data recovery - cse.chalmers.se · analysis report order recovery delivery economy 4-6 days...
TRANSCRIPT
![Page 1: Data Recovery - cse.chalmers.se · Analysis Report Order Recovery Delivery Economy 4-6 days Standard 2 days Express 7 hours Economy 6-10 days 3-5 days Express 24 hours TNT JetPak](https://reader034.vdocuments.site/reader034/viewer/2022042811/5fa05887e885ad067b1bd095/html5/thumbnails/1.jpg)
Data Recovery- What is possible to recover and how?
Data Erasure
- How to erase information in a secure way
Åke Ljungqvist, Country Manager Sweden
![Page 2: Data Recovery - cse.chalmers.se · Analysis Report Order Recovery Delivery Economy 4-6 days Standard 2 days Express 7 hours Economy 6-10 days 3-5 days Express 24 hours TNT JetPak](https://reader034.vdocuments.site/reader034/viewer/2022042811/5fa05887e885ad067b1bd095/html5/thumbnails/2.jpg)
Who is Ibas?
• Norway...
• Recovery of hard drives after fire exposure...
• Unforeseen costs...
![Page 3: Data Recovery - cse.chalmers.se · Analysis Report Order Recovery Delivery Economy 4-6 days Standard 2 days Express 7 hours Economy 6-10 days 3-5 days Express 24 hours TNT JetPak](https://reader034.vdocuments.site/reader034/viewer/2022042811/5fa05887e885ad067b1bd095/html5/thumbnails/3.jpg)
• Founded in 1978
• Owner: Kroll Ontrack
• Business areas
- Data Recovery
- Data Erasure
- Computer Forensics
• Number of employed
(Nordic countries): 68
• World wide (Kroll Ontrack)
• Global customer service: 24/7/365
About Ibas
![Page 4: Data Recovery - cse.chalmers.se · Analysis Report Order Recovery Delivery Economy 4-6 days Standard 2 days Express 7 hours Economy 6-10 days 3-5 days Express 24 hours TNT JetPak](https://reader034.vdocuments.site/reader034/viewer/2022042811/5fa05887e885ad067b1bd095/html5/thumbnails/4.jpg)
Data Recovery
![Page 5: Data Recovery - cse.chalmers.se · Analysis Report Order Recovery Delivery Economy 4-6 days Standard 2 days Express 7 hours Economy 6-10 days 3-5 days Express 24 hours TNT JetPak](https://reader034.vdocuments.site/reader034/viewer/2022042811/5fa05887e885ad067b1bd095/html5/thumbnails/5.jpg)
Data recovery – when your
backup fails...
• Large amounts of data are stored on
hard drives
640 000 A4 binders equals 640 GB of data
• Technology is stressed to its limit in
order to squeeze in more data
![Page 6: Data Recovery - cse.chalmers.se · Analysis Report Order Recovery Delivery Economy 4-6 days Standard 2 days Express 7 hours Economy 6-10 days 3-5 days Express 24 hours TNT JetPak](https://reader034.vdocuments.site/reader034/viewer/2022042811/5fa05887e885ad067b1bd095/html5/thumbnails/6.jpg)
Data recovery – when your
backup fails...
• Large amounts of data are stored on
hard drives
• Technology is stressed to its limit in
order to squeeze in more data
• Hard drives will crash…
• Backup systems fails or are missing
• Human errors occurs!
![Page 7: Data Recovery - cse.chalmers.se · Analysis Report Order Recovery Delivery Economy 4-6 days Standard 2 days Express 7 hours Economy 6-10 days 3-5 days Express 24 hours TNT JetPak](https://reader034.vdocuments.site/reader034/viewer/2022042811/5fa05887e885ad067b1bd095/html5/thumbnails/7.jpg)
Only 50% of the
companies in Sweden
have procedures for
backup of laptops!!
![Page 8: Data Recovery - cse.chalmers.se · Analysis Report Order Recovery Delivery Economy 4-6 days Standard 2 days Express 7 hours Economy 6-10 days 3-5 days Express 24 hours TNT JetPak](https://reader034.vdocuments.site/reader034/viewer/2022042811/5fa05887e885ad067b1bd095/html5/thumbnails/8.jpg)
PC users are the
biggest threat to
security!!
![Page 9: Data Recovery - cse.chalmers.se · Analysis Report Order Recovery Delivery Economy 4-6 days Standard 2 days Express 7 hours Economy 6-10 days 3-5 days Express 24 hours TNT JetPak](https://reader034.vdocuments.site/reader034/viewer/2022042811/5fa05887e885ad067b1bd095/html5/thumbnails/9.jpg)
-98% of the IT managers said
that all important data is
stored on their servers where
the backup is running
- 20% of the users said they
store data locally on their own
hard drive…
![Page 10: Data Recovery - cse.chalmers.se · Analysis Report Order Recovery Delivery Economy 4-6 days Standard 2 days Express 7 hours Economy 6-10 days 3-5 days Express 24 hours TNT JetPak](https://reader034.vdocuments.site/reader034/viewer/2022042811/5fa05887e885ad067b1bd095/html5/thumbnails/10.jpg)
Data recovery- in practice
![Page 11: Data Recovery - cse.chalmers.se · Analysis Report Order Recovery Delivery Economy 4-6 days Standard 2 days Express 7 hours Economy 6-10 days 3-5 days Express 24 hours TNT JetPak](https://reader034.vdocuments.site/reader034/viewer/2022042811/5fa05887e885ad067b1bd095/html5/thumbnails/11.jpg)
Analysis Report Order Recovery Delivery
Economy
4-6 days
Standard
2 days
Express
7 hours
Economy
6-10 days
Standard
3-5 days
Express
24 hours
TNT
JetPak
Post
Taxi
Via Internet
Type of Problem
Amount of data
Delivery time
Cost
Order from
customer
Data recovery - step by step
All data handling and management is confidential, done by emplyoees with a SÄPO (Swedish Security Service) security clearance
![Page 12: Data Recovery - cse.chalmers.se · Analysis Report Order Recovery Delivery Economy 4-6 days Standard 2 days Express 7 hours Economy 6-10 days 3-5 days Express 24 hours TNT JetPak](https://reader034.vdocuments.site/reader034/viewer/2022042811/5fa05887e885ad067b1bd095/html5/thumbnails/12.jpg)
Physical damage
• Head crash (1) (2) (3)
• What is that “click sound”? (OK disk) (Head crash)
• Shock damage – often happens to laptops
• Electronic failure
• Mechanical damage
• Water (4)(5)
• Fire/Heat (6)
![Page 13: Data Recovery - cse.chalmers.se · Analysis Report Order Recovery Delivery Economy 4-6 days Standard 2 days Express 7 hours Economy 6-10 days 3-5 days Express 24 hours TNT JetPak](https://reader034.vdocuments.site/reader034/viewer/2022042811/5fa05887e885ad067b1bd095/html5/thumbnails/13.jpg)
• Viruses
• Removed files
• Partial overwrite
• Lost/corrupt system information
• Loss of specific data due to physical damage
Logical damage
![Page 14: Data Recovery - cse.chalmers.se · Analysis Report Order Recovery Delivery Economy 4-6 days Standard 2 days Express 7 hours Economy 6-10 days 3-5 days Express 24 hours TNT JetPak](https://reader034.vdocuments.site/reader034/viewer/2022042811/5fa05887e885ad067b1bd095/html5/thumbnails/14.jpg)
Typical damage - Tape
• Entanglement
• Breaches
• Mechanical failures on tape recorders
Physical damage
• Overwriting with a new backup
• Logical damage in header and raw data
Logical damage
![Page 15: Data Recovery - cse.chalmers.se · Analysis Report Order Recovery Delivery Economy 4-6 days Standard 2 days Express 7 hours Economy 6-10 days 3-5 days Express 24 hours TNT JetPak](https://reader034.vdocuments.site/reader034/viewer/2022042811/5fa05887e885ad067b1bd095/html5/thumbnails/15.jpg)
Pictures/music/data etc from all
types of flash memories on the
market can be recovered, e.g.:
• CompactFlash
• Secure Digital
• Memory Stick
• SmartMedia
• xD Picture Card
• mini / micro SD
Recovery of flash memories
![Page 16: Data Recovery - cse.chalmers.se · Analysis Report Order Recovery Delivery Economy 4-6 days Standard 2 days Express 7 hours Economy 6-10 days 3-5 days Express 24 hours TNT JetPak](https://reader034.vdocuments.site/reader034/viewer/2022042811/5fa05887e885ad067b1bd095/html5/thumbnails/16.jpg)
Photo by Helena Larsson, Naturfotograferna
![Page 17: Data Recovery - cse.chalmers.se · Analysis Report Order Recovery Delivery Economy 4-6 days Standard 2 days Express 7 hours Economy 6-10 days 3-5 days Express 24 hours TNT JetPak](https://reader034.vdocuments.site/reader034/viewer/2022042811/5fa05887e885ad067b1bd095/html5/thumbnails/17.jpg)
Photo by Helena Larsson, Naturfotograferna
![Page 18: Data Recovery - cse.chalmers.se · Analysis Report Order Recovery Delivery Economy 4-6 days Standard 2 days Express 7 hours Economy 6-10 days 3-5 days Express 24 hours TNT JetPak](https://reader034.vdocuments.site/reader034/viewer/2022042811/5fa05887e885ad067b1bd095/html5/thumbnails/18.jpg)
Photo by Helena Larsson, Naturfotograferna
![Page 19: Data Recovery - cse.chalmers.se · Analysis Report Order Recovery Delivery Economy 4-6 days Standard 2 days Express 7 hours Economy 6-10 days 3-5 days Express 24 hours TNT JetPak](https://reader034.vdocuments.site/reader034/viewer/2022042811/5fa05887e885ad067b1bd095/html5/thumbnails/19.jpg)
• Don’t panic!
