17
Data Recovery Data Recovery Aakash Mehta Aakash Mehta Bhaumik Chaudhari Bhaumik Chaudhari 10IT026 10IT026 10IT053 10IT053 Shankersinh Vaghela Bapu Shankersinh Vaghela Bapu Institute Of Technology Institute Of Technology Nov 22 Nov 22 nd nd , 2012 , 2012

Data recovery

Embed Size (px)

DESCRIPTION

if you want the report on this topic "data recovery" then contact me on [email protected]

Citation preview

Page 1: Data recovery

Data RecoveryData Recovery

Aakash MehtaAakash Mehta Bhaumik ChaudhariBhaumik Chaudhari 10IT02610IT026 10IT053 10IT053

Shankersinh Vaghela Bapu Shankersinh Vaghela Bapu Institute Of TechnologyInstitute Of Technology

Nov 22Nov 22ndnd, 2012, 2012

Page 2: Data recovery

OverviewOverview

What is Data Recovery?What is Data Recovery? Disk StructureDisk Structure Software usedSoftware used Real World UsesReal World Uses Advantages & DisadvantagesAdvantages & Disadvantages Demo Demo

22Shankersinh Vaghela Bapu Shankersinh Vaghela Bapu

Institute Of TechnologyInstitute Of Technology

Page 3: Data recovery

What is data recovery?What is data recovery?

Retrieving deleted/inaccessible data from Retrieving deleted/inaccessible data from electronic storage media (hard drives, removable electronic storage media (hard drives, removable media, optical devices, etc...)media, optical devices, etc...)

Typical causes of loss include:Typical causes of loss include: Computer VirusComputer Virus Data CorruptionData Corruption Computer CrimeComputer Crime Human ErrorHuman Error

33Shankersinh Vaghela Bapu Shankersinh Vaghela Bapu

Institute Of TechnologyInstitute Of Technology

Page 4: Data recovery

Disk StructureDisk Structure

A. TrackA. Track

B. Geometrical SectorB. Geometrical Sector

C. Track SectorC. Track Sector

D. ClusterD. Cluster

44Shankersinh Vaghela Bapu Shankersinh Vaghela Bapu

Institute Of TechnologyInstitute Of Technology

Page 5: Data recovery

Several forms of Disk Several forms of Disk StorageStorage

Comparison of Comparison of several forms of several forms of disk storage disk storage showing tracks.showing tracks.

Shankersinh Vaghela Bapu Shankersinh Vaghela Bapu Institute Of TechnologyInstitute Of Technology 55

Page 6: Data recovery

How data is Stored ?How data is Stored ?

Data is stored into magnetic blocks which Data is stored into magnetic blocks which are in sectors.are in sectors.

Every time you format HDD, new layer is Every time you format HDD, new layer is created.created.

With the increase of layers memory blocks With the increase of layers memory blocks are also increased and it results to are also increased and it results to variations in data transfer(Speed variations in data transfer(Speed Decrease, Memory consumption high).Decrease, Memory consumption high).

Shankersinh Vaghela Bapu Shankersinh Vaghela Bapu Institute Of TechnologyInstitute Of Technology 66

Page 7: Data recovery

How Data Is Recovered?How Data Is Recovered?

At the First time Low Level Format(LLF) is At the First time Low Level Format(LLF) is performed on the hard disk, the disk’s platters performed on the hard disk, the disk’s platters start out empty. That’s the last time the start out empty. That’s the last time the platters will be empty for the life of the drive.platters will be empty for the life of the drive.

If an LLF is done on a disk with data on it If an LLF is done on a disk with data on it already, the data is permanently erased.already, the data is permanently erased.

The type of formatting that most users are The type of formatting that most users are familiar with is called high-level formatting and familiar with is called high-level formatting and it is the process of setting up an empty file it is the process of setting up an empty file system.system.

Shankersinh Vaghela Bapu Shankersinh Vaghela Bapu Institute Of TechnologyInstitute Of Technology 77

Page 8: Data recovery

How Data Is Recovered?How Data Is Recovered?

Data stored on the hard drive is not physically Data stored on the hard drive is not physically deleted during formatting.deleted during formatting.

The hard drive is re-organized and the table The hard drive is re-organized and the table with information where files are stored is with information where files are stored is reset.reset.

As long as the file system and its settings As long as the file system and its settings remain the same, none of the actual data remain the same, none of the actual data previously stored on the hard drive is deleted previously stored on the hard drive is deleted or overwritten can subsequently be or overwritten can subsequently be recovered. recovered.

Shankersinh Vaghela Bapu Shankersinh Vaghela Bapu Institute Of TechnologyInstitute Of Technology 88

Page 9: Data recovery

How Data Is Recovered?How Data Is Recovered? When Data is overwritten, the magnetic domains When Data is overwritten, the magnetic domains

on the HDD are re-magnetized.on the HDD are re-magnetized. This is an irreversible process that physically This is an irreversible process that physically

removes information previously stored in this removes information previously stored in this location. location. 

This would require the use of a Magnetic force This would require the use of a Magnetic force microscopy (MFM) or similar technologies, to microscopy (MFM) or similar technologies, to recover overwritten data successfully.recover overwritten data successfully.

There is no software or other technical way known There is no software or other technical way known to the public that can restore overwritten data.to the public that can restore overwritten data.

