Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

Detecting if someone used a disk wipe / secure erase program

Posted on 2008-09-30
4
Medium Priority
?
515 Views
Last Modified: 2012-06-27
I was recently on a tech call to try and recover some missing files from a small office that had a laptop returned to them from an employee that recently left, but apparently deleted all of their work files. I was unable to find any ms office documents and was wondering if there were any programs that can detect if a disk wiper was used? As this is a small office, they won't be sending the drive away for any expensive file recovery services (they'll live without the files), but they were curious to see if the employee had used a disk wipe program.

Any ideas?
0
Comment
Question by:mrbayne
  • 2
4 Comments
 
LVL 96

Expert Comment

by:Lee W, MVP
ID: 22610024
I can not imagine a situation where you would know unless you could find the actual disk wipe program installed.  
0
 
LVL 96

Expert Comment

by:Lee W, MVP
ID: 22610028
I suppose you can "guess" based on the configuration of the laptop when it was returned... but there are plenty of programs that can do a "file wipe"
0
 
LVL 38

Accepted Solution

by:
Rich Rumble earned 500 total points
ID: 22627597
No, most wipe utilities do a combination of things, all 1's all 0's alternating 1's and 0's and random... so you couldn't tell one from the other. Windows also has it's own wipe utility, cipher.exe which will over-write once with random data. You can run it as much as you like to get multiple wipes. Doesn't matter if they did really, you could never actually tell, maybe they just hit the delete button, and then defrag'd the HD, that would likely over-write the empty places those files used to be, especially if the HD was very fragmented. You can run recovery software, but you should never boot or install programs to the drive you want to recover data from, things will get overwritten that way. Take the HD out, use something like: http://www.newegg.com/Product/Product.aspx?Item=N82E16812119152 that adapter to read the HD. use a program like: http://tokiwa.qee.jp/EN/dr.html to scan the HD to see if you can recover the data.
Again, unless as stated above, you find the utility they used using software like I linked to, you will never know if they used a utility or if they simply hit shift+delete (by passes recycle bin) and then defragged the HD.
-rich
0
 
LVL 1

Expert Comment

by:Brese
ID: 22663427
Although you could use a tool like FTK, it appears you are looking for a quick fix. I would suggest removing the drive, loading it onto another machine as an external drive, then run a tool like PC Inspector File Recovery. That app in particular can recover "lost files" and you can see deleted applications.

IF they used a wipe program that they installed, like cCleaner for example, they had to uninstall it and therefore couldn't wipe it, which would leave it potentially available for recovery.

You could perform this inside an hour and get an answer to your client.
0

Featured Post

Veeam and MySQL: How to Perform Backup & Recovery

MySQL and the MariaDB variant are among the most used databases in Linux environments, and many critical applications support their data on them. Watch this recorded webinar to find out how Veeam Backup & Replication allows you to get consistent backups of MySQL databases.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

As hardware bugs go, this is a strange one! I upgraded a laptop in December 2011 with a 512GB Crucial m4 2.5-inch/9.5mm SATA Solid State Drive (SSD), Crucial part number CT512M4SSD2: http://www.crucial.com/store/partspecs.aspx?IMODULE=CT512M4SSD2 …
Storage devices are generally used to save the data or sometime transfer the data from one computer system to another system. However, sometimes user accidentally erased their important data from the Storage devices. Users have to know how data reco…
This video Micro Tutorial explains how to clone a hard drive using a commercial software product for Windows systems called Casper from Future Systems Solutions (FSS). Cloning makes an exact, complete copy of one hard disk drive (HDD) onto another d…
this video summaries big data hadoop online training demo (http://onlineitguru.com/big-data-hadoop-online-training-placement.html) , and covers basics in big data hadoop .

916 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question