• Disconnect the power
• Don’t attempt a re-start
• Don’t re-install the Operating System
or application S/W
• Don’t open the hard drive
• Make a thorough assessment of the
situation
First advice to the user…
![Page 20: Data Recovery - cse.chalmers.se · Analysis Report Order Recovery Delivery Economy 4-6 days Standard 2 days Express 7 hours Economy 6-10 days 3-5 days Express 24 hours TNT JetPak](https://reader034.vdocuments.site/reader034/viewer/2022042811/5fa05887e885ad067b1bd095/html5/thumbnails/20.jpg)
Data Erasure
![Page 21: Data Recovery - cse.chalmers.se · Analysis Report Order Recovery Delivery Economy 4-6 days Standard 2 days Express 7 hours Economy 6-10 days 3-5 days Express 24 hours TNT JetPak](https://reader034.vdocuments.site/reader034/viewer/2022042811/5fa05887e885ad067b1bd095/html5/thumbnails/21.jpg)
Data Erasure Protecting information in use is natural
• Firewalls
• Encryption
• Passwords
• Remote login security
But what happens to the information when we throw
away our computers….?
A TV news flash
![Page 22: Data Recovery - cse.chalmers.se · Analysis Report Order Recovery Delivery Economy 4-6 days Standard 2 days Express 7 hours Economy 6-10 days 3-5 days Express 24 hours TNT JetPak](https://reader034.vdocuments.site/reader034/viewer/2022042811/5fa05887e885ad067b1bd095/html5/thumbnails/22.jpg)
Why data erasure? • SECURITY – correct methodology
prevents information leakage
• ECONOMY – re-use is economic -
- premature disposal is costly
• ENVIRONMENT - functioning hard
disks make re-use possible
• PUL – Legal requirements
![Page 23: Data Recovery - cse.chalmers.se · Analysis Report Order Recovery Delivery Economy 4-6 days Standard 2 days Express 7 hours Economy 6-10 days 3-5 days Express 24 hours TNT JetPak](https://reader034.vdocuments.site/reader034/viewer/2022042811/5fa05887e885ad067b1bd095/html5/thumbnails/23.jpg)
Why data
erasure?
• SECURITY – correct methodology
prevents information leakage
• ECONOMY – re-use is economic -
- premature disposal is costly
• ENVIRONMENT - functioning hard
disks make re-use possible
• PUL – Legal requirements
![Page 24: Data Recovery - cse.chalmers.se · Analysis Report Order Recovery Delivery Economy 4-6 days Standard 2 days Express 7 hours Economy 6-10 days 3-5 days Express 24 hours TNT JetPak](https://reader034.vdocuments.site/reader034/viewer/2022042811/5fa05887e885ad067b1bd095/html5/thumbnails/24.jpg)
![Page 25: Data Recovery - cse.chalmers.se · Analysis Report Order Recovery Delivery Economy 4-6 days Standard 2 days Express 7 hours Economy 6-10 days 3-5 days Express 24 hours TNT JetPak](https://reader034.vdocuments.site/reader034/viewer/2022042811/5fa05887e885ad067b1bd095/html5/thumbnails/25.jpg)
![Page 26: Data Recovery - cse.chalmers.se · Analysis Report Order Recovery Delivery Economy 4-6 days Standard 2 days Express 7 hours Economy 6-10 days 3-5 days Express 24 hours TNT JetPak](https://reader034.vdocuments.site/reader034/viewer/2022042811/5fa05887e885ad067b1bd095/html5/thumbnails/26.jpg)
160 000 000 SEK down the drain… When the
computers could be reused…
![Page 27: Data Recovery - cse.chalmers.se · Analysis Report Order Recovery Delivery Economy 4-6 days Standard 2 days Express 7 hours Economy 6-10 days 3-5 days Express 24 hours TNT JetPak](https://reader034.vdocuments.site/reader034/viewer/2022042811/5fa05887e885ad067b1bd095/html5/thumbnails/27.jpg)
The Swedish Data Inspection Board:
![Page 28: Data Recovery - cse.chalmers.se · Analysis Report Order Recovery Delivery Economy 4-6 days Standard 2 days Express 7 hours Economy 6-10 days 3-5 days Express 24 hours TNT JetPak](https://reader034.vdocuments.site/reader034/viewer/2022042811/5fa05887e885ad067b1bd095/html5/thumbnails/28.jpg)
Data erasure – How?
