[lostjamie]

Hi, again,

I've been wondering, ever since i sold my Mac Mini (G4 processor) that maybe the data i had on there could have been recovered and seen by the new owner. Is this possible?

I must have formated it about 4 times in all the time i had it (which was probably about 1.2 years) and i had a lot of school coursework and my websites clients work on there, which i wouldn't like someone else getting a hold of and using maybe?

It's not a big issue to me but it's just something i've been wondering about and if it's anyway possible to recover data.

I'm also interested because i recently re-installed Mac OS X on my MacBook Pro and forgot to save a backup of some excel sheets i had. By knowing the answer to my initial question i'll be able ot move on with finding out how to recover them exactly.

Any thoughts? Previous experience?


Thanks, Jamie.

[Will C]

From what I have read, recovering items which you have put in the trash and then emptied is quite hard, BUT that does not mean it is impossible - I am not sure about finding data after a basic erase, which I think only rewrites the header on the drive - it can't do much as it takes such a short time.
I am in a similar boat to you in that I am sellling 2 macs at the moment and I am doing the (paranoid) 8 times random re-write followed by the zero all data option in the Disc Utility>Erase - I am just ultra cautious sometimes - I doubt my data is worth much - that design for the cardboard fusion reactor was never going to work........
I have heard that forensic data recovery centres can recover data after it has been overwritted - I really don't know enough about the science of the recording mechanism on hard drives, but I suspect this procedure is only done for serious criminals and espionage where the payback/investment is worth it.

[lostjamie]

I get where your coming from, yeah i doubt people would try to recover it or give a damn at my coursework anyways. It's just the thought of someone else looking through your hard work etc.. and maybe using it.


Thanks

[Will C]

I would be more worried if they could look at caches of online banking sessions, though my bank claims to be secure....somehow....I guess.....

[ph0ust]

let's clarify something first: recovering anything that has been deleted [under normal circumstances] is very EASY. it is not really deleted- it is no longer shown in the os, but the data is retained on the hard drive itself. there are an abundance of free and commercial tools that will help one recover things quickly.

however, if you turn on file vault you can secure the virtual memory and i believe (chime in here mac experts) you can enable a secure delete feature. this overwrites the sectors of the hard drive that were storing information that is deleted with zeros, thus eliminating the data from the hard drive.

with that said, it is still easy to recover deleted & overwritten data with forensic software, which is why the military has a data deletion standard that requires multiple overwrites to a point they believe makes recovering data nearly impossible.

many programs out there have a secure delete feature, generally referred to as disk "wiping". os x has one built into the disk utility, but i don't know what standard they use. if you do not perform any kind of secure delete method recovering data is a snap. formatting the hard drive does this to a degree, but again it is likely possible to recover a lot of information if one has the time, knowledge and tools.

keep in mind that unless your machine falls into the wrong hands and they really, really want to get the data.... formatting the hard drive should be more than adequate.

[peeb]

If you formatted it it is seriously unlikely that anyone normal will recover anything.

[allblue]

Just as a matter of interest... If you reformat a HD, ie set all the switches back to zero, how is it possible, forensically, to recover data from that? Is there some kind of magnetic memory hanging aound? I have heard it said that the only truly safe way to destroy data is to take the HD out and smash it up with a hammer, but surely a couple of billion zeros are just a couple of billion zeros, aren't they?

[brokenjago]

Just as a matter of interest... If you reformat a HD, ie set all the switches back to zero, how is it possible, forensically, to recover data from that? Is there some kind of magnetic memory hanging aound? I have heard it said that the only truly safe way to destroy data is to take the HD out and smash it up with a hammer, but surely a couple of billion zeros are just a couple of billion zeros, aren't they?

When you reformat a hard drive it doesn't set everything to Zero, it simply deletes the contents of the File Allocation Table (Or whatever it's equivalent is) and builds a new one.

All the data is still there.

[Will C]

Originally Posted by brokenjago 

When you reformat a hard drive it doesn't set everything to Zero, it simply deletes the contents of the File Allocation Table (Or whatever it's equivalent is) and builds a new one.

