Talk:Data recovery

From Wikipedia, the free encyclopedia

Contents

[edit] Name Confusion

This is just a suggestion, but shouldn't this article's name be changed to edata recovery, since it deals with data stored in electronic format, which is generally referred to as edata? This way, it wouldn't be confused with such forensic processes as recovery of hard, physical data. --Novena

[edit] Relevance of External Links

I was wondering why linking to a forum discussing data recovery methods would be deemed wrong by an administrator whereas a barely related whitepaper on whether security services can read straight from a platter is ok? I thought external links to related resources that provided further reading for those interested was what WP was all about? Please don't say the great Wikipedia is going the same way as DMOZ?

This page tends to get a lot of spammers posting links to their sites here. The consensus of those who keep an eye on this page seems to be that external links to things that aren't clear, unbiased advice aren't okay. So, that probably explains some of the zealousness in reverting. I took a look at the forum you linked and, IMHO, it seems rather self-promoting to post a link to it in this article. It's a small board with little notability, basically, and notability is one of the factors many Wikipedia editors use to decide what stays and what goes. --FreelanceWizard 17:12, 4 April 2006 (UTC)
I can appreciate what you're saying. If there had been a link to a similar resource that was more notable then I wouldn't have bothered. But I was linking to a resource that would be useful to many who would read this article rather than shamelessly promoting it. The forum is relatively new, but has helped people already who were looking for independant advice or just want to research the subject. However, as the editor(s), you have the last say and I respect that. Keep up the good work! --John 09:50, 5 April 2006 (UTC)

[edit] A previous version was copyvio

note that a previous version of this article was deleted as a copyvio -- sannse (talk) 3 July 2005 11:31 (UTC)

[edit] Linking to external articles, sites and software

"Recent state of the art data recovery methodologies are discussed at Recovering Unrecoverable Data a whitepaper by ActionFront Data Recovery."

I'm not sure that this is a good thing to link. Yes, it is free to get, but that's an indirect link; you have to ask for the paper in order to get it. Thoughts? --FreelanceWizard 7 July 2005 20:31 (UTC)

Thoughts (from a "biased" source ... I work for ActionFront) The entire text of the white paper is posted on the page linked-to. We used the email to track who actually gets the full-version of the paper - a small price to pay for the most definitive document on hard drives and data recovery that can be found anywhere! ...Ron Austin

I'm not sure that everyone would agree with that, as it sounds, no offense, like it's a means to collect e-mail addresses for the marketing department (the common term for that, and other links to sites, is "link spam," though I'm not sure I agree with such an condemnation here). I'm sure the paper's a useful source, though. Anyway, on my next edit, I'm going to drag some of the current inline links down to an external links section, which would include both that link, the links to the other companies, and the link to Runtime Software. The whole article, now that I've read it again, seems a little too commercialized for my tastes. ;) --FreelanceWizard 11:15, 15 July 2005 (UTC)

To FreelanceWizard - Your comment on the page being too commercial is valid. The whitepaper link that we posted is a highly regarded document on both the internal workings of hard disk drives and the current techniques of the data recovery industry. It contributes to any serious user's understanding of the subject matter. Meanwhile during the past months, I have seen company after company simply remove other's links and post links to themselves. And whether it's Ontrack, or Runtime, generally these have been just links (advertisements) to commercial sites and make no real attempt to add value to the subject of the article. As for requesting an email address - this is a large PDF document with color photos. When we left it uncontrolled - we experienced thousands of downloads per day by individuals trying to monopolize our bandwidth and shut us down. Now you can read the entire document in a text version at the link - and if you want the fully formatted, diagrammed version - it is requested by autoreply email. (By the way there is no harvesting or any other use of email addresses as explained on the download request page) - Thanks Nick Majors (ActionFront)

External links to corporate sites are always a tricky, delicate thing. Anyway, I think the article's substantially less commercial now, and I didn't see any reason to exclude the link to your whitepaper; perhaps someone could use it as a source to expand the section on physical recovery. I'm sure you can understand that, with all sorts of companies trying to sneak themselves in wherever they can (there are many examples easily found on, say, Votes for Deletion), there's always a bit of skepticism when an edit appears from an anonymous user that only adds an external link to a corporate site. It does seem your intentions were pure, so there are no hard feelings, I hope? :) --FreelanceWizard 21:19, 26 July 2005 (UTC)

Frankly - this is getting to be a little out of hand and starts become a free-for-all links page. The purpose of Wikipedia should be to provide knowledge. There is no need in a article on data recovery to provide links to commercial services who have inserted their own names for no reason other than self-serving advertisements. They make little or no attempt to contribute knowledge to the subject. I added our ActionFront whitepaper, because it is 1) An extremely comprehensive technical article with little or no marketing, 2) It discusses, explains and examines (in some detail) techniques used in the industry. 3) In an industry shrouded with secrecy and half-truths - it tries to inject some fact and dispell falsehoods without resort to vague claims of expertise. 4) It was written by Chuck Sobey who is an extremely well respected member of the disk drive manufacturing industry as oppose to a marketing. advertising writer. I would suggest we can all do without the advertisements from Ontrack, Ibas, Runtime, Disklabs, ESS, etc. etc. That's what PPC is for. If any of these companies wish to publish something helpful ON TOPIC (and hopefully more technically advanced and complimentary to this article) they should do so. FREELANCE WIZARD - What do you think? (Nick Majors, ActionFront Data Recovery) 12:11 EDT, 13 August 2005

*thumbs up* Good choice of external links there. I definitely agree that the commercial links were getting a bit... much. I'm not opposed to one or two just to give people a feel as to what's available out there, but I think you've got a point that there was a nasty precedent starting. So, good call, good work, nice catch, etc. ;) --FreelanceWizard 10:20, 16 August 2005 (UTC)
yes, this [1] link was pretty useful for me. Altough I couldn´t recover the data (yet) I already checked the drive with Testdisk (definitly worth an article) and the boot sector is at least ok! Anyway I give the linked article four out of five stars for noobs :) --MilesTeg 01:01, 30 January 2006 (UTC)

[edit] Salvage data versus data recovery?

There seems to be some IT industry confusion as to the different specific definitions of "recovering”, "salvaging" or “rescuing” of data. Corporations such as IBM, SUN, HP, Sungard, Ironmoutain and others define "data recovery" as the process of "accessing and retrieving data from network storage devices" while other organizations and companies like Ontrack, DriveSavers and Dataleach who specialize in the niche market of rescuing data from failed storage disk drives and computeing devices also have coined such services and products as "Data Recovery". --WikEditor 17:28, 2 December 2005 (UTC)

All the references I've seen from academic circles (including Tanenbaum) refer to recovering data from a failed file system as "data recovery." It's never been suggested to me by anyone that "data recovery" is synonymous with "data mining" (which is what I think you're describing). On the other hand, continuous data protection is a type of backup, and backups are related to data recovery. Anyway, my intuition is that what we're seeing is IBM et al. trying to recast the term for advertising reasons, everyone else be damned. Still, it might be useful to add another section to this page describing the difference. --FreelanceWizard 23:05, 2 December 2005 (UTC)

[edit] Contradiction with "MFSTM" article

There is an stub article on Magnetic Force Scanning Tunneling Microscopy, which claims that overwritten data can be recovered with current methods after "1000 overwrites". I find this claim dubious (to say the least!), and have tagged this latter article for cleanup. Please contribute to the discussion on that article if you know anything about MFSTM. Mtford 08:44, 15 August 2006 (UTC)


I find this difficult to believe as well. By that time, would'nt some of the poles be back in the original location, and some not? I always was under the impression that the current electron scanning microscopes could see the LAST polar path, but not past those. I think someone in the industry should clear that up. - Admiralthrawn999

[edit] "Common misconceptions" contains original research

The "common misconceptions" section [2] claims that it is simply impossible for overwritten data to be read from a hard drive. No sources are cited to back up this claim. Furthermore, it does not address the fact that overwritten data has been read from drives as early as 1992. See "Magnatic Force Scanning Tunneling Microscope Imaging of Overwritten Data", IEEE Transactions on Magnetics, Vol. 28, Issue 5, Part 2, September 1992, pp. 3141-3143 ISSN: 0018-9464 [3]. Here is the abstract from that article:

The magnetic force scanning tunneling microscopy is briefly discussed and demonstrated to successfully image overwritten data on commercial rigid magnetic disks. In particular, clear images of unerased remnants of the previously stored data are presented. These unerased data are attributed to slight radial deviations in write head tracking due to the intrinsic limitations in the electromechanical positioning of the head.

