SANS Digital Forensics and Incident Response Blog: Tag - Hard drive recovery

Spin-Stand Microscopy of Hard Disk Data

I shall be posting a series detailing the additional data not included in the paper [1] on recovering overwritten data in the following weeks.

My thanks to Dave Kleiman (one of the original papers co-author's with myself) for reviewing and adding some details to this post series.

Due to the limitations of peer reviewed papers, much of the detail of a process is commonly lost. This series of posts will endeavor to fill out the areas that are not covered in the paper in any detail and also add some further level of knowledge.

The recovery of data from damaged hard drives has come a long way over the years. Various techniques have been developed using both optical and electron microscopes and leading to the use of Magnetic force microscopy (MFM). MFM is a category of Scanning Probe Microscopy (SPM) and perhaps is the most widely used of these techniques. Of the techniques


First Response: Recovering a Dying Hard Drive

By David Hoelzer
Enclave Forensics

So there I was, happily working away, when Time Machine pops up and tells me, "Time Machine has not successfully completed a backup in 18 days." "That's strange," I thought, and proceeded to look into what could possibly be wrong.

I won't bore you with my deep satisfaction with Macs and Time Machine. That's not what this article is about. However, what I discovered was that Time Machine was failing to mount the sparse bundle in which the backup is stored. After poking at this for a couple of minutes I decided to simply reformat the Time Machine partition and be done with it.

After doing