Results 1 to 7 of 7

Thread: Recover sdelete'd files?

  1. #1
    My life is this forum thorin's Avatar
    Join Date
    Jan 2010
    Posts
    2,629

    Default Recover sdelete'd files?

    Just curious if anyone out there has ever tried Helix, Encase, or whatever against a file (or files) which have been removed with sdelete?
    Microsoft/SysInternals SDelete
    I'm a compulsive post editor, you might wanna wait until my post has been online for 5-10 mins before quoting it as it will likely change.

    I know I seem harsh in some of my replies. SORRY! But if you're doing something illegal or posting something that seems to be obvious BS I'm going to call you on it.

  2. #2
    Super Moderator lupin's Avatar
    Join Date
    Jan 2010
    Posts
    2,943

    Default

    Quote Originally Posted by thorin View Post
    Just curious if anyone out there has ever tried Helix, Encase, or whatever against a file (or files) which have been removed with sdelete?
    Microsoft/SysInternals SDelete
    Haven't tried it, but theoretically I would think that this wouldn't be possible. Assuming that the disk sectors containing the file are correctly zeroed out by sdelete, you shouldn't be able to recover the old contents of those files via any software interface to the drive, as any software interface should only be able to return the current 1s and 0s that are represented on the drive itself.

    Concerning whether recovery is possible, I guess some of the questions are:
    • How well does sdelete zero out the appropriate disk sectors? Does it ever miss something?
    • Is there another copy of the file written somewhere else on disk, by either the OS or the application? Microsoft Office for example, writes temporary copies of files you are working on to the drive, and deletes (but doesn't overwrite) them once you finish your session.
    • Is it possible to use a hardware interface to the drive, to read the data that has bled out between tracks on the disk. The ability to do this may relate to how many overwrite passes are made (which seems to be configurable with the -p switch in sdelete). There's a post about reading disk contents in this way on the sansforensic blog by Dr Craig Wright from a few months back if you're interested.


    Post back if you give this a try, Id be interested in the result.
    Capitalisation is important. It's the difference between "Helping your brother Jack off a horse" and "Helping your brother jack off a horse".

    The Forum Rules, Forum FAQ and the BackTrack Wiki... learn them, love them, live them.

  3. #3
    Very good friend of the forum Gitsnik's Avatar
    Join Date
    Jan 2010
    Location
    The Crystal Wind
    Posts
    851

    Default

    Have tried it, didn't work (years ago now). Did manage to hex edit a partial file from the filesystem though - turns out that windows doesn't always keep fragments on disk where they belong when you edit them in place. Might be something to think about.

    To answer some of lupin's points, the sectors that were used seemed to be well zeroed out (you can check sectors with your hexeditor, then zero them and look again), but if the OS has paged them to different area's, it seems rather useless (which is why it should start out encrypted I think).

    Did I hear lately that there is no chance of electron/magnetic recovery anymore because we pack sectors too tightly these days?
    Still not underestimating the power...

    There is no such thing as bad information - There is truth in the data, so you sift it all, even the crap stuff.

  4. #4
    Super Moderator lupin's Avatar
    Join Date
    Jan 2010
    Posts
    2,943

    Default

    Quote Originally Posted by Gitsnik View Post
    but if the OS has paged them to different area's, it seems rather useless (which is why it should start out encrypted I think).
    Yes, paging to disk, another good point.

    Quote Originally Posted by Gitsnik View Post
    Did I hear lately that there is no chance of electron/magnetic recovery anymore because we pack sectors too tightly these days?
    That was my recollection. For modern disks anyway. If the disks are older (and smaller) this may still work however.
    Capitalisation is important. It's the difference between "Helping your brother Jack off a horse" and "Helping your brother jack off a horse".

    The Forum Rules, Forum FAQ and the BackTrack Wiki... learn them, love them, live them.

  5. #5
    My life is this forum thorin's Avatar
    Join Date
    Jan 2010
    Posts
    2,629

    Default

    Thanks guys.

    I know some out there are probably thinking, "why not just try it" ... it was simply an issue of time. I do ultimately plan to try it at some point but I was looking for a quick'ish answer for a colleague.

    Did I hear lately that there is no chance of electron/magnetic recovery anymore because we pack sectors too tightly these days?
    I've heard this argument but I haven't seen any actual research on the topic.
    I'm a compulsive post editor, you might wanna wait until my post has been online for 5-10 mins before quoting it as it will likely change.

    I know I seem harsh in some of my replies. SORRY! But if you're doing something illegal or posting something that seems to be obvious BS I'm going to call you on it.

  6. #6
    Super Moderator lupin's Avatar
    Join Date
    Jan 2010
    Posts
    2,943

    Default

    Quote Originally Posted by thorin View Post
    Thanks guys.

    I know some out there are probably thinking, "why not just try it" ... it was simply an issue of time. I do ultimately plan to try it at some point but I was looking for a quick'ish answer for a colleague.

    I've heard this argument but I haven't seen any actual research on the topic.
    Here the blog post from Craig Wright that I was referring to before - I decided to look it up to remind myself what the conclusion was about retrieving data via access to the platters. The gist of the whole thing is that properly erased data can't be recovered, even from older disks.

    Overwriting Hard Drive Data « SANS Computer Forensics, Investigation, and Response
    Capitalisation is important. It's the difference between "Helping your brother Jack off a horse" and "Helping your brother jack off a horse".

    The Forum Rules, Forum FAQ and the BackTrack Wiki... learn them, love them, live them.

  7. #7
    My life is this forum thorin's Avatar
    Join Date
    Jan 2010
    Posts
    2,629

    Default

    Thanks Lupin.
    I'm a compulsive post editor, you might wanna wait until my post has been online for 5-10 mins before quoting it as it will likely change.

    I know I seem harsh in some of my replies. SORRY! But if you're doing something illegal or posting something that seems to be obvious BS I'm going to call you on it.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •