Skip to content

Let’s discuss the Fallacy that Forensics can recover data from a wiped drive


gutmans recover data

There is a fallacy that Forensics can recover data using an electron microscope – so let’s discuss this.

The Evidence against the fallacy.

gutmanns belief

Floppy Disks – where this belief started

Bit level recovery – on old floppy disks:

gutmanns floppy diskYeah, but, I’ve heard they use an Electron Microscope

gutmanns electron

Yeah, but, I’ve heard they go down various “layers” with an Electron Microscope

gutmanns layers

So the depth of magnetic field does vary, but usually that’s due to temperature.  In a court of law, this would destroy the prosecutions case.  A summers day does alter the magnetism.

gutmanns 80 degrees


Probability Results – were basically like flipping a coin

gutmanns probabilitygutmanns what this means

There is no chance of recovery.

On old drives they could recover a bit – but not “data or files”.  On newer drives, there is no chance of recovery.

gutmanns conclusion

Windows “delete” key does not delete any files

Windows has no “delete” function, which is why the field of Forensics appears to have such mysterious powers.

Forensics exists because Microsoft doesn’t like”secure delete”, or any “delete” if we’re totally frank.  Which with the Internet, is a very dangerous stance for a company to take.  It offers the home user, absolutely no protection or security.

How do I delete files?

  • The EFF recommends that you use 2 different wiping tools.  They recommend Eraser, you may prefer Ccleaner.
  • Mix and match them.
  • There is also a third tool called BCwipe.

Where to download Ccleaner




Evidence – Write patterns used for the experiment

gutmanns experiment write patterns


Leave a Comment

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s

%d bloggers like this: