Hacker News new | past | comments | ask | show | jobs | submit login

"in the early 1990s you could read hard drive content pretty easily with a scanning probe microscope"

I believe that is an urban legend. http://all.net/ForensicsPapers/2012-12-07-OverwrittenMagneti... describes attempts to track down such cases:

> To date I have found no example of any instance in which digital data recorded on a hard disk drive and subsequently overwritten was recovered from such a drive since 1985, when about 15% of the overwritten data was claimed to have been recovered from an modified frequency modulation (MFM) disk drive.

It cites "Overwriting Hard Drive Data: The Great Wiping Controversy" at http://www.vidarholen.net/~vidar/overwriting_hard_drive_data... which gives a best case example of a pristine hard drive, written once and then wiped once, and where you know the data is located before hand. Even then nearly all of the data had disappeared. If the drive was not pristine, it was not possible to recover the data. Quoting from it (emphasis mine):

> The purpose of this paper was a categorical settlement to the controversy surrounding the misconceptions involving the belief that data can be recovered following a wipe procedure. This study has demonstrated that correctly wiped data cannot reasonably be retrieved even if it is of a small size or found only over small parts of the hard drive. Not even with the use of a MFM or other known methods. The belief that a tool can be developed to retrieve gigabytes or terabytes of information from a wiped drive is in error.

> Although there is a good chance of recovery for any individual bit from a drive, the chances of recovery of any amount of data from a drive using an electron microscope are negligible. Even speculating on the possible recovery of an old drive, there is no likelihood that any data would be recoverable from the drive. The forensic recovery of data using electron microscopy is infeasible. This was true both on old drives and has become more difficult over time. Further, there is a need for the data to have been written and then wiped on a raw unused drive for there to be any hope of any level of recovery even at the bit level, which does not reflect real situations. It is unlikely that a recovered drive will have not been used for a period of time and the interaction of defragmentation, file copies and general use that overwrites data areas negates any chance of data recovery. The fallacy that data can be forensically recovered using an electron microscope or related means needs to be put to rest.

Parent said reading a drive:s current data is possible. You said that reading erased data is impossible.

You're wrong.

> if you looked close you might find the edges of bits that had been written before and weren't perfectly aligned.

GGP spoke about both recovering data that had been overwritten and re-assembling data from destroyed platters without the original drive mechanism.

Thanks. Yes, I should have included the "that had been written before" in my quote.

I didn't look too into the question of how to recover the contents of a hard disk with microscopy because I figured it would be possible, but expensive. Looking now, I quickly found a MS thesis at http://escholarship.org/uc/item/26g4p84b which recovered data from a disk using MFM. While the performance was poor, the author attributes that to the experimental setup.

Ahh, and http://www.dataclinic.it/magnetic-force-microscopy.htm appears to provide a commercial service to extra data from a hard disk using magnetic force microscopy.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact