Welcome to new students seminar!! Data Recovery Security is a people problem proneer.tistory.com proneer@gmail.com @pr0neer JK Kim
Outline Data & Recording Method Definition & Classification Recovering data after physical damage Recovering data after logical damage Recovering data after deletion Studies : the trends in the field
Data Data is information that can be stored and used by a computer program. In computer science, data is anything in a form suitable for use with a computer. Data is often distinguished from programs. Wikipedia
Recording Method Magnetic Recording Hard drive, Recoding tape, credit cards Optical Recording Compact Disk or Digital Versatile Disc Electronic Recording Memory type
Definition Data recovery is theprocess ofsalvaging datafromdamaged damaged, failed, corrupted, or inaccessible secondary storage media when it cannot be accessed normally. Primary Storage? Often the data are being salvaged from storage media such as hard disk drives, storage tapes, CDs, DVDs, RAID, and other electronics.
Classification Recovering dataafter after physical damage Recovering data after logical damage Recovering data after deletion
Recovering data after physical damage A wide variety of failures can cause physical damage to storage media. Physical damage always causes at least some data loss. Most physical damage cannot be repaired by end users.
Recovering data after physical damage Recovery techniques Hardware repair Removing a damaged PCB (printed circuit board) and replacing it with a matching PCB from a healthy drive. Removing the hard disk platters from the original damaged drive and installing them into a healthy drive.
Recovering data after logical damage Power outages Problems with hardware (especially RAID controllers) System Crashes
Recovering data after logical damage Recover techniques A mechanism to prevent logical damage Journaling function of file systems Battery backup UPS
Recovering data after deletion File System Meta Area Data Area FAT(FAT12, FAT16, FAT32, exfat), NTFS ext2/ext3/ext4, XFS, UFS, HFS/HFS+ HPFS, ISO 9660, Veritas File System(VxFS) ZFS, Embedded File System(EFS)
Recovering data after logical damage Recovery techniques Recovery using File System metadata Data carving Overwritten data Recovery
Recovery using File System metadata Meta Area Data Area
Data carving
Recovering overwritten data When data have been physically overwritten on a hard disk it is generally assumedthat the previousdata are nolonger possibleto recover. In 1996, Peter Gutmann, a respected computer scientist, presented a paper that suggested overwritten data could be recovered through the use of Scanning TransmissionElectron Microscopy (STEM).
Scanning transmission electron microscopy (STEM)
Wiping techniques Fast (1 pass) Russian GOST P50739 95 (2 passes) British HMG IS5 (Enhanced) (3 passes) US Army AR380 19 (3 passes) NAVSO P 5239 26 (RLL) (3 passes) NAVSO P 5239 26 (MFM) (3 passes) DoD 5220.22 M (ECE) (7 passes) Bruce Schneier (7 passes) Peter Gutmann (35passes)
Studies : the trends in this field Foremost Linux based program data for recovering deleted files and first published in 2000. Uses a configuration file to specify headers and footers to search for. Scalpel Open source program for recovering deleted data originally based on foremost. Presented at the DFRWS conference in 2005.
Studies : the trends in this field DFRWS 2006 Challenge 50 MB raw file and has no file system, but it contains file fragments. Extract as many full JPEG, ZIP, HTML, Text, and Office files as possible from it. DFRWS 2007 Challenge 330 MB raw file and has no file system, but it contains many files and file frag (JPEG, ZIP, HTML, Text and Microsoft Office) and multimedia, document, e mail format.
Studies : the trends in this field SL Garfinkel, Carving contiguous and fragmented files with fast object validation, 2007. SJ Veenman, Statistical disk cluster classification for file carving, 2007. G Richard, V Roussev, L Marziale, Ml Cohen, In place File Carving, 2007. Advanced carving techniques, 2007. Effective Carving (reduce false positive), Smart Carving
Question & Answer