On 18/08/15 14:21, Adrian Mageanu wrote:
[...] I can't remember where I read but there are ways to retrieve data after a dd fill with zeroes or something else by using photorec and some hardware forensic techniques. [...]
photorec is only for recovering deleted (as opposed to wiped) files, or for recovering files from a disk with damaged file system. But as it simply reads the data as presented by the disk it cannot do anything at all to recover data from a _wiped_ disk. (When you _delete_ a file only the file system entry is actually changed to pretend there is no file anymore, but all the content of the file is still there as before - and exactly that makes it possible for photorec and other deleted-file recovery tools to do their work.)
Hardware forensic techniques... hm, well, firstly there is no guarantee that you will be able to recover anything useful at all, even if you have infinite resource available. And as some have pointed out, if somebody has data worth so much that somebody else would be willing to invest a lot for possibly maybe recovering some of the data, then the original data owner would be well advised to physically obliterate the disk. That's usually also quicker and easier than wiping.
Kind regards, Helmut. _______________________________________________ Linux-users mailing list [email protected] http://lists.canterbury.ac.nz/mailman/listinfo/linux-users
