computer forensics question

[Devin Rankin]

I don't know.

I was a computer forensic guy for the Phoenix Police Department.  I can tell 
you that no local or state agency has any equipment to read a drive once it 
has been erased and over written, even once.

There have long been rumors that equipment existed to read the data on a drive 
that had been over written by detecting a residual magnetic charge of the 
original data.  But with something being over written 3 or more times, I 
really don' know how you would sort out what was original and what was the 
3rd  or 4th pass of random characters.  

Maybe this was possible on the older, lower density drives, but with todays 
drives, and how tight the tolerances are getting between data tracks, I think 
its getting less and less likely.

I trained with all kinds of government agent, from military to IRS, and none 
of then had ever actually seen any equipment that would really be able to 
read erased data.  If the equipment exists that can do it, its very rare, or 
very secret or both.

Devin


On 10/08/2005 10:08 pm, Technomage wrote:
> ok,
> I've been wrangling this question around a while and haven't been able to
> gain any real answers that make sense (and my knowledge base on this is
> lacking due to being 10 years out of date).
>
> so, here goes:
>
> is it possible, given the current understanding of the laws of physics, to
> so erase a hard drive as to make it virtually impossible to recover ANY
> data of any usefulness whatsoever (up to and including either a major
> government or major multinational corporationthrowing huge sums of money at
> the problem in an attempt to recover)?
>
> so far, the only answer I have found is: a conditional no (any or all the
> data can be recovered, including the previously written data multiple
> layers deep).
>
> is there a correct 9and unconditional) answer for this arguement?
> ---------------------------------------------------
> PLUG-discuss mailing list - PLUG-discuss at lists.plug.phoenix.az.us
> To subscribe, unsubscribe, or to change  you mail settings:
> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss