[linux-elitists] Hard drive recovery in L.A. area

Karsten M. Self kmself@ix.netcom.com
Wed Apr 11 18:56:12 PDT 2001

on Wed, Apr 11, 2001 at 05:29:47PM -0700, Ben Woodard (ben@valinux.com) wrote:
> > No idea what the costs are.
> Really expensive!!! We did that at Cisco once and I think that the
> bill was something like 15K for some really important data. I think
> that it is something like $500/hr.

Probably depends on what they have to do to recover the data.

Standard fried disk:  you can image the disk and go through it with
filesystem debugging tools.  Most of the data are there, but the chains
and continuity are broken.  Putting the pieces back together.  Charges
for this are probably relatively nominal.

Data deletion -- anything from undelete utilities to binary scanning of
systems to find unlinked fragments of files.

Extensive recovery of deleted drives -- once you get into
force/tunneling magnetic microscopy (ams MSM, MFM, or MTM), you start
getting bills in the 10k-100k region, median about 30k.  This involves
going over the disk surface with a microscope looking for the traces of
patterns left even after multiple overwrites of data.  The Chinese are
probably getting really good at this right now.

I'd gotten involved in a comp*security thread on this topic a year or so
back, did some research.  The folks who came up with the algorithms used
in secure deletion utilities (e.g.:  wipe) have worked out just what
patterns are required to securely delete all traces of data -- this
requires resonating magnetic media at specific frequencies repeatedly to
produce a largely random background.

One of my last actions at a former employer was to nuke a stash of MP3s
(no need for them to get hit with copyright violation on top of their
other problems -- not that this helped).   The job had run for well over
an hour before I left -- if you are keeping your
SecretPlansForWorldDomination on your computer and plan on nuking the
data when the cops kick in the door (or the fighter clips your wing)....
I'd rely on something else or start by nuking my GPG keys required to
decrypt the data.

Best method for data recovery?



Karsten M. Self <kmself@ix.netcom.com>    http://kmself.home.netcom.com/
 What part of "Gestalt" don't you understand?       There is no K5 cabal
  http://gestalt-system.sourceforge.net/         http://www.kuro5hin.org
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 232 bytes
Desc: not available
Url : http://allium.zgp.org/pipermail/linux-elitists/attachments/20010411/aee243ec/attachment.pgp 

More information about the linux-elitists mailing list