[mdlug] Recover data from zeroed drive

[Adam Tauno Williams]

On Thu, 2013-12-12 at 09:08 -0500, Carl T. Miller wrote:
> Robert Citek wrote:
> > Hello all,
> > A client recently zeroed their drive with this:
> >    dd if=/dev/zero of=/dev/sdb
> > when they meant to do this:
> >    dd if=/dev/zero of=/dev/sdd
> I'm not aware of any program that will fix this, and the
> pros who do this type of work are expensive.

+1

You need specialized *hardware* to recover data from this kind of
blunder;  the data can theoretically partially be recovered by reading
the platter at a ***very*** slight offset to read the margins of the
sector and statistically reconstruct the probably contents.

It is not anything like you see on CSI/NCIS.  It takes a long time and
is not complete - the result will be a jumble of the previous contents,
versions of the previous contents, and noise.  It all depends on the
'ghosting' effect of the magnetic fields used to store the data on the
drive.

Defeating the ghost images of the data is why DoD wipe specifications
write random data over-and-over to the media when data is deleted.

A young hard-drive that has been written to fewer times will usually
yield more data back than an older drive that is constantly being
written to [good luck recovering anything from the sectors used to
record the file-system's meta-data journal, as that gets rewritten with
new contents constantly].

-- 
Adam Tauno Williams <mailto:awilliam at whitemice.org> GPG D95ED383
Systems Administrator, Python Developer, LPI / NCLA