Contrary to the current Wikipedia article text, it is quite reasonable to expect---especially in security-sensitive contexts---that an adversary might be capable of recovering data that has been overwritten. -- Wonderstruck 03:53, 18 October 2006 (UTC)

It would have been easier to read overwritten data in the past. They used bigger bits back then, and heads were wobbly. A lot of change has happened in 15 years. See these Usenet threads for some refutes of the "wobbly heads leave some bits un-overwritten" argument.
Google archive of Usenet discussion
Another Google archive of a Usenet discussion
While both of these contain a bunch of original research the information in them is easy enough to verify for anyone wishing to do so. A single overwrite is adequate for anyone. Multiple overwrites are suitable for the paranoid. DanBeale 15:03, 18 February 2007 (UTC)


Wonderstruck--You're basing your belief on a publication that is fifteen years old at the time I post this (October 2007.) They weren't likely using the latest drive technology when they ran that test either.
There is no evidence of overwritten data ever having been recovered on any hard drive which was made since ATA technology became the standard for home-use hard drives in the early 1990s, and it's doubtful that anything useful has ever been recovered once it was overwritten. The idea that what was previously written to a sector is readable at the edge of the track due to slight variations in the path of the write head seems to make sense, but the logic falls apart under scrutinization. In order to read enough of the data of a previous file to recover anything useful, the write head would have to consistently write off-center to the previously written data. However, this would not happen if the head was actually wobbling--if it was wobbling, it would go from one side of a track to the other and back continuously. In addition, there would be no way to tell if bits read on the edges were written by the previous write, or the one previous to that, or the one before that, etc. Most likely, bits from multiple incidences of data writes would be recovered and result in no usable data.
Furthermore, after the theory of reading data from the sides of tracks was presented in the early 1990s, hard drive storage densities have increased well more than seven thousandfold. In 1991, the largest hard drive you could get for a home PC was 130 MB drive, today it's one terabyte or one million megabytes. This increase was a direct result of shrinking the size of the area on which a bit of data is stored. Scanning tunneling microscope technology has not improved much during that same time period and even if it had, the precise alignment required by hard drives made since ATA technology became commonplace has made any recovery of overwritten data even less likely.
Consider the Watergate tapes. Cassette tape recording works on the same principle as hard drives: a variable magnet changes the orientation of a moving magnetic substrate during the write phase, and a magnetic sensor measures it during the read phase. A single overwrite of that tape back in 1972, the recording missing from the "18½ minute gap" has still not been recovered.[4] This isn't an exact analogy of course, just something to think about.
Here is a link to an article which contains a quote from a data recovery professional with ten years experience at an international data recovery company: http://www.computerworld.com/blogs/node/5687 In this article, Sean explains why Gutmann's information was already obsolete when he published it in 1996. RLL and MFM drives hadn't been the standard for at least half a decade at that point.
In conclusion, it might be possible to recover overwritten data from MFM or RLL hard drives (which were manufactured prior to 1991), but their is neither evidence nor reason to believe that any usable data can be recovered after a successful single-pass overwrite on any modern hard drive.Webgrunt 21:30, 8 October 2007 (UTC)

[edit] Common misconceptions.

From the article: "This claim, although theoretically possible to some extent, is today little more than a myth. The reason for this is that the method described above would, if possible, read remnants of magnetic information on the media. Taking into account that the time to read and interpret the remnants would be considerable even for a small drive (several years) and that several "previous" bits would not be able to be read correctly, it will create a time consuming and probabilistically impossible puzzle to solve."

This appears to be straight from the website of talking out of your ass. Where is the proof? [UNSIGNED]


It's not possible to prove that something can't be done, only to prove that it can. There is no proof that overwritten data can be recovered from modern hard drives, but there is evidence to the fact that it can't.


Here is a link to and an excerpt from an article posted bt Seagate Recovery Services, a data recovery company owned and operated by the hard drive manufacturer Seagate:
http://www.actionfront.com/ts_dataremoval.aspx
(Starting with the third paragraph under the heading, "CAN OVERWRITTEN DATA BE RECOVERED?"
It has been suggested that an electron microscope could be used to read and interpret any patterns that were not fully overwritten by the process. Theoretically this can be done - but in practice it is little more than a myth.
...In conclusion, overwritten data cannot be read back or recovered by any current disk drive technology or laboratory technique.


