Recovering deleted wallet/files from HDD

Ultegra134

hero member

Activity: 1582

Merit: 758

Quote from: QuickAccount on December 08, 2021, 03:40:26 PM

Quote from: larry_vw_1955 on December 07, 2021, 11:48:39 PM

Quote from: HCP on December 02, 2021, 01:17:27 AM

A very confusing answer to be sure...

User1: "It's bad for the environment to destroy perfectly functional drives, you should zero it and reuse it"
User2: "I agree, I smashed my harddrive with a hammer"

Ummm what??!? Huh

Still, the amount of time required to properly zerofill a drive can be quite massive... especially when you're talking Terabyte+ sized drives! Shocked

whereas... 5 minutes and a hammer? Tongue

a strong enough magnet should do the trick. in seconds.

The reason I use a hammer is because If I can hear the disks rattling inside, I know the job is done and that the data cant be recovered.

If I were to hammer them, I'd just keep them aside. Not keen on generating electrical/hardware waste. You could potentially use them as a backup, or an external HDD, I don't see the reason to smash them.

QuickAccount

member

Activity: 189

Merit: 52

In a world of coins, use them.

Quote from: larry_vw_1955 on December 07, 2021, 11:48:39 PM

Quote from: HCP on December 02, 2021, 01:17:27 AM

A very confusing answer to be sure...

User1: "It's bad for the environment to destroy perfectly functional drives, you should zero it and reuse it"
User2: "I agree, I smashed my harddrive with a hammer"

Ummm what??!? Huh

Still, the amount of time required to properly zerofill a drive can be quite massive... especially when you're talking Terabyte+ sized drives! Shocked

whereas... 5 minutes and a hammer? Tongue

a strong enough magnet should do the trick. in seconds.

The reason I use a hammer is because If I can hear the disks rattling inside, I know the job is done and that the data cant be recovered.

larry_vw_1955

sr. member

Activity: 1106

Merit: 430

Quote from: HCP on December 02, 2021, 01:17:27 AM

A very confusing answer to be sure...

User1: "It's bad for the environment to destroy perfectly functional drives, you should zero it and reuse it"
User2: "I agree, I smashed my harddrive with a hammer"

Ummm what??!? Huh

Still, the amount of time required to properly zerofill a drive can be quite massive... especially when you're talking Terabyte+ sized drives! Shocked

whereas... 5 minutes and a hammer? Tongue

a strong enough magnet should do the trick. in seconds.

ABCbits

legendary

Activity: 2870

Merit: 7490

Crypto Swap Exchange

Quote from: BitMaxz on December 01, 2021, 07:25:05 PM

Quote from: QuickAccount on December 01, 2021, 04:20:42 PM

https://github.com/qayshp/TestDisk

Have you checked the GitHub page it was developed years ago which is very old?

The GitHub page is abandoned, the latest stable version is 7.1 which released on July 7, 2019 according to https://www.cgsecurity.org/wiki/TestDisk. So it's not as old as you expected.

Quote from: nc50lc on December 02, 2021, 02:46:26 AM

Quote from: HCP on December 02, 2021, 01:17:27 AM

Still, the amount of time required to properly zerofill a drive can be quite massive... especially when you're talking Terabyte+ sized drives! Shocked

whereas... 5 minutes and a hammer? Tongue

Yeah, last time I zero-filled a 500GB WD Hard Drive, it took more or less 3 hours if my memory serves me right (that was 3 years ago).
Double that for a 1TB same speed HDD; although, the amount of time is still inconsequential if you want to re-use the disk.

You could estimate the time by benchmark it's sequential write speed, then divide size of your HDD with benchmark result.

nc50lc

legendary

Activity: 2394

Merit: 5531

Self-proclaimed Genius

Quote from: HCP on December 02, 2021, 01:17:27 AM

Still, the amount of time required to properly zerofill a drive can be quite massive... especially when you're talking Terabyte+ sized drives! Shocked

whereas... 5 minutes and a hammer? Tongue

Yeah, last time I zero-filled a 500GB WD Hard Drive, it took more or less 3 hours if my memory serves me right (that was 3 years ago).
Double that for a 1TB same speed HDD; although, the amount of time is still inconsequential if you want to re-use the disk.

HCP

legendary

Activity: 2086

Merit: 4316

A very confusing answer to be sure...

