Data recovery after a zero fill

Discussion in 'Mac Basics and Help' started by marianafelix, May 21, 2009.

  1. marianafelix macrumors newbie

    Joined:
    May 21, 2009
    #1
    Hi everyone,

    Due to a HUGE misundesrtanding, my dad erased my external HD!! But not only that... he cleaned it and made a zero fill!!!

    Is there any way I can recover my information? Is there maybe any way I can undo the zero fill?

    If someone knows, PLEASE PLEASE let me know. I'm desperate.
     
  2. Consultant macrumors G5

    Consultant

    Joined:
    Jun 27, 2007
    #2
    Nope. You just have to download your pron again. =p
     
  3. Insulin Junkie macrumors 65816

    Insulin Junkie

    Joined:
    May 5, 2008
    Location:
    Mainland Europe
    #3
    Ouch dude. I'd go ballistic if someone erased my external HD.
    I suppose I'm fortunate to have parents so hopeless at computers, they wouldn't even know how to erase a HD :cool:
     
  4. GimmeSlack12 macrumors 603

    GimmeSlack12

    Joined:
    Apr 29, 2005
    Location:
    San Francisco
    #4
    The point of a zero fill is so you cannot recover any data. Sorry man.
     
  5. RandomKamikaze macrumors 6502a

    RandomKamikaze

    Joined:
    Jan 8, 2009
    Location:
    UK
    #5
    Wirelessly posted (Mozilla/5.0 (iPhone; U; CPU iPhone OS 2_2_1 like Mac OS X; en-us) AppleWebKit/525.18.1 (KHTML, like Gecko) Version/3.1.1 Mobile/5H11 Safari/525.20)

    Personally I'd get my dad to download it.

    "here's a list of film names. Google and download them. Ask no questions"
     
  6. marianafelix thread starter macrumors newbie

    Joined:
    May 21, 2009
  7. Guiyon macrumors 6502a

    Joined:
    Mar 19, 2008
    Location:
    North Shore, MA
    #7
    What software? If you're referring to data recovery software, forget about it. If a zero all data was done when reformatting it's permanently gone, not even professional recovery services can get data from the drive.
     
  8. marianafelix thread starter macrumors newbie

    Joined:
    May 21, 2009
  9. GimmeSlack12 macrumors 603

    GimmeSlack12

    Joined:
    Apr 29, 2005
    Location:
    San Francisco
    #9
    Correct. You are totally and completely out of luck. I am really really sorry.
     
  10. Jethryn Freyman macrumors 68020

    Jethryn Freyman

    Joined:
    Aug 9, 2007
    Location:
    Australia
    #10
    There's nothing you can do, unless you have a magnetic force microscope.
     
  11. DeusInvictus7 macrumors 68020

    Joined:
    Aug 13, 2008
    Location:
    Kitchener, Ontario
    #11
    Nah, that won't even work. He's gonna need a Time Machine to get his stuff back.
     
  12. Makosuke macrumors 603

    Joined:
    Aug 15, 2001
    Location:
    The Cool Part of CA, USA
    #12
    And even that, it has been argued by a recent paper, wouldn't work on a modern drive. Almost certainly not on bulk data.

    Either way that's spy agency stuff, so nothing to do but mourn. Take it as a hard-earned lesson to ALWAYS have a backup of anything important enough to feel sad about losing.
     
  13. Bobbi Flekman macrumors regular

    Joined:
    Jan 14, 2008
    #13
    You can restore a backup... That's what they're there for...
     
  14. arjen92 macrumors 65816

    arjen92

    Joined:
    Sep 9, 2008
    Location:
    Below sea level
    #14
    why would there be an option to write 20x times the same zero. Because if you really want to, you can get some information from, even if zero's are written one time.

    I would knock on FBI's door. Maybe they can help :p
     
  15. yg17 macrumors G5

    yg17

    Joined:
    Aug 1, 2004
    Location:
    St. Louis, MO
    #15
    No, you can't. The 20 pass zero write is to appease the paranoid types in the CIA and FBI who like big numbers and think writing zeros 20 times is more secure than writing zeros one time. One pass zero write is enough to completely wipe the drive clean without any chance of recovery.
     
