Recovery of Overwitten Data on Magnetic Media

It is possible to recover data from formatted magnetic media.

Essentially, you should read a track 32 times to cover all possible “ways”. This is security related stuff, and you can probably find papers on it. We currently read each track 5 times, with which we can do a “best effort” solution based on this theory, but obviously not as good. It does save us having to deal with 40Mb disk images however. Maybe if we find the only known copy of a game that has errors...

This is used by security agencies, the inland revenue, etc. To recover “lost” data. By “lost” we mean:

• Stolen
• Deleted
• Formatted
• etc.

Basically anything to do with “national security” or taxes. Since it is expensive and time consuming, they only do it when it is worth the effort.

Similar data recovery is probably done on “black boxes” too. Obviously these are designed for excess damage anyway. They use specialised drive beds, where the head can be stepped within a track, i.e. At a much higher resolution. They then apply an analysation process to the incredible amount of data read. As far as we know, there is a security bulletin in many government offices around the world to use specialised software that considers this kind of behaviour to really erase sensitive data. There are probably some hard disks that support this without any hardware modifications through “secret” controller commands.

Here is one paper to show you what we mean. It is not easy to read, but very interesting.

Please Note: “MFM“, unless expressly stated is not MFM recording in the linked document, it is “Magnetic Force Microscopy”. MFM recording = Modified Frequency Modulation recording. The process is not as cheap as it mentions though - at least not without university equipment or on disks containing encrypted data. You may find another interesting recovery methods there too, like from RAM, etc.

Secure Deletion of Data from Magnetic and Solid-State Memory (HTML), (PDF) (cached: HTML, PDF)