User1: "It's bad for the environment to destroy perfectly functional drives, you should zero it and reuse it"
User2: "I agree, I smashed my harddrive with a hammer"

Ummm what??!? Huh

Still, the amount of time required to properly zerofill a drive can be quite massive... especially when you're talking Terabyte+ sized drives! Shocked

whereas... 5 minutes and a hammer? Tongue

nc50lc

legendary

Activity: 2394

Merit: 5531

Self-proclaimed Genius

Quote from: QuickAccount on December 01, 2021, 04:20:42 PM

Quote from: larry_vw_1955 on November 21, 2021, 02:20:09 AM

Quote

If you're offloading your own computer, and the hard drive has to be included for whatever reason, then I would recommend writing 0's to it, with multiple checks. You can do this within Linux or you can use a program like DBAN if you wish.

That's a much better solution for the environment than destroying a perfectly good hard drive. IMO, it's kind of the height of conceit to destroy a perfectly good hard drive. Remember guys, someone out there needs that hard drive. :D

I second this.

-snip- Even if you overwrite "everything" data is still recoverable with highly accessible software such as this one off of github:

You second~ed the replies yet you've countered their points :/

Anyways, what they meant by "writing 0's" is to 'low-level format' the drives which will turn all of the data on the drive into 0's (binary: 0 or 1).
There's nothing recoverable after that, your example software can only restore deleted files or a formatted drive, those are files which aren't really deleted but flagged as "overwritable".

BitMaxz

legendary

Activity: 3304

Merit: 3037

BTC price road to $80k

Quote from: QuickAccount on December 01, 2021, 04:20:42 PM

I second this.

Recovering data from a Hard drive that has been "wiped" isnt hard. When I bought an ssd to replace my computer's hard drive, I overwrote everything on it, then went out to the driveway and slammed it with a hammer until I could hear the disk plates rattling inside. No data is every coming out of that drive. Even if you overwrite "everything" data is still recoverable with highly accessible software such as this one off of github:

https://github.com/qayshp/TestDisk

Have you checked the GitHub page it was developed years ago which is very old?

And they only support Windows NT/2K/XP for NTFS drive so do you think you can recover files from Windows 7 and up?
That tool is outdated you can't just easily recover files using that tool you should use a tool that is updated and support almost all newer OS.

QuickAccount

member

Activity: 189

Merit: 52

In a world of coins, use them.

Quote from: larry_vw_1955 on November 21, 2021, 02:20:09 AM

Quote

If you're offloading your own computer, and the hard drive has to be included for whatever reason, then I would recommend writing 0's to it, with multiple checks. You can do this within Linux or you can use a program like DBAN if you wish.

That's a much better solution for the environment than destroying a perfectly good hard drive. IMO, it's kind of the height of conceit to destroy a perfectly good hard drive. Remember guys, someone out there needs that hard drive. Cheesy

I disagree with this.

Recovering data from a Hard drive that has been "wiped" isnt hard. When I bought an ssd to replace my computer's hard drive, I overwrote everything on it, then went out to the driveway and slammed it with a hammer until I could hear the disk plates rattling inside. No data is every coming out of that drive. Even if you overwrite "everything" data is still recoverable with highly accessible software such as this one off of github:

https://github.com/qayshp/TestDisk

larry_vw_1955

sr. member

Activity: 1106

Merit: 430

Quote

If you're offloading your own computer, and the hard drive has to be included for whatever reason, then I would recommend writing 0's to it, with multiple checks. You can do this within Linux or you can use a program like DBAN if you wish.

That's a much better solution for the environment than destroying a perfectly good hard drive. IMO, it's kind of the height of conceit to destroy a perfectly good hard drive. Remember guys, someone out there needs that hard drive. Cheesy

fillippone

legendary

Activity: 2114

Merit: 15144

Fully fledged Merit Cycler - Golden Feather 22-23

Quote from: Welsh on November 10, 2021, 03:06:38 PM

If you're offloading your own computer, and the hard drive has to be included for whatever reason, then I would recommend writing 0's to it, with multiple checks. You can do this within Linux or you can use a program like DBAN if you wish.

Great advice.
I have been doing that since a long time. Usually I am declaring this to the buyer stating only that "HDD has just been formatted for YOUR convenience". They even look quite pleased by this innocent lie.