  16. angelwatt Moderator emeritus

    angelwatt

    Joined:
    Aug 16, 2005
    Location:
    USA
    #16
    Actually, it is possible to recover data from a zeroed out disk. See this paper from a very smart guy to see some of the details. A zero out will be more than efficient for most people, as most commercial recovery software isn't sophisticated enough to do the recovery. Though, for people in work areas that deal with highly sensitive or classified material, a 7-pass should really be used. The 35-pass isn't needed really because of the advancements made in HD construction, but wasn't always the case.
     
  17. InvalidUserID macrumors 6502a

    InvalidUserID

    Joined:
    Sep 7, 2008
    Location:
    Palo Alto, CA
    #17
    My company has sent out emails to Mac users to use the 7-pass on work related material.

    <---corporate finance.
     
  18. mkrishnan Moderator emeritus

    mkrishnan

    Joined:
    Jan 9, 2004
    Location:
    Grand Rapids, MI, USA
    #18
    As I understand it, isn't it generally possible to recover small chunks of data here and there from a single pass overwrite, but not the vast majority of the disk contents? Recovering the small chunks would be dangerous if the drive had sensitive material on it, and one might make something of the small chunks, but in this case, it would be generally useless, since it wouldn't typically amount to usable files.
     
  19. old-wiz macrumors G3

    Joined:
    Mar 26, 2008
    Location:
    West Suburban Boston Ma
    #19
    It's kind of moot discussing theoretical ways to recover from an erase if it's not available to the OP.

    The disk might have been wiped multiple pass as well.
     
  20. angelwatt Moderator emeritus

    angelwatt

    Joined:
    Aug 16, 2005
    Location:
    USA
    #20
    Right, that's why I made sure to phrase it as recovering data, and not recovering files, as it's likely harder to get a completely recovered file. I'm not expert on this, I just read about it some times as I enjoy the topic of computer security.
     
  21. Makosuke macrumors 603

    Joined:
    Aug 15, 2001
    Location:
    The Cool Part of CA, USA
    #21
    A paper written in 1996, when hard drives had at least two orders of magnitude less density. Yes, I understand your point that it is theoretically possible to recover some organized bits from a wiped drive, but even that paper itself includes the following in the two more recent epilogues:

    ...and even more recently:

    The point here isn't that it's not hypothetically possible to recover a few KB of data from a one-pass zeroed drive if you have exotic spy agency technology--it may well be. It's that from anything resembling a realistic perspective, it's just not going to happen.

    More importantly, someone wrote a theoretical paper in 1996 that was then used directly as the basis for some US government wipe methods (angelwatt's referenced paper is what everything has been based on for about 13 years now). The construction and realities of hard drives have changed drastically since then, but the "voodoo" has stuck, and it's a little sad.

    Note, by the way, that a 7-pass erase involves seven passes of random data, whereas the MacOS single-pass just writes zeros. This no doubt hypothetically increases the chances of recovery if you've got a multi-million dollar spy agency disk recoverer on hand vs. a single-pass random data write, but the fact of the matter here is any substantial recovery of bulk data from even a single-pass zeroed modern drive is functionally nil.

    I'm not arguing that it's not interesting from a technical and security standpoint, I just wish people wouldn't continue to hold the no-longer-true belief that if you don't 7-pass wipe a disk it's recoverable in any real-world scenario.
     
  22. mkrishnan Moderator emeritus

    mkrishnan

    Joined:
    Jan 9, 2004
    Location:
    Grand Rapids, MI, USA
    #22
    Right, I think everyone agrees that the OP is SOL. ;)
     
  23. angelwatt Moderator emeritus

    angelwatt

    Joined:
    Aug 16, 2005
    Location:
    USA
    #23
    Right, that's why I stated earlier that a zero wipe would be more than sufficient for most people. My job requires otherwise though.

    Yes indeed.
     
  24. Jethryn Freyman macrumors 68020

    Jethryn Freyman

    Joined:
    Aug 9, 2007
    Location:
    Australia
    #24
    Data can be recovered after a zero fill. The largest intact file recovered so far was 4KB in size after a single pass. 7 passes is recommended if you actually have something to hide and someone is looking for it.
     

Share This Page