Software For Retaining Deleted Data

This is a new information to me. So after delete some data if we fill the disk with some other data, never we can retain the deleted data. Am I right ?

Yes. You may be able to retrieve the deleted data, until those sectors are overwritten with new data.

When you delete data. In most cases it just clears the data that tells where it's written on the hard disc freeing up the space so it can write over it. Those applications that retrieve deleted data. Just have the hard disc read the free space. Reporting any files it finds and their condition. Makes a temporary log file of where their located on the disc so they can be retrieved if wanted. Their condition will depend upon how many times the data has been over written. So no you can't retrieve all the deleted data.

Their condition will depend upon how many times the data has been over written.

Once if it is overwritten all data will get lost. How the condition of deleted file can depend on number of overwrittings ?

Please ignore this question. HiTekRedNek is given a beautiful explanantion.

If you want to ensure that data is deleted securely you can use a programme that deletes the file by overwriting the space it occupied several times with '1's & '0's.

There's really no need to worry about this.

Backup your important data. It's the only thing you have to remember.

External hard drives, zip drives, CDs, etc. are all cheap. It's simply a matter of taking the 5-10 minutes every once in a while and backing up the important stuff.

I've gone to an offsite service for $50 US a year.

As a Military Police Officer, I have been involved in securing TS HD's for disposal. And the process is quite intense. Leaving a few steps out for obvious reasons, an app is ran that over-rights the drive a significant number of times. The drive is then altered physically... again leaving some steps out, parts of the process include extreme heat, chemical mixing, casting, and crushing. Extensive, and a very interesting process to say the least.

If the time is available, you are right.
Otherwise, one must use a more drastic immediate method, most I have not mentioned for obvious reasons.

Good Answer.

Further to that explanation, whenever data is written to an available sector on disk, the start address is saved to an index (FAT). When the user deletes a file, only the index (FAT) is changed. The data itself is not touched and may be recovered or over-written by new data. An analogy would be a book, where an Index notes what page each chapter starts on. Assume that Chapter 3 starts on page 30 and Chapter 4 starts on page 40. Now, suppose you wanted to delete Chapter 3. You could blank out each page in the Chapter, or you could simply go to the Index and remove the reference to Chapter 3 starting on page 30 and ending on page 39. The Chapter 3 information is still there, but the Index does not list it anymore.

So now, assume you wanted to add a new chapter to your book, call it Chapter 20. Where would you put it? You could put it at the end of Chapter 19, or you could reuse the pages abandoned by Chapter 3. So, you would tell the Index that Chapter 20 starts at page 30 and ends on let's say page 35. This means that pages 30 to 35 now hold data from Chapter 20, while pages 36 to 39 (still available according to the Index) contain info from the earlier Chapter 3. So, a recovery program would be able to retrieve only a portion of the lost chapter 3. The rest has been over-written.

You can see why it is that the fewer new files are added to a drive, the more success you can have in recovering deleted files.

http://www.piriform.com/recuva

Recuva (pronounced "recover") is a freeware Windows utility to restore files that have been accidentally deleted from your computer. This includes files emptied from the Recycle bin as well as images and other files that have been deleted by user error from digital camera memory cards or MP3 players. It will even bring back files that have been deleted from your iPod, or by bugs, crashes and viruses!

Quote from:

<<Simply erasing all the data and formatting the hard drive is not secure enough. You can spend hours going through your hard drive deleting files and documents, but this basically only removes the shortcuts or links to the files making them invisible to users. Deleted data still remains on the hard drive and a quick search on Google will reveal a wide variety of system recovery software options allowing anyone to reinstate that data. >>

In simple way FAT [File Allocation Table] is only modified for the deleted files so can not be accessed like if if Post Code from the letter is damaged partially; say a drop of water mixed up the writing the Post Office system will not be able to sort it out and letter will be dropped to susped bin.

Data remains but access address is removed, As all the sectors on HDD are allocated address like co-ordinates of map and only one file or part of the file is stored on one sector. Even a bit occupies the whole sector and nothing subsquently can be recorded on it unlees the whole file is deleted and space for furher recording is made.

Further to my reply:

All the is moved [Transferred, transmitted, downloaded, telephone communication ... ] is splitted in packets; having addresses on both ends to be joined to the relative packets. It is very sophisticated protocol used in all fields. In addition to data andddresses a Parity bit is also in it to validate the packet. If you recall that your phone calls to long distance is transmitted not only a single path but the packets route changes from time to time [in part of seconds] from the best one and combine at the destination terminal and transferred to your phone line.

In formatting or deleting with your system tools only modifies the FAT not the packet.

<< When the system crashes, no data is lost. However, a FAT system may have removed disk area from the chain of free space, but may not have yet assigned it to any permanent new data set. The CHKDSK or SCANDISK utility examines the FAT table to determine the status of every record on disk. The records which are not part of any data set may be returned to the free space chain. >>

As others have covered, "remanence" is the terminology used to describe the many signatures of data that are left behind from the numerous write cycles for any form of magnetic media.

If you are looking for a method for "permanently" erasing a drive, give Darik's Boot-n-Nuke a try. It uses all of the same methods which are US Department of Defense approved, plus a few that are even more over the top. Even "erasing" and bulk degaussing, drives containing classified information are physically destroyed. The NSA has approved hard drive decimation, or "shredding" for this last method. After that the metal can go out to scrap. This is for hardware classified up to and including top secret and SCI classification levels.

Recovering data that is simply "deleted" from a hard drive is simple and can be done with any free software (normally with limitations) available all over the internet. Try ZDNet.com and search the downloads section.

Magnetic media forensics investigations, for example, use any number of proprietary and/or a combination of commercially available software suites and associated hardware to prevent overwrite (write protection) of data while atttempting to retrieve as much data as possible.

Special software is used in an attempt to assemble the jigsaw puzzle of retrieved data from the media. Again, proprietary software is the key here. Many times the data is not easily accessible in straight form, but must be read from under various layers of overwrite. Some blocks of data may be clean, but others may have one to thousands (or more) of overwrites. Peeling back the layers and associating that data into a usable form takes a long time and very intelligent software.

It's not as easy as those dorks on the TV show "Numb3rs" make it look. (And real computers don't make noises when they are processing....I hate that.)

EnCase is very popular with the US DoD, but other "proprietary" measures are also taken to ensure their trade secrets cannot be countered.