View Full Version : Deleted a file by mistake ?
Just read a comment about "lost pictures", don't know what that was about but some may not be aware that if pictures are deleted by mistake, they are still there till overwritten with new info. To be able to see them again you can buy "recovery" software or get a lab to do it for you.
Sometimes this will also work when the camera or your reader reports "damaged" files. Or you may see part of the picture but not the rest.
Some recovery programmes are better than others, so if one does not work try another.
A common cause for damaged files is switching the camera off whilst it is still writing them, usually a light blinks during the operation.
BTW, this is also true for "deleted" files in your computer...
Franco
JokerJersey
05-20-2009, 19:59
Actually, depending how good the recovery software is, it is still possible on occasion to recover data that has been over written. That is how federal agencies are able to recover files long since deleted and over written when investigating cases of cyber crime.
It's one of the main reasons that the DoD standard for overwriting hard drives includes a regimen of writing and erasing random data patterns over the entire drive using a looping method that can include up to 99+ passes over a single drive. Even after that, with drives that contained sensitive material, we were often instructed to disassemble the drive itself, remove the platters inside, scratch them completely around with sand paper, then fold them into quarters with a sledge hammer.
Actually, depending how good the recovery software is, it is still possible on occasion to recover data that has been over written. That is how federal agencies are able to recover files long since deleted and over written when investigating cases of cyber crime.
It's one of the main reasons that the DoD standard for overwriting hard drives includes a regimen of writing and erasing random data patterns over the entire drive using a looping method that can include up to 99+ passes over a single drive. Even after that, with drives that contained sensitive material, we were often instructed to disassemble the drive itself, remove the platters inside, scratch them completely around with sand paper, then fold them into quarters with a sledge hammer.
This was once true, but hasn't been for some time now. The data density on modern hard drives is too high to do recovery of even once overwritten data. The multiple overwrite suggestions are an anachronism.
http://hardware.slashdot.org/article.pl?sid=08/01/28/1610202
Im guessing you work at a fort connected to an airport Joker? ;)
This was once true, but hasn't been for some time now. The data density on modern hard drives is too high to do recovery of even once overwritten data. The multiple overwrite suggestions are an anachronism.
http://hardware.slashdot.org/article.pl?sid=08/01/28/1610202
doh wrong link
http://www.cs.auckland.ac.nz/~pgut001/pubs/secure_del.html
"with the ever-increasing data density on disk platters and a corresponding reduction in feature size and use of exotic techniques to record data on the medium, it's unlikely that anything can be recovered from any recent drive except perhaps a single level via basic error-cancelling techniques. In particular the drives in use at the time that this paper was originally written have mostly fallen out of use, so the methods that applied specifically to the older, lower-density technology don't apply any more"
There hasn't actually been a documented case of data recovery from overwritten data since the days of the MFM hard drive.
JokerJersey
05-20-2009, 21:11
doh wrong link
http://www.cs.auckland.ac.nz/~pgut001/pubs/secure_del.html
"with the ever-increasing data density on disk platters and a corresponding reduction in feature size and use of exotic techniques to record data on the medium, it's unlikely that anything can be recovered from any recent drive except perhaps a single level via basic error-cancelling techniques. In particular the drives in use at the time that this paper was originally written have mostly fallen out of use, so the methods that applied specifically to the older, lower-density technology don't apply any more"
There hasn't actually been a documented case of data recovery from overwritten data since the days of the MFM hard drive.
Eh, if you say so brother. I know for certain that less than a year ago, I encountered a case of child pornography on a computer that I worked on at the shop where I worked. After discovering a couple of files, we called the local FBI field office. Two agents showed up later that day to collect the computer. After the cases was closed, one of the two agents returned and thanked us for our help and using federal software, were able to recompile files on the computer dating back 5 years.
Also, less than 6 months ago, I recieved a computer with a serious virus infection. The customer told me they didn't need any data on the drive, so instead of trying to repair the problem, I simply reformatted, did a single pass rewrite to zero the drive and boot sector to make sure the virus hadn't replicated in hidden partitions, reinstalled the OS and called it good. Later that day, I was called back by the customer frantically telling me they had pictures on there they just couldn't lose, which they thought they had backups of but didn't. Using civilian software, I was able to easily recover a good 80-85% of the information even after doing a single pass rewrite of the drive.
So, you can believe whatever you'd like (not saying that in a bad way), but I know from personal experience that it can be done.
@Foyt20 - Na, I'm a former Marine that was stationed at Camp Pendleton with 9th Comm Bn. One of the sections of the Comm Elec. Maint. platoon that I was a part of was Crypto repair. Since I worked on the computer side of things, on occasion we were given hard drives from machines that had failed that needed to be destroyed and that was how we took care of them.
JokerJersey
05-20-2009, 21:15
doh wrong link
http://www.cs.auckland.ac.nz/~pgut001/pubs/secure_del.html
"with the ever-increasing data density on disk platters and a corresponding reduction in feature size and use of exotic techniques to record data on the medium, it's unlikely that anything can be recovered from any recent drive except perhaps a single level via basic error-cancelling techniques. In particular the drives in use at the time that this paper was originally written have mostly fallen out of use, so the methods that applied specifically to the older, lower-density technology don't apply any more"
There hasn't actually been a documented case of data recovery from overwritten data since the days of the MFM hard drive.
Now, if the report you are citing is talking about SSD (solid state drives), then yes, I'd completely agree with that.
WalkingStick75
05-20-2009, 21:43
Ah lets keep it simple, Joker I agree with you but for the normal person if you delete a picture by accident first of all quit using that card so you do not overwrite the picture. If you are a linux user DD the disk and use a free program from diskinternals research to recover. Windows user? I have had good luck with restore2000pro reasonable price under 50 bucks I think.