Shankersinh Vaghela Bapu Shankersinh Vaghela Bapu Institute Of TechnologyInstitute Of Technology 99

Page 10: Data recovery

Software For Data Recovery Software For Data Recovery

Stellar Phoenix Windows Data RecoveryStellar Phoenix Windows Data Recovery

Stellar phoenix Linux Data RecoveryStellar phoenix Linux Data Recovery

Get Data Back-NTFSGet Data Back-NTFS

Get Data Back-FATGet Data Back-FAT

Shankersinh Vaghela Bapu Shankersinh Vaghela Bapu Institute Of TechnologyInstitute Of Technology 1010

Page 11: Data recovery

Operating SystemsOperating Systems

Helix:Helix:- Helix is a Linux based forensics operating Helix is a Linux based forensics operating

system.system.- It is combined system used to analyse the It is combined system used to analyse the

file system and also generates the reports.file system and also generates the reports. Encase:Encase:- It is also very rich utility designed for the It is also very rich utility designed for the

professionals.professionals.

Shankersinh Vaghela Bapu Shankersinh Vaghela Bapu Institute Of TechnologyInstitute Of Technology 1111

Page 12: Data recovery

Real World UsesReal World Uses

Average User:Average User: Recover important lost filesRecover important lost files Keep your private information privateKeep your private information private

Law enforcement:Law enforcement: Locate illegal dataLocate illegal data Restore deleted/overwritten information.Restore deleted/overwritten information. Prosecute criminals based on discovered Prosecute criminals based on discovered

datadata

1212Shankersinh Vaghela Bapu Shankersinh Vaghela Bapu

Institute Of TechnologyInstitute Of Technology

Page 13: Data recovery

Advantages Advantages

Recover important data easily by using Recover important data easily by using various software.various software.

If you work for an organization than your If you work for an organization than your data should be most important and you data should be most important and you need to recover at any cost if it is lost. need to recover at any cost if it is lost.

Recover your personal photo's, files and Recover your personal photo's, files and etc which is precious to you.etc which is precious to you.

Shankersinh Vaghela Bapu Shankersinh Vaghela Bapu Institute Of TechnologyInstitute Of Technology 1313

Page 14: Data recovery

DisadvantagesDisadvantages

There is no surety that There is no surety that all of the lost data all of the lost data can be recovered.can be recovered.

Shankersinh Vaghela Bapu Shankersinh Vaghela Bapu Institute Of TechnologyInstitute Of Technology 1414

Page 15: Data recovery

Private Recovery ServicesPrivate Recovery Services

Many private companies offer quick, secure, Many private companies offer quick, secure, and confidential data recovery:and confidential data recovery: Computer Disk Service Computer Disk Service http://www.compdisk.com

20 GB from $195.0020 GB from $195.00 46 GB and up – from $895.0046 GB and up – from $895.00

Action Front Action Front http://www.datarec.com/ External cases - $500 to $1500External cases - $500 to $1500 Internal cases -$2500 to $4000 for a single hard driveInternal cases -$2500 to $4000 for a single hard drive Critical Response services start at $5,000.Critical Response services start at $5,000.

Data Recovery Services - Data Recovery Services - http://www.datarecovery.net/

1515Shankersinh Vaghela Bapu Shankersinh Vaghela Bapu

Institute Of TechnologyInstitute Of Technology

Page 16: Data recovery

ReferencesReferences "Data Recovery Solutions". R3 Data Recovery. Retrieved 13 October 2012.. R3 Data Recovery. Retrieved 13 October 2012.   "Computer Forensics Schools and Training". Legal-Criminal-Justice-Schools.com. . Legal-Criminal-Justice-Schools.com.

Retrieved 13 October 2012.Retrieved 13 October 2012.   Zeno, Keneth (27 September 2011). Zeno, Keneth (27 September 2011). "How Does Data Recovery Work?". Data Recovery . Data Recovery

Box. Retrieved 29 February 2012.Box. Retrieved 29 February 2012.   Secure Deletion of Data from Magnetic and Solid-State Memory, Peter Gutmann, , Peter Gutmann,

Department of Computer Science, University of AucklandDepartment of Computer Science, University of Auckland   Data Remanence in Semiconductor Devices, Peter Gutmann, IBM T.J. Watson Research , Peter Gutmann, IBM T.J. Watson Research

CenterCenter   Feenberg, Daniel (14 May 2004). Feenberg, Daniel (14 May 2004). 

"Can Intelligence Agencies Read Overwritten Data? A response to Gutmann." . National . National Bureau of Economic Research. Retrieved 21 May 2008.Bureau of Economic Research. Retrieved 21 May 2008.

Data Removal and Erasure from Hard Disk Drives   "Disk Wiping - One Pass is Enough""Disk Wiping - One Pass is Enough". Anti-Forensics. 17 March 2009.. Anti-Forensics. 17 March 2009.   "Disk Wiping - One Pass is Enough - Part 2 (this time with screenshots)""Disk Wiping - One Pass is Enough - Part 2 (this time with screenshots)" . Anti-Forensics. . Anti-Forensics.

18 March 2009.18 March 2009.   Wright, Dr. Craig (15 January 2009). Wright, Dr. Craig (15 January 2009). "Overwriting Hard Drive Data""Overwriting Hard Drive Data"..   "Data Recovery Possible on Securely Erased SSDs""Data Recovery Possible on Securely Erased SSDs". Retrieved 22 November 2011.. Retrieved 22 November 2011.

Shankersinh Vaghela Bapu Shankersinh Vaghela Bapu Institute Of TechnologyInstitute Of Technology 1616

Page 17: Data recovery

QUESTIONS?QUESTIONS?

1717Shankersinh Vaghela Bapu Shankersinh Vaghela Bapu

Institute Of TechnologyInstitute Of Technology