F
F
footballer2018-09-13 10:20:09
Data recovery
footballer, 2018-09-13 10:20:09

Unrecoverable deletion of data - how?

Does formatting a disk with the "fast" checkbox disabled in Windows physically delete the data on the disk so that it cannot be recovered? Judging by my experiment, it deletes, tk. recuva could not find the files. But if not "quick" formatting reliably deletes all data, then why do we need third-party utilities for reliable data deletion, such as revo uninstaller or recuva, which, it seems, are also slower than formatting? And if not "quick" formatting does not physically delete data, then how does it differ from "quick"?
Also, in utilities for reliable deletion, you can usually set the number of overwriting cycles in the settings, in recuva you can choose from 1 to 35. Why choose more than 1? Isn't the fact that we overwrote the file once with random data guaranteed that the file cannot be recovered? But the file has already been overwritten. How can it be restored after that?
And yet, I wiped the C drive with revo uninstaller, but recuva still found the files and even some could be viewed. Is it such a buggy revo app and can't be relied upon?

Answer the question

In order to leave comments, you need to log in

3 answer(s)
P
PrAw, 2018-09-13
@footballer

What remains of the file:
1. During a normal deletion, everything remains, it is still in the clusters on the disk, the file is marked "deleted" in the file allocation table, while the file name and information about the addresses of the clusters where it was stored are saved.
May be overwritten by any write operation that wants to write to the cluster previously occupied by the file. Or maybe not overwritten ...
2. When formatting a disk, the information of the file allocation table is deleted, the contents of the clusters remain almost unchanged. So there is a bunch of anonymous pieces of files on the disk. Plus, there is a chance that a piece of the file allocation table will remain in one of the clusters, and this will allow you to pull out files without any problems
3. When overwriting a file over random data, residual magnetization will be preserved - in laboratory conditions it will be possible to assume with a decent probability that it was there before. Repeated overwriting eliminates traces well.
4. When working with a file in the same %temp% or some other directories, there may be backup copies, intermediate data that can be restored without big problems.
5. If you change the file size down or overwrite a smaller file over - at the end of the cluster, the same content may remain.
Total: if you want to delete data with a guarantee - carborane acid .

V
Vladislav Lyskov, 2018-09-13
@Vlatqa

you can recover data not only with the help of recovery and similar programs, but also with the help of special programs. equipment that can recover data even after opening the hard drive

C
CityCat4, 2018-09-13
@CityCat4

But the file has already been overwritten. How can it be restored after that?

F - Physics.
There is such a thing as residual magnetization. Google.
Roughly speaking - you have a hole. If you throw a couple of shovels of soil into it, then by the shape of the walls and other signs, you can roughly guess what depth and shape it is. If you throw a dozen shovels, it will be more difficult. If you fall asleep to the brim and dig a new one in this place, it will become almost impossible.
Multiple overwriting does just that - "falls asleep" (deletes) the old "pit" (data) and "digs" (writes) a new one. And they are all different shapes and sizes. After several passes, it will become much more difficult to guess the shape and depth of the original hole.
But still - a more or less reliable way - it's either a very powerful EM pulse, or a disk in the microwave. True, after that they turn into bricks:

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question