Eh, if you say so brother. I know for certain that less than a year ago, I encountered a case of child pornography on a computer that I worked on at the shop where I worked. After discovering a couple of files, we called the local FBI field office. Two agents showed up later that day to collect the computer. After the cases was closed, one of the two agents returned and thanked us for our help and using federal software, were able to recompile files on the computer dating back 5 years.
Also, less than 6 months ago, I recieved a computer with a serious virus infection. The customer told me they didn't need any data on the drive, so instead of trying to repair the problem, I simply reformatted, did a single pass rewrite to zero the drive and boot sector to make sure the virus hadn't replicated in hidden partitions, reinstalled the OS and called it good. Later that day, I was called back by the customer frantically telling me they had pictures on there they just couldn't lose, which they thought they had backups of but didn't. Using civilian software, I was able to easily recover a good 80-85% of the information even after doing a single pass rewrite of the drive.
So, you can believe whatever you'd like (not saying that in a bad way), but I know from personal experience that it can be done.
@Foyt20 - Na, I'm a former Marine that was stationed at Camp Pendleton with 9th Comm Bn. One of the sections of the Comm Elec. Maint. platoon that I was a part of was Crypto repair. Since I worked on the computer side of things, on occasion we were given hard drives from machines that had failed that needed to be destroyed and that was how we took care of them.
Deleting a file in windows does not = "overwriting" (Deleting a file in windows simply removes it's FAT entry and overwrites a few bytes in the filename, and doesn't overwrite any file information at all.)
Formatting a hard drive does not = "overwriting" (Even a full format doesn't write zeroes over the drive, contrary to popular belief)
http://16systems.com/zero.php
JokerJersey
05-20-2009, 22:57
Yeah, no kidding. Seriously, you don't need to link me information. Depending on the type of format or deletion method you use, it gets progressively harder to retrieve information. I'll give you that. If you use certain methods, it is next to impossible to retrieve things, but still not impossible depending on the level of hardware and software you have (talking military/gov't grade).
Most end users will never, ever use methods like that. You are arguing a point that I concede to that has no bearing on this post. This guy is talking about deleting a file from Windows.
I deleted the info on my old hard drive by dropping the hard drive in a half full bucket of old white paint that I didn't need anymore. Then put the lid back on the bucket and shook it up some. Go ahead, try to recover that data.
Panzer :D
Yeah, no kidding. Seriously, you don't need to link me information. Depending on the type of format or deletion method you use, it gets progressively harder to retrieve information. I'll give you that. If you use certain methods, it is next to impossible to retrieve things, but still not impossible depending on the level of hardware and software you have (talking military/gov't grade).
the "Great Zero Challenge" is just a one-pass of zeroes. No data recovery service has ever been able to recover data even after one single pass. (not since the MFM/RLL formatted days)
Most end users will never, ever use methods like that. You are arguing a point that I concede to that has no bearing on this post. This guy is talking about deleting a file from Windows.True, I was responding to a claim that "overwritten" data could be recovered... it's never been done.
http://tokiwa.qee.jp/EN/DataRecovery_EN.zip
This should work for most NTFS drives and FAT formatted memory cards. I've used it to recover data from my Cannon FS100 after a power failure while recording.
WalkingStick75
05-21-2009, 08:59
I deleted the info on my old hard drive by dropping the hard drive in a half full bucket of old white paint that I didn't need anymore. Then put the lid back on the bucket and shook it up some. Go ahead, try to recover that data.
Panzer :D
OK, I never actually tried a recovery under these circumstances but I think once the connection was cleaned up it could be done.
A couple of hints about recovering data:
There are some free programs that you can find on the internet that work really well... find them and install them BEFORE YOU NEED THEM!
When you "delete" a file, the information is all still there, but a little tag is attached to the file saying that it is ok to write over that section of the disk. You really don't want to try installing a new program when you have to undelete a file because installing a program may write over the file you were trying to undelete!
(Note: this only matters if the deleted file is on your C: drive - if the file is on a thumb drive, it is ok to install a program on your computer).
As soon as you realize you deleted the file, STOP WHATEVER ELSE YOU ARE DOING ON THE DRIVE WITH THE DELETED FILES! You don't want to overwrite the deleted file by downloading music, saving new documents, opening new programs, taking more pictures, etc.
Run your file recovery program. If you catch it quickly and haven't saved any new files to your computer (or drive), you stand a very good chance of recovering the files.
My wife called me at work one day last year, crying. She had accidentally erased about 40 pictures of my brother's wedding off a thumb drive and she felt horrible about it. I told her to stop using the thumb drive right NOW! Don't transfer any more pictures to or from the drive! I had a file recovery program on my computer already (a free one I found on the internet, can't think of the name of it right now) and I was able to recover every single picture from my brother's wedding. :sun She was so grateful that she made it up to me later that night.:D
I deleted the info on my old hard drive by dropping the hard drive in a half full bucket of old white paint that I didn't need anymore. Then put the lid back on the bucket and shook it up some. Go ahead, try to recover that data.
Panzer :D
A company with the correct equipment could retrieve that data. There are services out there that can retrieve data off of burnt platters, and HD's that have been crushed in earthquakes and building collapses. As long as the platters can be retrieved, they can be cleaned up and put into another case of the same make, and work again. There is some very good data recovery programs out there :D
@Foyt20 - Na, I'm a former Marine that was stationed at Camp Pendleton with 9th Comm Bn. One of the sections of the Comm Elec. Maint. platoon that I was a part of was Crypto repair. Since I worked on the computer side of things, on occasion we were given hard drives from machines that had failed that needed to be destroyed and that was how we took care of them.
Well that explains it. From your location, I thought maybe you were a contractor at Ft. Dix, or McGuire ;) :banana