BleepingComputer.com: Recovering Files Deleted With Wipe It

HI all -

I'm hoping somebody out there has a brilliant solution to my problem - we had an employee decide to test out the software program wipe it on his computer. So he deleted some critical files and forgot to back them up. Well now I need to recover the data that was removed. I have been able to recover files, unfortunately the files contain special characters through out (looks like this: ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ). So this is a bit of a problem. Details I can provide are that the software wipe it was run 6 times with a simple wipe enabled. I have full access to the hard drive that was cleaned and am hoping somebody might know of some software that will recover the lost data.

OS: XP pro, sp2 - on a domain.

Not sure what other information you might need - please let me know.

thanks!

Lirria

Moderator Edit: Moved topic to the more appropriate forum. ~ Animal

This post has been edited by Animal: 07 September 2007 - 12:17 PM

I have no personal experience with WipeIt, but it appears that WipeIt was used to "sanitise" your hard drive;"The process of sanitizing a drive means overwriting each track several times to erase the data that was previously there."
http://www.skylarkutilities.com/wipe-it/home.html

Apparently from your post, the files in question were overwritten six times. This makes them practically unrecoverable except by a computer forensic expert to whom you will pay a high price for the service.

It may be that another Member who has more experience using the application in question can provide additional help. In any case, it would be important not to do ANYTHING to the hard drive; if possible, do not even turn the computer on, as it might add to the problem of retrieving any file.

Regards,
John

According to secureclean 4.0 (competitor program) seven overwrites is the US DOD standard. It sounds to me like these files are gone for good.

As jg and dan have said, the contents of the files will not be able to be recovered by software, only (possibly) by very expensive forensic techniques. If they are vital business files that justify the expense, it seems you will at least have the advantage of it being a simple wipe. That usually means the data has been overwritten the stated number of times with the same character, rather than a pattern designed to repeatedly toggle all the data bits, and nothing further has been done to remove the file identifying information - file directory entries and allocation table chains/file table data. This does mean it may be easier than it otherwise would be for a forensic recovery lab to scan the file locations with a magnetic microscope and identify the remnants of the previous data prior to the wipe.

But if the significance of the data doesn't justify spending large amounts of money for recovery, then it's gone. That is the whole purpose of that type of program, after all...

Yeah, that's kinda what I figured - I was just hoping. Now I wish I still had my connections to the forensic unit I use to work with - they had all the cool software. Oh well - I'll let the COO decide if he wants to really recover the data or not.

Thank you for all the input!!

Lirria