Naslov

The fact that we could even recover data from a formatted Hard Drive is kind of amazing. You choose (or not) to delete data, but it is still there, even if it is not that easy to read.

The purpose of this paper is to understand how data recovery works. To do so, we explain the steps and some technics. We will go through how a sinister leading to a try for data recovery can occur. Then, we will see a method that could have been used by computer forensics experts in order to find traces. To finish, we will mention methods to definitely erase data from Hard Drives to avoid leaving traces.

The reasons for those sinisters are numerous, but human mistakes are majorly involved. Peter Gutmann proposed through his papers an explanation of how this data could still be read on Hard Drives at that time, but also some advices to securely erase data.

This paper is some kind of a warning to all those selling Hard Drives via eBay that once contained personal data.

Keywords: recovery; data; traces

Uredi

Uredi

Data recovery consists of finding lost digital information. This loss may have various causes such as human mistake or material failure. The difficulty of the recovery of this data varies, but it may be a challenge.

What is at stake depends on the case. If we are dealing with a private person, the reasons for the willing of retrieving these data are mainly personal attachment to the files (holiday photos and videos). However, if we are talking of a company, then this seems much more important since data loss is the second threat to cloud security and 60% of companies that lose their data shut down within 6 months of this disaster.

In case of an accidentally deleted file, this file is not really removed from the guilty computer. What is really deleted is the path useful to grant access to the file. The space is now available again to re-write on it. But the data corresponding to this file is still stored, until something is stored at the same place. This means that you may be able to restore this data, even months later if no other file overwrote it.

Uredi

Uredi

Uredi

Uredi

Uredi

Uredi

Uredi

Uredi

Uredi

Uredi

Uredi

Uredi

Uredi

Uredi