recovering data after erasure using DoD method ?

[yacobs]

New way of wiping memory cards..
After you get out of hospital, take the memory card to Yacob's Mossad mate and see if he can recover the data.

hahaha
so i understand from your sarcastic way that it's impossible by any mean even hex editing or magic or whatever to retrieve these data ??

[scratchy]

Sorry Yacob,

I didn't mean to be sarcastic .. It was meant as an aside to the thread.. No offence mate

[yacobs]

no no don't worry i was just laughing about it (and oh the video is great ) i want to try this way lol
no offense taken
i am just proving that unless you are a sort of programing genius with an awesome HEX knowledge that can talk to the computer in binary and hex
there is no possible way to mankind to retrieve the data that was destructed the way i did ? (even that might be impossible as well)

[drc]

Even if you ARE a programming genius with awesome hex knowledge there is no way to get the data off of a flash that has been completely overwritten. The data is physically NOT THERE anymore.

[yacobs]

@ drc well, i think the guy somehow got a copy of the data
and am pretty sure that all data were erased as i tried
R-Network recovery
Recover 4 all
Recover my files
the 3 of them gave me 0 files found 0 files recoverable
so i assume he got he copy of the data somehow
unless harry potter shows up and habra cadabra loool

[yacobs]

you are all silent all of a sudden wow

[HDD Spaz]

maybe just bored.

[TechMerc]

Get TestDisk, comes in many OS flavors.

[HaQue]

Accessing the TOC or whatever he calls it will not recover the photos.

once wiped, memory cards do not leave any trace of data as they are not magnetic. They consist of transistors which are in an on or an off state giving binary 1 or 0 there are no intermediate phases, so reading would be impossible. So as drc says a simple overwrite would render the card unrecoverable.

if the memory card had the 'master partition' or 'TOC' it would then need to contain exactly double the existing memory in order to rebuild it.
.

While I agree the data would likely not be recovered, I disagree with Scratchy's explanation.
The data is not typically a transistor. It may behave in a way that resembles it, but better described as logic gates.

a charge is trapped in a gated environment, and the presence of this charge, or not, is typically classed as a 1 or a 0. binary data. In SLC NAND this is easy to understand .. SLC Single level cell ... 1 or 0.. off or on.

There is also MLC (Multi Level Cell) and TLC (Triple Level Cell). so in a MLC "cell" you can store 2 bits per cell...you could store states like 00,01,10, 11 in the same single cell, by varying the strength of the charge. Further to this you can store in a TLC 3 bits per cell, states like 000,001,010,011,100,101,110,111 or 8 different states.

Some MLC will only use a single bit, to make it faster.

So what I am getting at is if you have a cell that can hold different voltage strengths, you could feasibly do high level research on the properties of the NAND, and infer some data by what is there now and what could have been previous states.

It is extremely unlikely any significant amount of data be recovered, more like traces of data. In a forensic case, a single 1 byte file with a time stamp, proven to be authentic could be enough data to prove a certain action or event at a given time. Very unlikely any regular person would be recovering in any form such as what I was talking about there.

Also, lets say you have a 16GB NAND with a bad block reserve of 512K, and it is almost exhausted, then a full format of 00's will write over the good blocks, yes, making file recovery impossible. But if you can change your reading method to read bad blocks, these would still contain(probably corrupted) data, and again some fragments of data could be recoverable. Software is typically not able to be configured to read the bad blocks, though if you want to know about it, I think last year Josh Thomas (Monk) did some work, and a presentation at a few conferences of using Linux to read the bad blocks, change them, mark good ones bad etc.

basically formatting and writing 00's won't touch the bad blocks, most of the read chain ignores them altogether.

all this is my own interpretation, and Ive never done any institution based training on storage technology, so forgive any errors or terminology oopsies.

BTW if you want to stop someone reading a card, just snap it in a few pieces, why worry about software then leave the evidence around when the cards are so cheap. It is like hiding your kids Xmas presents in the master bedroom, the be shocked when they find the new iPad under the socks!!!!!

[Keatah]

Most likely scenarios:

1- The erase programs didn't interact with the SD card controller in the expected manner.
2- The guy already had a prior copy of the data somehow.