Date post: | 13-May-2015 |
Category: |
Technology |
Upload: | bhaumikc |
View: | 685 times |
Download: | 2 times |
Data RecoveryData Recovery
Aakash MehtaAakash Mehta Bhaumik ChaudhariBhaumik Chaudhari 10IT02610IT026 10IT053 10IT053
Shankersinh Vaghela Bapu Shankersinh Vaghela Bapu Institute Of TechnologyInstitute Of Technology
Nov 22Nov 22ndnd, 2012, 2012
OverviewOverview
What is Data Recovery?What is Data Recovery? Disk StructureDisk Structure Software usedSoftware used Real World UsesReal World Uses Advantages & DisadvantagesAdvantages & Disadvantages Demo Demo
22Shankersinh Vaghela Bapu Shankersinh Vaghela Bapu
Institute Of TechnologyInstitute Of Technology
What is data recovery?What is data recovery?
Retrieving deleted/inaccessible data from Retrieving deleted/inaccessible data from electronic storage media (hard drives, removable electronic storage media (hard drives, removable media, optical devices, etc...)media, optical devices, etc...)
Typical causes of loss include:Typical causes of loss include: Computer VirusComputer Virus Data CorruptionData Corruption Computer CrimeComputer Crime Human ErrorHuman Error
33Shankersinh Vaghela Bapu Shankersinh Vaghela Bapu
Institute Of TechnologyInstitute Of Technology
Disk StructureDisk Structure
A. TrackA. Track
B. Geometrical SectorB. Geometrical Sector
C. Track SectorC. Track Sector
D. ClusterD. Cluster
44Shankersinh Vaghela Bapu Shankersinh Vaghela Bapu
Institute Of TechnologyInstitute Of Technology
Several forms of Disk Several forms of Disk StorageStorage
Comparison of Comparison of several forms of several forms of disk storage disk storage showing tracks.showing tracks.
Shankersinh Vaghela Bapu Shankersinh Vaghela Bapu Institute Of TechnologyInstitute Of Technology 55
How data is Stored ?How data is Stored ?
Data is stored into magnetic blocks which Data is stored into magnetic blocks which are in sectors.are in sectors.
Every time you format HDD, new layer is Every time you format HDD, new layer is created.created.
With the increase of layers memory blocks With the increase of layers memory blocks are also increased and it results to are also increased and it results to variations in data transfer(Speed variations in data transfer(Speed Decrease, Memory consumption high).Decrease, Memory consumption high).
Shankersinh Vaghela Bapu Shankersinh Vaghela Bapu Institute Of TechnologyInstitute Of Technology 66
How Data Is Recovered?How Data Is Recovered?
At the First time Low Level Format(LLF) is At the First time Low Level Format(LLF) is performed on the hard disk, the disk’s platters performed on the hard disk, the disk’s platters start out empty. That’s the last time the start out empty. That’s the last time the platters will be empty for the life of the drive.platters will be empty for the life of the drive.
If an LLF is done on a disk with data on it If an LLF is done on a disk with data on it already, the data is permanently erased.already, the data is permanently erased.
The type of formatting that most users are The type of formatting that most users are familiar with is called high-level formatting and familiar with is called high-level formatting and it is the process of setting up an empty file it is the process of setting up an empty file system.system.
Shankersinh Vaghela Bapu Shankersinh Vaghela Bapu Institute Of TechnologyInstitute Of Technology 77
How Data Is Recovered?How Data Is Recovered?
Data stored on the hard drive is not physically Data stored on the hard drive is not physically deleted during formatting.deleted during formatting.
The hard drive is re-organized and the table The hard drive is re-organized and the table with information where files are stored is with information where files are stored is reset.reset.
As long as the file system and its settings As long as the file system and its settings remain the same, none of the actual data remain the same, none of the actual data previously stored on the hard drive is deleted previously stored on the hard drive is deleted or overwritten can subsequently be or overwritten can subsequently be recovered. recovered.
Shankersinh Vaghela Bapu Shankersinh Vaghela Bapu Institute Of TechnologyInstitute Of Technology 88
How Data Is Recovered?How Data Is Recovered? When Data is overwritten, the magnetic domains When Data is overwritten, the magnetic domains
on the HDD are re-magnetized.on the HDD are re-magnetized. This is an irreversible process that physically This is an irreversible process that physically
removes information previously stored in this removes information previously stored in this location. location.
This would require the use of a Magnetic force This would require the use of a Magnetic force microscopy (MFM) or similar technologies, to microscopy (MFM) or similar technologies, to recover overwritten data successfully.recover overwritten data successfully.
There is no software or other technical way known There is no software or other technical way known to the public that can restore overwritten data.to the public that can restore overwritten data.
