Citat:
> What is the trick about hardware way of recovering
> HD data after completely overwriting all sectors?
There are two theories behind it.
1.
Theory:Read/write heads may not always be accurately positioned over a
track. That would suggest that old versions of the track may survive as
a narrow band to either side of the current track.
Practice:Modern drives don't use stepper motors. The heads are
positioned electronically by following a servo 'signal' recorded along
with the data. Alignment is 99.9% accurate.
2.
Theory:Writing over the top of a track doesn't completely erase the old
magnetic signal. A ghost of it will remain. In effect the new track is
not a 100% accurate record of what came off the heads. It retains an
'essence' of what went before.
Practice:The 'essence' is extremely weak. It requires incredibly
sensitive read heads to detect it. After detecting it you need to
perform very intensive signal processing to recover it.
You basically have to read the main signal very, very accurately. Then
calculate what it should be and subtract that. What little is left will
be incomplete and you'll need to perform heuristic analysis to guess at
the signal.
Bombshell:Both methods rely on you having a read head that is a lot,
lot more sensitive than the one built onto the drive. If such a read
head were available the manufacturers would already be using it to
increase data density. Of course eventually such a head will be
available but by then the data needing recovery will probably be
several years old.
It is actually made worse by today's drives. They don't even record an
accurate signal in the first place. They try to of course but by design
the data density means they often fail. They rely on signal processing
to guess at the data. This is normal operation on many drives these
days. Yes, really :)
Conclusion:If data has been overwritten on a modern hard drive then
it's gone. There is no way to get it back. Luckily (or not depending on
the data) most data is simply mislaid or hidden. Undelete processes
work by find the data and either retrieving it or reconstructing the
metadata to reconnect it to the file system.
--
Andrue Cope [TeamB]
[Bicester, Uk]