MultiDrive – free backup, clone & wipe disk utility from Atola Technology

All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 7 posts ] 
Author Message
 Post subject: Some noob questions about reading overwritten data
PostPosted: August 27th, 2016, 15:04 
Offline

Joined: August 4th, 2016, 17:39
Posts: 20
Location: Canada
I've been reading so much contradicting information online, I really have no idea whats true and what isn't anymore. (Also, I should clarify that viewing them would suffice, I don't necessarily have to recover them) The hdd in question is a HGST Travelstar 5K250 HTS542516K9SA00 - hard drive - 160 GB.

1. One of the things I read stated that sometimes its possible to read overwritten data as long as its "only a couple layers deep". Does that mean if it is overwritten once by Windows, I can still use software to view it? Or would it involve striping away at the physical hdd? Keep in mind I'm talking about notepad type files with plain text.

2. If a text file is "partially overwritten", would I be able to view the text that wasn't overwritten in a program like DMDE or something similar?


3. What software would be capable of reading (in plain english like a hex editor) the overwritten data and the partially overwritten data?

4. I've read some articles talking about how hdd's never write to the exact same place more than once. What does this mean regarding overwritten data?


Top
 Profile  
 
 Post subject: Re: Some noob questions about reading overwritten data
PostPosted: August 27th, 2016, 16:54 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 16960
Location: Australia
Didn't the following thread answer most of your questions?
viewtopic.php?f=1&t=33909

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Some noob questions about reading overwritten data
PostPosted: August 27th, 2016, 17:39 
Offline

Joined: August 4th, 2016, 17:39
Posts: 20
Location: Canada
fzabkar wrote:
Didn't the following thread answer most of your questions?
viewtopic.php?f=1&t=33909


Not the ones I listed above.


Top
 Profile  
 
 Post subject: Re: Some noob questions about reading overwritten data
PostPosted: August 27th, 2016, 19:53 
Offline
User avatar

Joined: January 28th, 2009, 10:54
Posts: 3547
Location: Greece
kurt2121 wrote:

1. One of the things I read stated that sometimes its possible to read overwritten data as long as its "only a couple layers deep". Does that mean if it is overwritten once by Windows, I can still use software to view it? Or would it involve striping away at the physical hdd? Keep in mind I'm talking about notepad type files with plain text.

Not true. Once sectors are overwritten, they're gone forever.
Quote:
2. If a text file is "partially overwritten", would I be able to view the text that wasn't overwritten in a program like DMDE or something similar?

Theoritically speaking, you could be able to see data of partially not-overwritten files using some hex viewer (or DMDE).
Quote:
3. What software would be capable of reading (in plain english like a hex editor) the overwritten data and the partially overwritten data?

See answer 2. There are plenty of freeware hex editors.
Quote:
4. I've read some articles talking about how hdd's never write to the exact same place more than once. What does this mean regarding overwritten data?

This is ridiculous. If that was correct, then HDDs would work sort-of like CD-Rs: write data -> reach maximum capacity -> turn in read-only mode.
HDDs can read and write for as long as they're healthy.

_________________
http://www.northwind.gr
SandForce SSD Recovery
Ransomware Reverse Engineering - NoMoreRansom! partners


Top
 Profile  
 
 Post subject: Re: Some noob questions about reading overwritten data
PostPosted: August 28th, 2016, 17:22 
Offline

Joined: August 4th, 2016, 17:39
Posts: 20
Location: Canada
northwind wrote:
kurt2121 wrote:

1. One of the things I read stated that sometimes its possible to read overwritten data as long as its "only a couple layers deep". Does that mean if it is overwritten once by Windows, I can still use software to view it? Or would it involve striping away at the physical hdd? Keep in mind I'm talking about notepad type files with plain text.

Not true. Once sectors are overwritten, they're gone forever.
Quote:
2. If a text file is "partially overwritten", would I be able to view the text that wasn't overwritten in a program like DMDE or something similar?

Theoritically speaking, you could be able to see data of partially not-overwritten files using some hex viewer (or DMDE).
Quote:
3. What software would be capable of reading (in plain english like a hex editor) the overwritten data and the partially overwritten data?

See answer 2. There are plenty of freeware hex editors.
Quote:
4. I've read some articles talking about how hdd's never write to the exact same place more than once. What does this mean regarding overwritten data?

This is ridiculous. If that was correct, then HDDs would work sort-of like CD-Rs: write data -> reach maximum capacity -> turn in read-only mode.
HDDs can read and write for as long as they're healthy.


Thanks!


Top
 Profile  
 
 Post subject: Re: Some noob questions about reading overwritten data
PostPosted: August 28th, 2016, 18:24 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 16960
Location: Australia
Let's assume binfile is a portion of a binary file and textfile is a portion of a text file.

We can create a hybrid textbin or bintext file as follows:

    copy /b binfile + textfile bintext
    copy /b textfile + binfile textbin

Now view these files in a hex editor (eg HxD freeware) or in a word processor (eg Windows Wordpad or DOS Edit).

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Some noob questions about reading overwritten data
PostPosted: August 28th, 2016, 23:26 
Offline

Joined: April 26th, 2012, 1:52
Posts: 388
Location: Chicago, USA
kurt2121 wrote:
4. I've read some articles talking about how hdd's never write to the exact same place more than once. What does this mean regarding overwritten data?


I think what was meant by this question is that the data, during subsequent re-writes, gets shifted around. Maybe not the precise same spot, but a few nm off-target so to speak.

But, yes of course, sectors are reused unlike CD-R.

_________________
On a clear disk you can seek forever.


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 7 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: Google [Bot] and 156 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group