If I format a partition and then fill it completely with a huge file containing random numbers, is there any software that can retrieve the original contents of the partition prior to formatting?

Quote: Original post by DevFred
If I format a partition and then fill it completely with a huge file containing random numbers, is there any software that can retrieve the original contents of the partition prior to formatting?

No.

May - be

I don't know whether it is possible in software but there must a reason why shred overwrites the data 25 times by default.

Quote: Original post by Kambiz
I don't know whether it is possible in software but there must a reason why shred overwrites the data 25 times by default.

The reason I hear is that with an electron microscope, enough time and hundreds of thousands of dollars, you could presumably read the latent magnetic field left behind on the disk platter by the heads writing the original bit.

However, I strongly doubt anyone actually cares enough in any data to go through that. I wouldn't even do it for my own data.

Maybe the NSA/CIA have enough free time and money to do it, but I can't imagine getting enough out of the procedure to make it worthwhile.

If your data is THAT sensitive, toss the drive into a fire.

Restoring a 95% good signal from tapes after overwriting 4-5 times has been standard in civial avitation during the early 1980s. Admitted, data density has increased by 4 orders of magnitude since then, but so have the forensic measures.

As said before, the question that matters is if the data is worth the trouble.

I've done some reading of a few guys who do this stuff professionally; there are apparently some situations in which the mass overwrite is not guaranteed to work.

One such situation is the existence of bad sectors; the drive electronics will automatically remap to a different sector, so a software tool for wiping drives will ignore them. If an attacker is clever enough, they could read those bad sectors and get the information off them, but I'd be surprised if that got anything effective off. The solution to this problem is to hurl the drive into an industrial strength degausser and just give 'er.

I'm also told that a lot of Windows disk wiping tools do not work properly with the Windows API and so their changes are never committed back to disk. Darren's Boot and Nuke was the one most frequently suggested as a wipe tool; reportedly, it works quite well.

Also, I did some quick research and it looks like 1-2 pseudorandom passes are enough to defeat even most law enforcement tools (and the NSA will probably just kidnap you and waterboard you until you give up what you have). More wipes probably won't help, but I imagine they can't hurt either.

It would be wise to start out by hiding your sensitive information through encryption in the first place then you won't need to whipe a drive at all as your hidden info is unobtainable in the first place. It's very simple with software such as TrueCrypt. You can encrypt your whole drive as well, but I haven't done it myself.

If you did full format, not a quick should be ok, but when rscued get pulled they com from drives formatted not just quick but full. If you used a software like partion magic it can partion drives and just move info around no problemo.
But if it were me, and wanted to totally know for sure, I would do this. remove precious files store on seperate drive then merge all partions on drive back to a single drive, a C drive, then reboot with system install disk, and from cd disk reformat entire drive, it will operate from the cd and rewrite, every one and zero on the entire drive, now drive is fully clear, now partion, now put info on, gotta do it from cd.