate on thedisk to store data, and use
>>highly efficient algorithms to use all of the information on the disk
>>productively, trather than redundantly. Ie, If it were possible to recover the
>>data, that dual level of data ( both the current data and the previous data are
>>recoverable) could be used to store current data. And manufacturers try very very
>>hard not to waste storage capacity.

>True. But you are missing a vital ingredient here: money.

>Disk manufacturers have no incentive to put 'as many data as
>physically possible' on a disk. They (and we all) go for 'as many
>data for a buck as feasable'.

Oh yes they do. ?There is a huge competition between disk manufacturers.
Do you really thing that 1TB on a 3.5 inch disk comes from "manufacturers
that have no icentive to put as much as physically possible on a disk" When Guttman
wrote the max disk size lwas a few GB or less.
>Which means in current terms that 1 TB goes for say $ 100.
Which means that they spend huge amounts to make sure that they yuse every little bit of the physical
real estate.

>While it might cost another $ 100.000 to retreive 'the previous 1
>TB from that same disk'.

Just not there.
>Law enforcement and secret service operate by standards, quite
>different from a disk manufacturer's.

They are Hugely more constrained by finacial costs than you are. Prosecutorial services
are always short of funds, and spending huge sums on some some evidentiary goose chase
is not looked on kindly by the paymasters.

>A security officer you should keep that in mind :-)

>--
>Kind regards,
>Gerard Bok

[Gerard Bok]

On Sat, 09 May 2009 14:02:30 -0400, Jo Jitty
<JoJittyN0SPAM@aol.com> wrote:

>Gerard Bok wrote:
>> On Sat, 09 May 2009 05:24:59 GMT, Unruh
>> <unruh-spam@physics.ubc.ca> wrote:
>>
>>
>>>"Non scrivetemi" <nonscrivetemi@pboxmix.winstonsmith.info> writes:
>>
>>
>>>>When data have been physically overwritten on a hard disk it is
>>>>generally assumed that the previous data are no longer possible to
>>>>recover.
>>>
>>>Disks now try to use all of the real estate on thedisk to store data, and use
>>>highly efficient algorithms to use all of the information on the disk
>>>productively, trather than redundantly. Ie, If it were possible to recover the
>>>data, that dual level of data ( both the current data and the previous data are
>>>recoverable) could be used to store current data. And manufacturers try very very
>>>hard not to waste storage capacity.
>>
>>
>> True. But you are missing a vital ingredient here: money.
>>
>> Disk manufacturers have no incentive to put 'as many data as
>> physically possible' on a disk. They (and we all) go for 'as many
>> data for a buck as feasable'.
>> Which means in current terms that 1 TB goes for say $ 100.
>> While it might cost another $ 100.000 to retreive 'the previous 1
>> TB from that same disk'.
>> Law enforcement and secret service operate by standards, quite
>> different from a disk manufacturer's.
>> A security officer you should keep that in mind :-)
>>
>LOL, in the US who needs evidence!

I was under the impression that the answer to this question reads

"that totally depends on who you are working for".
But then, I am no US citizen ;-)

--
Kind regards,
Gerard Bok

[Gerard Bok]

On Sat, 09 May 2009 14:30:14 GMT, Unruh
<unruh-spam@physics.ubc.ca> wrote:

>bok118@zonnet.nl (Gerard Bok) writes:
>
>>On Sat, 09 May 2009 05:24:59 GMT, Unruh
>><unruh-spam@physics.ubc.ca> wrote:
>
>>>"Non scrivetemi" <nonscrivetemi@pboxmix.winstonsmith.info> writes:
>
>>>>When data have been physically overwritten on a hard disk it is
>>>>generally assumed that the previous data are no longer possible to
>>>>recover.
>>>Disks now try to use all of the real estate on thedisk to store data, and use
>>>highly efficient algorithms to use all of the information on the disk
>>>productively, trather than redundantly. Ie, If it were possible to recover the
>>>data, that dual level of data ( both the current data and the previous data are
>>>recoverable) could be used to store current data. And manufacturers try very very
>>>hard not to waste storage capacity.
>
>>True. But you are missing a vital ingredient here: money.
>
>>Disk manufacturers have no incentive to put 'as many data as
>>physically possible' on a disk. They (and we all) go for 'as many
>>data for a buck as feasable'.
>
>Oh yes they do. ?There is a huge competition between disk manufacturers.
>Do you really thing that 1TB on a 3.5 inch disk comes from "manufacturers
>that have no icentive to put as much as physically possible on a disk"

As I said: They are in business. Their line of thought is not
'physically possible" but "commercially viable".

>Prosecutorial services are always short of funds,

That's simply not true.
Prosecutorial services are driven by politics.
(Whether or not funds are available in a certain case often just
depends on how far the next elections are off.)

--
Kind regards,
Gerard Bok

[Jo Jitty]

Gerard Bok wrote:
> On Sat, 09 May 2009 05:24:59 GMT, Unruh
> <unruh-spam@physics.ubc.ca> wrote:
>
>
>>"Non scrivetemi" <nonscrivetemi@pboxmix.winstonsmith.info> writes:
>
>
>>>When data have been physically overwritten on a hard disk it is
>>>generally assumed that the previous data are no longer possible to
>>>recover.
>>
>>Disks now try to use all of the real estate on thedisk to store data, and use
>>highly efficient algorithms to use all of the information on the disk
>>productively, trather than redundantly. Ie, If it were possible to recover the
>>data, that dual level of data ( both the current data and the previous data are
>>recoverable) could be used to store current data. And manufacturers try very very
>>hard not to waste storage capacity.
>
>
> True. But you are missing a vital ingredient here: money.
>
> Disk manufacturers have no incentive to put 'as many data as
> physically possible' on a disk. They (and we all) go for 'as many
> data for a buck as feasable'.
> Which means in current terms that 1 TB goes for say $ 100.
> While it might cost another $ 100.000 to retreive 'the previous 1
> TB from that same disk'.
> Law enforcement and secret service operate by standards, quite
> different from a disk manufacturer's.
> A security officer you should keep that in mind :-)
>
LOL, in the US who needs evidence!

[Justin Thyme]

On Sat, 09 May 2009 15:29:20 GMT, bok118@zonnet.nl (Gerard Bok) wrote:


>
>That's simply not true.
>Prosecutorial services are driven by politics.
>(Whether or not funds are available in a certain case often just
>depends on how far the next elections are off.)

Actually, I don't think prosecutors are the main customers for this
sort of thing. It would be tricky to get a conviction for "possession"
of something that you don't have access to. Most of us don't have a
scanning electron microscope and can't access anything requiring one.
Investigators are another matter, if the disk contains clues to where
other information might be found.

J. T.