Hard drive data recovery

[GeneralB44]

I remember that a few of you here are also LAN Admin type guys like me, so I'm hoping you can help.

My company's info security is worried that if a hard drive is formatted normally, and has Windows reinstalled, that data can still be recovered from the previous Windows installation. I've heard that this is possible, but I haven't seen it myself.

I tried EasyRecovery Pro from some company called ONTRACK, and it didn't find anything from the previous windows installation.

Do any of you guys have any recovery/undelete tools to recommend?

Thanks!
Brendan

 

[We4ster]

Feds use Logicube To Search for Evidence/recover data .

www.logicube.com

 

[JoeNational]

If you format you erase there should be no recovery of any sorts, any time we format and re-image there is no trace, i even test after every format to make sure, since one user would have stuff another user should not see.

 

[We4ster]

Joe,

Thats a misconception, data can be recovered from simple reformat and reinstall of software. There are government and state agencies that use software to recover data from PC's that have been taken in hacking cases.

 

[JoeNational]

So in other words if i format a HD that had win xp on it and than re-install win xp on that same machine after a succesfull format i should be able to recover the data from that previos install? or i will be able to recover the data after a succesfull re-install using the recover data software? i think ive confused myself lol

 

[We4ster]

The answer is YES!

 

[gn85]

I've heard the recomendation that if you sell a computer to someone you should either keep the hard drive or drill holes in it to keep the data from being recoverable.

 

[tjthorson]

The only sure-fire way is to get yourself a data scrubber.

They actually write blank zeroes into every sector of the hard disk - but it takes time. A low-level format will also accomplish the same task. Look at:

http://staff.washington.edu/jdlarios/autoclave/

for a free one.

 

[GeneralB44]

Cool - thanks. Our company does drill holes in hard drives before sending the machines outside of the company, but internal stuff we never bothered with massive wiping - just reinstalling for redeployment.

Time for the 3rd party util eval!

Oh - I read in my research that low level formatting can't really be done on a normal IDE controller - it's done w/ special equipment or something. I dunno.

What a lot of people call "low level formatting" is actually just writing all zero's to the drive ("zero-fill").

I actually took a machine, FDISK'd to remove the partition, then recreated a new partition and ran FORMAT /U on it. I then slaved the drive to another machine, and used a recovery tool to get some data off the partition that had been formatted! It didn't get a lot of data, but it did get some. Crazy!

 

[Black Box]

What if you run the government wipe (DOD 5220.22-M) in Norton Systemworks? Does that completely eliminate data to the point of being unrecoverable?

Steve