Tools used by law enforcement to completely recover data from a wiped/formatted drive..

[totalnoob]

Title says it all. I recently reformatted several hard drives and used one pass of DBAN on a couple, only to discover later that they had old data on them I wanted to save.

Are there any programs available that do a professional recovery/rebuild of a freshly formatted hard drive? I know the government has programs that can recover all data even after a complete wipe and rewrite with 1s and 0s. Are there similar programs available for retail buyers? Or is the cost too prohibitive?

 

[Fardringle]

Short answer: No.

Long answer: Forensic data recovery is not just a software solution. It involves completely dismantling the drive and mounting the individual platters in very specialized machines that are capable of reading "between the lines" (magnetic charges outside of the tracks that are normally used by the drive heads) to attempt to recover data that has been erased or overwritten.

 

[totalnoob]

doh...I assumed the worst since I've never seen those programs for sale.

Thanks for the answer (and the education).

 

[Fardringle]

If the drive was only formatted, you can usually recover the data easily with any of a number of different programs (I like GetDataBack) since formatting doesn't really delete the data from the drive. After a complete overwrite with DBAN, you're not likely to get anything useful back.

 

[Modelworks]

Actually they are for sale, just not cheap.
http://www.x-ways.net/forensics/index-m.html

I use winhex for drive recovery and it is really stellar in what it can do. The problem is it does require a lot of time to learn. You need to understand sectors and platter layout and the way each file system works that you are trying to recover. It really is not a click and recover solution.

The recovery of drives that have been rewritten even once is a theory. Nobody has done it short of using electron microscopes, beware of any software that claims to do it.

 

[imported_Mills]

I think EnCase is popular among law enforcement agencies, and I'm pretty sure it will not recover a drive overwritten with a proper wiping tool. http://www.guidancesoftware.co...e-digital-evidence.htm