FUNCTIONING hard drive
OS-tools (Formatting/deletion)
Not intended for complete erasure
Dependent on the Operating System
Tools for file removal
Overwrites part of the hard drive
Dependent on the Operating System
Disk sanitizers
Overwrites the whole hard drive
Independent of the Operating System
Independent of the BIOS
![Page 29: Data Recovery - cse.chalmers.se · Analysis Report Order Recovery Delivery Economy 4-6 days Standard 2 days Express 7 hours Economy 6-10 days 3-5 days Express 24 hours TNT JetPak](https://reader034.vdocuments.site/reader034/viewer/2022042811/5fa05887e885ad067b1bd095/html5/thumbnails/29.jpg)
• All magnetic storage is based on a single principle, i.e.:
• Data is stored by changing the polarity of magnetic domains
What do we want to achieve?
![Page 30: Data Recovery - cse.chalmers.se · Analysis Report Order Recovery Delivery Economy 4-6 days Standard 2 days Express 7 hours Economy 6-10 days 3-5 days Express 24 hours TNT JetPak](https://reader034.vdocuments.site/reader034/viewer/2022042811/5fa05887e885ad067b1bd095/html5/thumbnails/30.jpg)
USER
APPLICATION
OS
Buffer Memory
BIOS
Sector Buffer
uC+Firmware
Sanitizing Tools
OS Tool
HOST SYSTEM
HARD DRIVE
Media
OntrackEraser
System overview:
![Page 31: Data Recovery - cse.chalmers.se · Analysis Report Order Recovery Delivery Economy 4-6 days Standard 2 days Express 7 hours Economy 6-10 days 3-5 days Express 24 hours TNT JetPak](https://reader034.vdocuments.site/reader034/viewer/2022042811/5fa05887e885ad067b1bd095/html5/thumbnails/31.jpg)
Erasure report - Traceability
Ontrack Eraser Report------------------------------------------------------------Time of erasure Fri Sep 07 16:27:30 2007Time of report upload Fri Sep 07 16:00:26 2007Software Version 3.0.1.2Overwrites 1Verify FalsePattern SEKollOntrack AlgorithmReport Security Hash eba2f7cead6157a219ceaf13cf410403Customer Defined Fields:Media------------Disk #1Model ST3160828AS40Y9046LENSerial Number 4MT26SCKCapacity 160041885696Block Size 512Type Erasure Status SuccessUnlock SuccessLock type No locking----------------
Model IBMManufacturer IBMVersion 0Serial 65453168416871BIOS:Vendor IBMVersion 2EKT32AUS (12/16/2005)RAM:Slot J10Size 0Slot J3Size 536870912Slot J4Size 0Slot J9Size 536870912Slot System board or motherboardSize 1073741824CPU:Slot LGA775/PSC/TJSProduct Intel(R) Pentium(R) 4 CPU 3.40GHzVendor Intel Corp.Capacity 3800000000Width 64Size 3400000000
![Page 32: Data Recovery - cse.chalmers.se · Analysis Report Order Recovery Delivery Economy 4-6 days Standard 2 days Express 7 hours Economy 6-10 days 3-5 days Express 24 hours TNT JetPak](https://reader034.vdocuments.site/reader034/viewer/2022042811/5fa05887e885ad067b1bd095/html5/thumbnails/32.jpg)
Defect hard drives and other media
Saturation of the magnetic layer
Fast and secure method when data must not be re-used
Erasure of hard drives, tapeand floppy disks
Compliant to the Department of Defencestandard (DoD 5220.22M) and Swedish military requirements
Data erasure – How?
![Page 33: Data Recovery - cse.chalmers.se · Analysis Report Order Recovery Delivery Economy 4-6 days Standard 2 days Express 7 hours Economy 6-10 days 3-5 days Express 24 hours TNT JetPak](https://reader034.vdocuments.site/reader034/viewer/2022042811/5fa05887e885ad067b1bd095/html5/thumbnails/33.jpg)
What does the ”data” look like?
A data track on a hard drive before degaussing
![Page 34: Data Recovery - cse.chalmers.se · Analysis Report Order Recovery Delivery Economy 4-6 days Standard 2 days Express 7 hours Economy 6-10 days 3-5 days Express 24 hours TNT JetPak](https://reader034.vdocuments.site/reader034/viewer/2022042811/5fa05887e885ad067b1bd095/html5/thumbnails/34.jpg)
A data track on a hard disk after degaussing
What does the ”data” look like?