All the data is still there.

I think allblue was referring to using the zero all data option in Disk UItility>Erase which does in fact write all zeros to the disk. There is also a random 8 way re-write which writes random data over the entire disk 8 times (and takes forever....). I believe this is the one which the mililtary and data paranoid types like to use, as zeroing the data has its limitations and forensic examination can recover the data apparently - though I cannot back this up with any further info, just what I have heard/read.

[Will C]

Originally Posted by ph0ust 

...there are an abundance of free and commercial tools that will help one recover things quickly.

Ah that's interesting, when I deleted something a while back I was in desparation to find a way to recover it and all the articles I read (not that many admittedly) said OSX made it very difficult and I could only find expensive solutions - I have always known normal deletion does not wipe the data but leaves the space overwritable so you should recover the data asap.

Any suggestions for free/shareware data recovery tools? - something I ought ot have in my utilites folder.

[allblue]

Yes Will C, it was zeroing the disk (as in Disk Utility) I was thinking of. A couple of years ago I had a problem with a bad sector on the HD, and used that option before a clean reinstall. On the original subject, I did think up a way that might work. Create a 'safe' folder ie nothing important, or just gibberish. Then delete everything else from the HD. then duplicate the safe folder, duplicate them, etc etc until you physically fill up the HD with thousands of copies. Presumably, that would set every single switch to gibberish mode, completely removing any previous setting, thus completely removing all previous data?
In terms of forensics, I read about this case six or seven years ago. At that time there was a struggle going on for the European satellite TV market between Canal+ (a French company) and Sky, part of Murdoch's empire. Canal+ were doing very well, when suddenly their subscription levels started to fall off dramatically. They started investigating and discovered that their scrambling encryption code had been broken, and pirate cards were freely circulating driving down their income. Further investigation revealed how this had been done. A company in Israel (that Murdoch owned a part of) had taken one of their chips that had the encryption code hardwired into it, opened it up, and using a very powerful microscope had systematically looked at each individual switch to ascertain whether it was on or off! Eventually (god what a boring job that must have been - on, on, off, on, off etc etc! ) they had the code! A quiet settlement was then agreed behind the scenes between the companies. Which just goes to show, perhaps a hammer might be the best solution after all!

[Will C]

Of course, I have seen video and data magnetic tapes 'developed' with special chemicals to make the magnetism show up visibly - I am sure an optical machine reads the device rather than human.......good story though.

[ph0ust]

Originally Posted by allblue 

Just as a matter of interest... If you reformat a HD, ie set all the switches back to zero, how is it possible, forensically, to recover data from that? Is there some kind of magnetic memory hanging aound? I have heard it said that the only truly safe way to destroy data is to take the HD out and smash it up with a hammer, but surely a couple of billion zeros are just a couple of billion zeros, aren't they?

there are ghosts of the original data that are there, but very hard to read. multiple passes wiping the drive reduce the ghost artifacts with each pass.

Originally Posted by Will C 

There is also a random 8 way re-write which writes random data over the entire disk 8 times (and takes forever....). I believe this is the one which the mililtary and data paranoid types like to use, as zeroing the data has its limitations and forensic examination can recover the data apparently - though I cannot back this up with any further info, just what I have heard/read.

it is more than 8 passes using specific algorithms. last i looked i think it was 24 passes, but i could be wrong (i haven't worked with forensics guys in some time so specific details are a little shaky).

Originally Posted by Will C 

Any suggestions for free/shareware data recovery tools? - something I ought ot have in my utilites folder.

most of my time in the space was on windows. many of those tools are also available for *nix, but i am not sure what is there for mac. the gold standard is a product called enCase, which is what pretty much all gov agencies use (e.g. fbi). on a more consumer friendly level, i know disk warrior does some of this, but have no comment on how capable it is if things have been cleaned up really well.

remember, at the end of the day people can get anything they want if: 1) they really, really want it; 2) they know how to get it; 3) they have the tools; 4) they have the time. mostly this means they are after proprietary data (gov secrets, financially beneficial information, etc.), not arbitrary user data. anything can be hacked.... but the harder it is.... the more determined the hacker needs to be; and they are almost always motiviated by money in one way or another (ah the good ole days when they just wanted to be annoying and cause trouble). if you work for nasa, the gov or have seriously beneficial financial data on your machine.... you better do what is necessary to keep that stuff private. preventing/limiting forensic recovery is only one aspect of that.... start with a secure machine while the data is actually resident on the machine.

[allblue]

remember, at the end of the day people can get anything they want if: 1) they really, really want it; 2) they know how to get it; 3) they have the tools; 4) they have the time. mostly this means they are after proprietary data (gov secrets, financially beneficial information, etc.), not arbitrary user data. anything can be hacked.... but the harder it is.... the more determined the hacker needs to be; and they are almost always motiviated by money in one way or another (ah the good ole days when they just wanted to be annoying and cause trouble). if you work for nasa, the gov or have seriously beneficial financial data on your machine.... you better do what is necessary to keep that stuff private. preventing/limiting forensic recovery is only one aspect of that.... start with a secure machine while the data is actually resident on the machine.

Just because you're not paranoid doesn't mean they're not trying to get ya!

[peeb]

If you formatted it, with zeros or anything else (as long as you did not just delete the FAT) the time and money to recover it will be prohibitive. If you had data on there that some nefarious person really wanted, it would be far easier for them to break into your house and look for it, or kidnap and torture you to get it!

[BLAZE_MkIV]

If your conserned about anyone recovering data from a drive you should be physically destroying the drive. There is no middle ground.

[lostjamie]

Well it's only coursework at the end of the day. Nothing major when you look at it.

[pcguy1]

Originally Posted by lostjamie 

Well it's only coursework at the end of the day. Nothing major when you look at it.

In which case I am sure 99.9999999% of people wouldn't want to look at your old coursework if u stick it in front of their face and force them to read thru it, just format the drive and install a clean copy of X should be just fine.

[Zeeb]

Do you work for the CIA or FBI? Did you have pictures of President Bush sleeping with Dick Cheney on your hard drive? If not, then there is very little reason that anyone would consider the contents of your hard drive important enough to try and recover the data. Most consumers don't have the expertise to recover deleted items.

Think about all the people that turn their computers into the Applestore for repair unlocked and with all their private data perfectly accessible--perhaps even with saved passwords and tax forms? My point is that a person wanting to steal someone's identity or files have more efficient ways of getting that stuff than buying some random guys computer.

[peeb]

But look how many laptops the FBI and CIA 'lose' every year. Even they are terrible at this. It's just not that easy to keep a secret. In many ways, that's a good thing in a democracy. Think Watergate, Plame, etc. The ability to really keep a secret over the long term just doesn't really exist. You can keep a secret for a while, but eventually, it tends to leak.

[lostjamie]

Originally Posted by Zeeb 

Do you work for the CIA or FBI? Did you have pictures of President Bush sleeping with Dick Cheney on your hard drive? If not, then there is very little reason that anyone would consider the contents of your hard drive important enough to try and recover the data. Most consumers don't have the expertise to recover deleted items.

Think about all the people that turn their computers into the Applestore for repair unlocked and with all their private data perfectly accessible--perhaps even with saved passwords and tax forms? My point is that a person wanting to steal someone's identity or files have more efficient ways of getting that stuff than buying some random guys computer.

Hey man i was just asking in general about clearing macs completely, does formating over and over again fill up the harddrive leaving less room for storage?

[khufuu]

Look Ask the Techies (H.264 Video Format): Episode 21: Securely Format Hard Drive With Disk Utility

[stereobox]

Originally Posted by lostjamie 

Hey man i was just asking in general about clearing macs completely, does formating over and over again fill up the harddrive leaving less room for storage?

likewise, does formatting over and over again shorten the lifespan of the harddisk itself??

cheers

[Big Mac]

Nope.

[ph0ust]

as long as you don't use one of these Hard Drive Shredding at Hard Drive Destroyer