Hard Drive Recovery Part 1

Hard Drive Recovery presented at Toorcon by Scott Moulton of Forensic Strategy Services, LLC. Very detailed info on rebuilding hard drives and recovery of your own data.

Category:

Howto & Style

Tags:

• Hard
• Drive
• Data
• Recovery
• repair
• Toorcon
• Scott
• Moulton
• Forensic
• Forensics
• fix
• platters
• platter

[PILMAN]

I use EnCase and I have been unsuccessful in recovering a harddrive which used a similar program as evidence eliminator, it appears to have overwritten the data but it looks like it's using a binary checkerboard method with two passes of overwriting "DoD standard", then a third pass of pseudorandom garbage. I've attempted to recover the unallocated space but no go, is this data toast?

[SuperFlyFlippingA]

Yes the data is toast. However, there are usually some things left behind in the registry and other locations each time something is cleared. Also you can use Encase's ability to look at what is called MACE times and you will notice that the size of the clusters changed and notes a Date and Time. So while you cannot get the data back you can make a forensic case out of it showing the destruction of evidence.

[saprissa9]

can you tell me the diference between a fire wire hard drive and a regular one, my school gave me one with fire wire, and is too big to carry around, so i bought a regular drive and i forgot that it needs to have fire wire, why do i need it to be fire wire? what is the diferende? THANK YOU.

[SuperFlyFlippingA]

Other than a cable and a connector there is no difference. The drive inside is the same as a USB depending on SATA or IDE.

[saprissa9]

so i can save stuff into my drive as long as i have room for it? we are going to use final cut pro, is a program about video (just in case you dont know) i just want to make sure that im not going to have any trouble saving stuff from final cut as long as i have room thats all. THANK YOU FOR YOUR TIME ILL GIVE YOU A 5 STAR.

[SuperFlyFlippingA]

Yes, you can save stuff as long as there is room. I would leave a few megs free just because something run over and will cause the application to crash.

[LethalInjectionRadio]

I dropped my External Harddrive, windows cant recognise it. The power turns on but it just clicks for 30 seconds then the light turns blue from green.

Anyone have any ideas of the best way to manually fix it? I'm a student, i cant afford to get it fixed and it has all my 3rd year degree work on it that I need to graduate in a week... Anyone?

[minicoz5]

wow thank you for sharing this I learned a Lot

[Alistar1992]

cud u write down the name of the website please? thanx!

[RawDealMcoy]

awesome!! excellent video....

[xrd1Hal9000]

Great!

[youknowita]

Data recovery software is really a good thing, MiniTool data recovery software is a good choice for you. It is easy to use and it is efficient.. some of the editions are absolutely FREE!!!!!!!! Any of you need it can have a try.

[boanxi]

Wwwwwwwwwwwwwwwwwwwwwwwwwwwwww­wwwwwwwwwwwwwwwwwwwwwwwwwwwwww­wwwwwwwwwwwwwwwwwwwwwwwwwwwwww­wwwwwwwwwwwwwwwwwwwwwwwwwwwwww­ww

[MrKillswitch88]

@BlueIsa7

That is nothing compared to my early 90s connor drives ;)

[emanoff22]

I was going to watch this vid but my harddrive "came back to live due to a unknown virus", so are viruses good or bad?

[TheSippler]

GOOD!

[ph1sheR1]

Advanced Hard Drive Data Recovery Video Tutorial /watch?v=l5HupqVdTZY

[irvin2cartel]

this is all too complicated for me. my hard drive got kicked. its not running anymore. the power still gets to it as i can see the light, but i dont hear or feel it running like i used to. when i connect it to the computer its the same, the computer also wont show that something is connected. its a maxtor one touch 1tb. any deas on how i can try and get m data back? its about 900gb ive used, but i dont need the movies, just the photos and assignments. thank you