09-19-2015, 10:13 PM
M A V I C wrote:
Has there ever been a recorded instance where someone was able to recover files after they've been erased? At last check, there was a security firm offering a large bounty for the first person to be able to do it.
I think you're mixing a few different things (and these comments are for based on rotating hard drives).
1) I think you're thinking of when an entire drive is erased (1 pass of zeros) in which case it's my position that it's unrecoverable, although there will be people here saying that they heard from a friend of a friend that it is. I've never seen a documented case of usable data being recovered, or a recovery service saying that they have that capability at any price. I was hoping that a certain email server that has been in the news had actually had it's drives zeroed, and if that were the case was the government able to recover any data, but I haven't seen many technical details, and I believe that all "recovered emails" came from a backup done before deletion that was stored in a lawyer's safe.
2) Normal deletion of a file and emptying trash still leaves the file data on the drive, it's not overwritten until another file needs to use that space, but the directory information has been deleted. This is where utilities like Data Rescue might be able to recover the file contents. Although when someone on the forum posts that they accidentally deleted a file and want to recover, they are usually met with silence and told to recover from a backup.
3) Secure Empty Trash, goes one step beyond #2, and overwrites the file data on the drive before deletion, so that it's not recoverable, rather than leaving it around until that disk space needs to be reused by another file. In a way, this is similar to how TRIM works, the disk blocks are "recycled" at the time the file is deleted rather than at the time in the future when they are needed.