how to recover data wiped by boot and nuke ?

[aditya_moon]

my question is that I accidentally wiped my hard disk using dban.(don't ask why I did it ) and the most interesting thing is that it was server 2003 (of my office......shh !!! don't tell this to anybody ) having many imp files. now I am facing so many problems . plz can
anybody tell me is there anyway to recover data wiped out by dban???

[pcimage]

no chance

[BlackST]

Ditto.

[lcoughey]

Start looking for a new job. Your only hope is that you didn't fully wipe the drive...which is unlikely.

[ppumkin]

You used software designed to remove ALL data sector by sector.
If it completed there is no data left.
I am sure a forensics guy would love to try and help you - but you going to need to take a loan out for about 50 - 80 thousand dollars.
Sorry mate. But mistakes costs.

[Eleg]

Restore from backup, which should be in place if this was an office server containing important data. Bad things can and will eventually happen.

If recent backups don't exist, you have to look into whether losses can be reduced. Maybe copies of files do exist on local work stations. If we are talking about databases you might have old copies around. Possibly reapplying recent changes if these are available in any format (and from any source).

[drc]

Scanning tunneling microscope

Last edited by drc on September 14th, 2010, 10:13, edited 1 time in total.

[Cleanroom]

Doing a single pass wipe of pretty much any drive will result in "zero" chance of getting back any data.

[CK]

Ever get the feeling someone is pulling our leg here?

If indeed it is legitimate, I have zero sympathy. The software is designed to completely wipe a drive and issues warnings about doing so. If you were stupid enough to go ahead and zero out the drive, I hope your boss isn't stupid enough to keep you employed.

[sknopp]

On modern hard drives, a one pass overwrite is sufficient to prevent any possible recovery. On older drives, as I understand it, it was possible to read magnetic 'remnants' from previous writes.

This topic came up about a year ago on a forensics list-serve that I am a member of. A company was making the claim that they could in fact recover data from overwritten sectors. A highly regarded CF professional challenged the claim and offered a $100,000 award if the company could make good on the claim. Suffice it to say, the award money did not exchange hands.

A good article on current recovery techniques out there can be had at: https://blogs.sans.org/computer-forensi ... disk-data/

[drc]

A company was making the claim that they could in fact recover data from overwritten sectors. A highly regarded CF professional challenged the claim and offered a $100,000 award if the company could make good on the claim.

How many sectors were required to be recovered?

[ppumkin]

Well isnt the fasterase command in mhdd an approved method by governments to ensure proper erasing of such hard drives? That only does a single pass zero fill.

Anyway, hope that fella sorted it out some how...

[sknopp]

I'll have to check my archives to get the particulars on how many sectors were needed to get the money.

Peter Gutmann, who offered the 35 pass overwrite as necessary back in 1996, has added an epilogue to his paper describing how changes in current drive technology has reduced the number of overwrite passes needed for secure deletion: http://www.cs.auckland.ac.nz/~pgut001/p ... l#Epilogue

He even mentions dban specifically for data shredding purposes.

[sknopp]

So the contest rules stated that the winner would have to recover one file from a new drive after that file was overwritten by a one pass wipe.

[drc]

So, any one file, or one specific file, or ...?

[sknopp]

The offer did not specify, but I imagine any .txt file would have sufficed.

[BlackST]

I am safe then... I clear all err list and selfscan...