Shankersinh Vaghela Bapu Shankersinh Vaghela Bapu Institute Of TechnologyInstitute Of Technology 99
Software For Data Recovery Software For Data Recovery
Stellar Phoenix Windows Data RecoveryStellar Phoenix Windows Data Recovery
Stellar phoenix Linux Data RecoveryStellar phoenix Linux Data Recovery
Get Data Back-NTFSGet Data Back-NTFS
Get Data Back-FATGet Data Back-FAT
Shankersinh Vaghela Bapu Shankersinh Vaghela Bapu Institute Of TechnologyInstitute Of Technology 1010
Operating SystemsOperating Systems
Helix:Helix:- Helix is a Linux based forensics operating Helix is a Linux based forensics operating
system.system.- It is combined system used to analyse the It is combined system used to analyse the
file system and also generates the reports.file system and also generates the reports. Encase:Encase:- It is also very rich utility designed for the It is also very rich utility designed for the
professionals.professionals.
Shankersinh Vaghela Bapu Shankersinh Vaghela Bapu Institute Of TechnologyInstitute Of Technology 1111
Real World UsesReal World Uses
Average User:Average User: Recover important lost filesRecover important lost files Keep your private information privateKeep your private information private
Law enforcement:Law enforcement: Locate illegal dataLocate illegal data Restore deleted/overwritten information.Restore deleted/overwritten information. Prosecute criminals based on discovered Prosecute criminals based on discovered
datadata
1212Shankersinh Vaghela Bapu Shankersinh Vaghela Bapu
Institute Of TechnologyInstitute Of Technology
Advantages Advantages
Recover important data easily by using Recover important data easily by using various software.various software.
If you work for an organization than your If you work for an organization than your data should be most important and you data should be most important and you need to recover at any cost if it is lost. need to recover at any cost if it is lost.
Recover your personal photo's, files and Recover your personal photo's, files and etc which is precious to you.etc which is precious to you.
Shankersinh Vaghela Bapu Shankersinh Vaghela Bapu Institute Of TechnologyInstitute Of Technology 1313
DisadvantagesDisadvantages
There is no surety that There is no surety that all of the lost data all of the lost data can be recovered.can be recovered.
Shankersinh Vaghela Bapu Shankersinh Vaghela Bapu Institute Of TechnologyInstitute Of Technology 1414
Private Recovery ServicesPrivate Recovery Services
Many private companies offer quick, secure, Many private companies offer quick, secure, and confidential data recovery:and confidential data recovery: Computer Disk Service Computer Disk Service http://www.compdisk.com
20 GB from $195.0020 GB from $195.00 46 GB and up – from $895.0046 GB and up – from $895.00
Action Front Action Front http://www.datarec.com/ External cases - $500 to $1500External cases - $500 to $1500 Internal cases -$2500 to $4000 for a single hard driveInternal cases -$2500 to $4000 for a single hard drive Critical Response services start at $5,000.Critical Response services start at $5,000.
Data Recovery Services - Data Recovery Services - http://www.datarecovery.net/
1515Shankersinh Vaghela Bapu Shankersinh Vaghela Bapu
Institute Of TechnologyInstitute Of Technology
ReferencesReferences "Data Recovery Solutions". R3 Data Recovery. Retrieved 13 October 2012.. R3 Data Recovery. Retrieved 13 October 2012. "Computer Forensics Schools and Training". Legal-Criminal-Justice-Schools.com. . Legal-Criminal-Justice-Schools.com.
Retrieved 13 October 2012.Retrieved 13 October 2012. Zeno, Keneth (27 September 2011). Zeno, Keneth (27 September 2011). "How Does Data Recovery Work?". Data Recovery . Data Recovery
Box. Retrieved 29 February 2012.Box. Retrieved 29 February 2012. Secure Deletion of Data from Magnetic and Solid-State Memory, Peter Gutmann, , Peter Gutmann,
Department of Computer Science, University of AucklandDepartment of Computer Science, University of Auckland Data Remanence in Semiconductor Devices, Peter Gutmann, IBM T.J. Watson Research , Peter Gutmann, IBM T.J. Watson Research
CenterCenter Feenberg, Daniel (14 May 2004). Feenberg, Daniel (14 May 2004).
"Can Intelligence Agencies Read Overwritten Data? A response to Gutmann." . National . National Bureau of Economic Research. Retrieved 21 May 2008.Bureau of Economic Research. Retrieved 21 May 2008.
Data Removal and Erasure from Hard Disk Drives "Disk Wiping - One Pass is Enough""Disk Wiping - One Pass is Enough". Anti-Forensics. 17 March 2009.. Anti-Forensics. 17 March 2009. "Disk Wiping - One Pass is Enough - Part 2 (this time with screenshots)""Disk Wiping - One Pass is Enough - Part 2 (this time with screenshots)" . Anti-Forensics. . Anti-Forensics.
18 March 2009.18 March 2009. Wright, Dr. Craig (15 January 2009). Wright, Dr. Craig (15 January 2009). "Overwriting Hard Drive Data""Overwriting Hard Drive Data".. "Data Recovery Possible on Securely Erased SSDs""Data Recovery Possible on Securely Erased SSDs". Retrieved 22 November 2011.. Retrieved 22 November 2011.
Shankersinh Vaghela Bapu Shankersinh Vaghela Bapu Institute Of TechnologyInstitute Of Technology 1616
QUESTIONS?QUESTIONS?
1717Shankersinh Vaghela Bapu Shankersinh Vaghela Bapu
Institute Of TechnologyInstitute Of Technology