Ultegra134

hero member

Activity: 1582

Merit: 758

Quote from: Welsh on November 10, 2021, 03:06:38 PM

Quote from: Ultegra134 on November 10, 2021, 12:37:38 PM

I wasn't really concerned before I made this thread, the other users here warned me about the dangers of leaving a computer unattended, especially to a technician. I wasn't too concerned about my Metamask wallet, since it's encrypted and requires my password, the Bitcoin one though was at a higher risk.

Thinking back to it, i shouldn't have handed my laptop without removing the HDD, which was merely a two minute job.

Yeah, my personal rule set is never include your hard drive with the laptop when you're offloading it to someone else. You don't know what people's intentions are, though most will likely be innocent, and wouldn't even think about checking for previous data. Then, the more, and more they use it the less likely it becomes to recover anything substantial.

If you are purchasing old hard drives it is usually enough to wipe the hard drive via a format, and not worry too much about malicious code. Though, there is a small amount of risk involved with that too. If you're offloading your own computer, and the hard drive has to be included for whatever reason, then I would recommend writing 0's to it, with multiple checks. You can do this within Linux or you can use a program like DBAN if you wish.

Thanks for your feedback, it's definitely a concerning matter, to be honest, I didn't even think about checking the hard drive, when I bought this refurbished laptop, (HDD was used, so I would probably find something if I was willing to), but it didn't even cross my mind to snoop into someone's files like that.

I haven't made up my mind yet, on whether to sell it or not, but I appreciate your feedback regarding the HDD overwriting.

Welsh

staff

Activity: 3276

Merit: 4111

Quote from: Ultegra134 on November 10, 2021, 12:37:38 PM

I wasn't really concerned before I made this thread, the other users here warned me about the dangers of leaving a computer unattended, especially to a technician. I wasn't too concerned about my Metamask wallet, since it's encrypted and requires my password, the Bitcoin one though was at a higher risk.

Thinking back to it, i shouldn't have handed my laptop without removing the HDD, which was merely a two minute job.

Yeah, my personal rule set is never include your hard drive with the laptop when you're offloading it to someone else. You don't know what people's intentions are, though most will likely be innocent, and wouldn't even think about checking for previous data. Then, the more, and more they use it the less likely it becomes to recover anything substantial.

If you are purchasing old hard drives it is usually enough to wipe the hard drive via a format, and not worry too much about malicious code. Though, there is a small amount of risk involved with that too. If you're offloading your own computer, and the hard drive has to be included for whatever reason, then I would recommend writing 0's to it, with multiple checks. You can do this within Linux or you can use a program like DBAN if you wish.

Ultegra134

hero member

Activity: 1582

Merit: 758

Quote from: examplens on November 09, 2021, 07:45:15 PM

Interesting discussion here. I have had cases like this where users were concerned about the possibility of unauthorized duplication of data.
as far as I know, it was enough to do low-level format, then 100% disk capacity is filled with some garbage (usually pornography) and this cycle is repeated two or three times depending on the level of paranoia.

I wasn't really concerned before I made this thread, the other users here warned me about the dangers of leaving a computer unattended, especially to a technician. I wasn't too concerned about my Metamask wallet, since it's encrypted and requires my password, the Bitcoin one though was at a higher risk.

Thinking back to it, i shouldn't have handed my laptop without removing the HDD, which was merely a two minute job.

examplens

legendary

Activity: 3248

Merit: 3098

Interesting discussion here. I have had cases like this where users were concerned about the possibility of unauthorized duplication of data.
as far as I know, it was enough to do low-level format, then 100% disk capacity is filled with some garbage (usually pornography) and this cycle is repeated two or three times depending on the level of paranoia.

fillippone

legendary

Activity: 2114

Merit: 15144

Fully fledged Merit Cycler - Golden Feather 22-23

Quote from: figliar0 on November 08, 2021, 12:45:08 PM

Quote from: Lucius on November 07, 2021, 11:10:21 AM

Quote from: fillippone on November 07, 2021, 06:02:19 AM

Maybe it’s worth asking him to assist in person to your repair, so that you don’t leave him with your datas alone. This could be counterproductive for opsec reasons anyway.

I have seen that some of the services that offer data rescue in my country offer just such a service - means that the client is present when rescuing data (which of course means a higher price). Yet even in such a situation, is it possible to be 100% sure that the data is being copied to only one location, and that this person is not doing another secret backup simultaneously?

Of course not. If he will use his computer how can you say that data is not copied somewhere else? You cannot be sure if he do not have som program copying your data elsewhere on the background.

