Keylogger

[Xen]

Joel Rees schreef op 04-12-2017 0:56:

> Did you miss the part where some guy who was doing it for a living in 
> 2009 gave a description if what he did and said explicitly how 
> sucessful he was and gave some background on why the usual case, 
> recovering data from a heavily used HD, was more successful than from a 
> once-used, practcally empty HD?

I must say that sounds rather convincing. I mean it was in the comments 
to other article (thank you).

>> You also don't allude which companies offer these (explicit) services.
> 
> I guess you didn't look at the URL as you read the second one?

The problem is that on that same site is this article:

https://digital-forensics.sans.org/blog/2009/01/15/overwriting-hard-drive-data/

Which is from a scientist 'proving' that it can't be done.

The extra data only seems to be required to 'anchor' the process because 
of known-file recognition and perhaps subsequent tuning of parameters 
based on that.

Which means that a disk not containing any operating system files would 
be unrecoverable, according to this guy.

I don't discount this tale so it seems you are right.

At least, back in 2009.

> I half to admit, I'm not sure why I bother mentioning it. If we worry 
> too much about where our information leaks, we can't use any of this 
> marvelous technology. Each of us has to choose how, and to what level, 
> we protect ourselves.

Yes. The process took upward a month according to that guy and at a cost 
of > $1000 for a 120GB drive.