Questions tagged [data-recovery]

For questions generally relating to recovery of "plain" data from digital storage, when that storage has been damaged or the credentials securing it are lost.

Data recovery is usually required in one of two cases:

  • Data was stored in a persistent mechanism such as a magnetic medium or flash memory, and that storage media has become damaged so that it cannot be read normally.

  • Data was stored in an obfuscated state, such as having been encrypted, and the key or credentials needed to recover the data have been lost.

In IT Security, questions asked are usually concerned with the second reason; recovery of data from an encrypted or hashed state (questions relating to recovery of data from damaged storage are usually asked on the Super User or Server Fault SE sites). This goal is usually frustrated by the very purpose of such methods; to make it infeasibly difficult to obtain the "plaintext" from the "ciphertext" or "hash".

Some common data encryption systems, especially those used to protect user accounts, have some sort of recovery option built in. This "back door" is designed to allow an administrator an alternate way to retrieve the data using their own credentials or other high-level secrets. However, many systems that place a primary emphasis on account or data security, provide only one efficient way to retrieve the data; know the password. Without a "back door", administrators or other "white hats" attempting to get the data for innocent purposes are limited to using the same "attacks" that someone with nefarious goals would have: "brute-force" cracking, or any documented attacks on the specific encryption scheme used by the system.

203 questions
210
votes
10 answers

What should you do if you catch encryption ransomware mid-operation?

You boot up your computer one day and while using it you notice that your drive is unusually busy. You check the System Monitor and notice that an unknown process is using the CPU and both reading and writing a lot to the drive. You immediately do a…
Fiksdal
  • 3,127
  • 3
  • 22
  • 29
68
votes
7 answers

Can RAM retain data after removal?

Is it possible for RAM to retain any data after power is removed? I don't mean within a few minutes such as cold boot Attacks but rather 24 hours plus. Working with classified systems the policy always seems to treat RAM the same as disks and must…
MattP
  • 783
  • 1
  • 6
  • 7
45
votes
3 answers

Should we keep logs forever to investigate past data breaches?

Listening to the Secure code lessons from Have I Been Pwned made me really think about logging. It appears that in the real world a lot of data breaches are discovered long after they happened which makes the investigation and recovery much more…
alecxe
  • 1,635
  • 6
  • 20
  • 36
39
votes
7 answers

At what point is deleted data irrecoverable?

From reading around on the internet I get the impression that barring physical damage, deleted data can be always be recovered using sophisticated digital forensics. For this reason the advice is that you should encrypt your data. So at what point…
Yoshi
  • 407
  • 1
  • 4
  • 3
34
votes
7 answers

Is there any hope of getting my pictures back after an iPhone factory reset some day in the future?

Four months ago I lost all my data after an iTunes update automatically restored my phone to factory defaults. I lost all the pictures of my newborn. I understand that when you do a factory reset the decryption key is discarded so the data is…
Vivi
  • 351
  • 1
  • 3
  • 7
26
votes
3 answers

What happens when a TPM chip breaks or fails?

I read that a TPM (Trusted Platform Module) has some sort of burnt in key that it uses, along with the password you provide, to encrypt your data. The point is that you cannot decrypt your Hard Disk without the TPM (please correct me if I'm wrong).…
Fresco
  • 363
  • 1
  • 3
  • 4
19
votes
4 answers

Why is writing zeros (or random data) over a hard drive used when writing all ones is more beneficial?

As far as I know, in order to securely delete the hard drive's contents, one should fill it with zeroes or, for added security and harder recoverability, random data first and then all zeroes. In order to get rid of all the data wouldn't be simpler…
Serban Razvan
  • 309
  • 1
  • 2
  • 5
19
votes
2 answers

Is Data Remanence a Myth?

Possible Duplicate: Why is writing zeros (or random data) over a hard drive multiple times better than just doing it once? Multiple overwrites have often been discussed as a secure way of erasing data. Some people say that the only way to securely…
lynks
  • 10,747
  • 5
  • 33
  • 55
19
votes
4 answers

Securely erasing personal data from Android phone before selling

I have just sold online my old Nexus 5 (Android Lolipop) and need to post it tomorrow morning. I would like to make sure the new owner can't access my files. What should I do?
user69377
17
votes
3 answers

Is there a real-world example of SSD data recovery?

Secure data deletion is known to be more complicated and elusive on a solid-state drive than for a regular hard drive. For instance, the logical block mapping on the SSD's flash translation layer makes it impossible to reliably overwrite specific…
Arminius
  • 45,195
  • 14
  • 148
  • 140
14
votes
2 answers

Recovery of EEPROM data after bulk erase operation

I am aware of research which shows that single (or sometimes double) random overwrites on a magnetic hard drive is enough to ensure data is not recoverable, but is there any research into the recovery of data stored in an EEPROM after the…
forest
  • 68,079
  • 20
  • 223
  • 298
13
votes
4 answers

How can data from VirtualBox leak to the host and how to avoid it?

I used a virtual machine (Windows host/Linux mint guest) to store some very sensitive and private data (it shouldn't be uncovered by state-level actors). Today I decided to check how much deleted files can be recovered from my host system using a…
Sonozaki
  • 157
  • 1
  • 7
10
votes
3 answers

Is filling up the empty space in a disk with any data enough measure against file recovery

If I have an important data in a disk (flash, SSD or HDD) and I deleted them, I know it is easy to recover these deleted data (even by using free software like recuva . Now if I fill this disk with any data, let's say a large movie file or so until…
user37714
10
votes
8 answers

Overwriting hard drive to securely delete a file?

I am working on a computer that I am not allowed to install new software on. It does not have secure delete software installed. Suppose I have a file (or files) that are sensitive that I'd like to delete and prevent (or make it very difficult) to…
Drew
  • 117
  • 1
  • 1
  • 3
10
votes
2 answers

Magnet to wipe HDD

This question is for HDD, not SDD. Would a Neodymium magnet like this one be strong enough to wipe the contents of a hard disk drive? How long would such an act take to destroy any data so it's not recoverable? Would it be possible to format and…
k1308517
  • 1,292
  • 1
  • 15
  • 28
1
2 3
…
13 14