Here is a link to an article by the National Bureau of Economic Research in which the conclusion reached is that:
"Gutmann's claim [that overwritten data can be recovered by reading the edges of the tracks] belongs in the category of urban legend."
http://www.nber.org/sys-admin/overwritten-data-guttman.html


In that same article, it is noted about Gutmann's paper that:
"it may be in the category of marketing hype. I note that it is being used to sell a software package called 'The Annililator'."
It may be important to note that there are many true stories of data that was thought to have been overwritten being recovered. The key phrase here is "thought to have been." In many cases of "overwritten" data, the data wasn't actually overwritten.Webgrunt 22:02, 8 October 2007 (UTC)

[edit] Physical Damage

There is no information given on where to find the procedures for recovering data from a drive with physical damage, such as crashed heads or surface damage. After a quick Google search, I found several companies offering the service, but nothing on the actual procedures or equipment needed. A link to details of the process of recovery would be a great addition to the article. Anyone? VietGrant 23:17, 7 November 2006 (UTC)


I added a section on the main procedure. I recieved the procedure from a professor of computer forensics at Purdue Universtity (2006). I added a note that not ALL data is recoverable, but most of it can be recovered. - Admiralthrawn999

I'm pretty sure some of the companies provide a little bit of info on what they do. They at least mention that they used clean rooms Nil Einne 16:00, 11 April 2007 (UTC)

I work for a recovery firm. The information that you are looking for is not readily available to the public. The procedures are proprietary and take time and resources to develop. The technology is constantly advancing as new drives are being produced every day. The one thing you can be sure of, if you drive has a hardware failure, make sure who ever does your recovery has a clean room. This is essential. (Cmbogard 13:53, 21 June 2007 (UTC))

[edit] Why the backlash against data recovery companies?

I work for a data recovery company. I respect Wikipedia. I had checked the data recovery pages here a few times. Finally one time I noticed that my company was added to a list of companies. It had gone on the list with a bunch of others apparently and now they were in alphabetical order. I do not know who did it, but it was nice to see my company on there. Now I find the page is deleted.List_of_data_recovery_software

There is a lot of complaining above about the advertising from data recovery companies appearing on the data recovery pages, notably the List_of_data_recovery_software page which is now gone. I did not see the argument about the ActionFront white paper but all I saw was a bunch of links at the bottom for some data recovery companies in a well defined section. This did not strike me as a negative thing. Sure, in a way it may be advertising, but it was also a helpful way to show people that companies like that exist. When someone has a hard drive problem or what have you and need their data, they probably don't know any data recovery companies at all and it may be an emergency. Wikipedia could be a place they might go for a little research. They might not have known that such companies exist at all. Those links therefore would have helped that particular person in addition to helping the data recovery companies.

There are zillions of examples of advertising on Wikipedia so I don't know how you can crush this one. Look at this page Comparison_of_instant_messaging_clients. Not only are there a ton of IM clients listed but they have huge grid breakdowns of features and they even have their own dedicated pages on Wikipedia!!! Those pages have direct links to the IM client's website. I don't know how you can say this is different. Actually it is far more abusive than a few links at the bottom of an article if you see things that way. Some are "free" but there are $25 IM clients, Adware supported IM clients, subscription based IM clients. So I ask the community here to be fair and allow some page with some sort of listing of data recovery companies/services/software etc. for everyone's benefit.

Thank you. —The preceding unsigned comment was added by 12.10.116.131 (talk) 23:43, 1 February 2007 (UTC).

--

The presence of other pages containing adverts does not justify your own, similar additions. Your site does not seem to introduce anything worthwhile to the subject matter - upon inspection it is entirely dedicated to your commercial products and services.

Wikipedia is meant to be an online encyclopaedia.

SexyBern 21:23, 2 February 2007 (UTC)

I have removed the offensive commercial link and spurious advertising posted by "Trustreliance" 128.243.220.22 13:50, 25 October 2007 (UTC)D

[edit] "Zero-knowledge analysis"

Is "Zero-knowledge analysis" the same as "data carving"? A quick look suggests that they are, but as I'm no expert I'm not going to edit this. Anyway, I found this informative PDF, which might be linked to or used as a reference. Morenoodles (talk) 11:07, 6 June 2008 (UTC)


Working for Corporation and safeguarding customer data:

Can data retreival be done from a single physical drive separated from it's Raid 5 NTFS array? For instance in the scenerio where a failed drive can not be logically accessed to ensure it is wiped clean and where physically damaging the drive would make it non-returnable, what is the risk of customer data being recovered from the parts of data that are stored in that particular drive?

199.67.140.84 (talk) 21:08, 11 June 2008 (UTC)BBA