Page 41 - index

The other main method of deleting data is to physically break the hard drive by opening it and
smashing the magnetic platter. This method is probably the most effective as putting back the
platter together might be impossible if pieces are missing.

How to recover deleted / formatted data.

One of the most common methods of recovering deleted / formatted data is to use Disk imaging
tools. Those tools come in the form of software which are capable of many tasks, from
recovering images of damaged data to retying bad blocks on failing hard drives. This sort of
software can also recover a hard drive by cloning the information byte to byte onto another hard
drive, allowing the user to recuperate and access the data.

Other software used to recuperate data takes place in the form of Forensics software. Similar to
disk imaging tools, forensics software goes further by looking for specific types of files which are
most known to contain evidence of cybercrime (photo files such as JPEG…). This software then
recreates the files similarly to disk imaging tools, going through a byte to byte process. Because
this sort of software is more specific to forensics investigations, it is better aimed at the specifics
of cybercrime, making it more efficient and faster at reconstructing incriminating data.

Another method is Data recovery software, which works similarly to the software mentioned
above. This software can restore access to emails, photos, documents and even executable
files. File recovery basically recycles information which hasn’t been fully deleted, allowing to
recover files and even their folder structure in some cases.

It is worth mentioning that using software solutions will not always guarantee a full recovery of
all the files, as some might have been replaced on the magnetic platter, making the byte-to-byte
data unavailable to recuperate.

Physically broken drives on the other side are a more complex matter as they required physical
interaction to recuperate. Hard drives are very fragile, and exposure of the magnetic platter to
natural elements such as dust and finger prints can make the data irrecoverable. This is why
broken drives are mostly given to hard drive recovery professionals as they are not only
equipped for this, they also have the skills to deal with recuperating data from broken hard
drives.

Are all drives recoverable?

Of course there are other forms of data storage such as Solid State Drives, USB flash drives,
SD cards and Compact disks. Even though some of them work differently to classic mechanical
hard drives, software solutions do encompass those types of drives.

Flash memory software tools work similarly to forensics software in the way that they are
designed to try to recuperate specific file formats (images, videos contained on SD cards and
USB flash drives). They are however not always geared to recuperate day to day files such as
archives and documents.

41 Cyber Warnings E-Magazine – August 2015 Edition
Copyright © Cyber Defense Magazine, All rights reserved worldwide