Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Recovering Files Deleted With Wipe It


  • Please log in to reply
4 replies to this topic

#1 Lirria

Lirria

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:01:42 AM

Posted 07 September 2007 - 11:03 AM

HI all -

I'm hoping somebody out there has a brilliant solution to my problem - we had an employee decide to test out the software program wipe it on his computer. So he deleted some critical files and forgot to back them up. Well now I need to recover the data that was removed. I have been able to recover files, unfortunately the files contain special characters through out (looks like this: ). So this is a bit of a problem. Details I can provide are that the software wipe it was run 6 times with a simple wipe enabled. I have full access to the hard drive that was cleaned and am hoping somebody might know of some software that will recover the lost data.

OS: XP pro, sp2 - on a domain.

Not sure what other information you might need - please let me know.

thanks!

Lirria

Moderator Edit: Moved topic to the more appropriate forum. ~ Animal

Edited by Animal, 07 September 2007 - 12:17 PM.


BC AdBot (Login to Remove)

 


m

#2 jgweed

jgweed

  • Staff Emeritus
  • 28,473 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Chicago, Il.
  • Local time:02:42 AM

Posted 07 September 2007 - 11:17 AM

I have no personal experience with WipeIt, but it appears that WipeIt was used to "sanitise" your hard drive;"The process of sanitizing a drive means overwriting each track several times to erase the data that was previously there."
http://www.skylarkutilities.com/wipe-it/home.html

Apparently from your post, the files in question were overwritten six times. This makes them practically unrecoverable except by a computer forensic expert to whom you will pay a high price for the service.

It may be that another Member who has more experience using the application in question can provide additional help. In any case, it would be important not to do ANYTHING to the hard drive; if possible, do not even turn the computer on, as it might add to the problem of retrieving any file.

Regards,
John
Whereof one cannot speak, thereof one should be silent.

#3 DanC1186

DanC1186

  • Members
  • 82 posts
  • OFFLINE
  •  
  • Local time:02:42 AM

Posted 07 September 2007 - 01:53 PM

According to secureclean 4.0 (competitor program) seven overwrites is the US DOD standard. It sounds to me like these files are gone for good.

#4 Platypus

Platypus

  • Moderator
  • 12,862 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Australia
  • Local time:06:42 PM

Posted 08 September 2007 - 06:10 AM

As jg and dan have said, the contents of the files will not be able to be recovered by software, only (possibly) by very expensive forensic techniques. If they are vital business files that justify the expense, it seems you will at least have the advantage of it being a simple wipe. That usually means the data has been overwritten the stated number of times with the same character, rather than a pattern designed to repeatedly toggle all the data bits, and nothing further has been done to remove the file identifying information - file directory entries and allocation table chains/file table data. This does mean it may be easier than it otherwise would be for a forensic recovery lab to scan the file locations with a magnetic microscope and identify the remnants of the previous data prior to the wipe.

But if the significance of the data doesn't justify spending large amounts of money for recovery, then it's gone. That is the whole purpose of that type of program, after all... :thumbsup:

Top 5 things that never get done:

1.


#5 Lirria

Lirria
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:01:42 AM

Posted 09 September 2007 - 07:24 PM

Yeah, that's kinda what I figured - I was just hoping. Now I wish I still had my connections to the forensic unit I use to work with - they had all the cool software. Oh well - I'll let the COO decide if he wants to really recover the data or not.

Thank you for all the input!!

Lirria




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users