I think that, being on the place while my PC is repaired , I could personally be pretty sure about what's getting on, and being able to spot any fraudulent action.

Just remember that self custody is hard. So you can securely hand over the custody of your assets to a professional custodian (not an exchange).

figliar0

member

Activity: 110

Merit: 19

Quote from: Lucius on November 07, 2021, 11:10:21 AM

Quote from: fillippone on November 07, 2021, 06:02:19 AM

Maybe it’s worth asking him to assist in person to your repair, so that you don’t leave him with your datas alone. This could be counterproductive for opsec reasons anyway.

I have seen that some of the services that offer data rescue in my country offer just such a service - means that the client is present when rescuing data (which of course means a higher price). Yet even in such a situation, is it possible to be 100% sure that the data is being copied to only one location, and that this person is not doing another secret backup simultaneously?

Of course not. If he will use his computer how can you say that data is not copied somewhere else? You cannot be sure if he do not have som program copying your data elsewhere on the background.

Lucius

legendary

Activity: 3234

Merit: 5637

Blackjack.fun-Free Raffle-Join&Win $50🎲

Quote from: fillippone on November 07, 2021, 06:02:19 AM

Maybe it’s worth asking him to assist in person to your repair, so that you don’t leave him with your datas alone. This could be counterproductive for opsec reasons anyway.

I have seen that some of the services that offer data rescue in my country offer just such a service - means that the client is present when rescuing data (which of course means a higher price). Yet even in such a situation, is it possible to be 100% sure that the data is being copied to only one location, and that this person is not doing another secret backup simultaneously?

Quote from: vapourminer on November 07, 2021, 09:47:19 AM

i never leave any old or failed disks anywhere or in anything i giveaway or sell. the drives are destroyed. even if it dies when in the warranty period im not sending a drive back for a replacement so i just write it off.

Exactly what I do all my life, I never sell or throw away old computers or mobile phones. I still have my first cell phone over the age of 20 which was state-of-the-art technology at the time, but quite inconvenient to carry because of its size and weight - who would say that today's smartphones are even bigger and similar in weight

vapourminer

legendary

Activity: 4354

Merit: 3614

what is this "brake pedal" you speak of?

Quote from: DaveF on November 05, 2021, 07:48:23 AM

I don't know how the $80 generic ones work, but the 'real' ones are just running an embedded linux controller and dd 'ing (more or less) the entire drive.
The source is only ever mounted in read only so having it come back as 'raw' is just about impossible.

This: https://www.amazon.com/SATA-Hard-Drive-Duplicator-Eraser/dp/B00G6TG5YE
is not the same as this: https://www.mediaduplicationsystems.com/fx2125-sata-sas-usb3.0-hard-drive-duplicator

If you walk into a shop or your tech is using something like the StarTech one. Run away as fast as you can.

can confirm the startech is junk. i have it (maybe not exactly this model but a similar startech) and while its never corrupted the source drive its only successfully duplicated maybe half the drives i tried. like 4 or 5 drives out of 10 or so. and man its slow af. waste of money.

i never leave any old or failed disks anywhere or in anything i giveaway or sell. the drives are destroyed. even if it dies when in the warranty period im not sending a drive back for a replacement so i just write it off.

Ultegra134

hero member

Activity: 1582

Merit: 758

Quote from: fillippone on November 07, 2021, 06:02:19 AM

Quote from: ABCbits on November 07, 2021, 05:52:18 AM

Just like @LoyceV said, remove the HDD before giving the device to someone else. If they ask why the HDD is missing, you could say you need the data for urgent work and ask them to use their own HDD/USB drive for testing.

I am not sure many laptop allows for an easy HDD removal, even more without breaking warrant (Mac User anyone?).
Also,even if I haven’t any wallet in it, just having access to my email a malicious user could do extremely dangerous actions.
Basically, when to give your laptop to an external technician, you are trusting him not to rip you off.
Maybe it’s worth asking him to assist in person to your repair, so that you don’t leave him with your datas alone. This could be counterproductive for opsec reasons anyway.

The main reason I bought a refurbished laptop was firstly, because it was cheap, and secondly, they are easily accessible. I do not even need a screwdriver to take the back out. On top of that, in case something breaks, it's easily replaceable, even if we're talking about a full replacement.

Topic: Recovering deleted wallet/files from HDD (Read 693 times)