PPRuNe Forums - View Single Post - Malaysian Airlines MH370 contact lost
View Single Post
Old 25th Mar 2014, 02:43
  #7932 (permalink)  
G0ULI
 
Join Date: Dec 2013
Location: Norfolk
Age: 68
Posts: 1
Likes: 0
Received 0 Likes on 0 Posts
CommanderCYYZ
Digital data can be recovered from large capacity USB sticks and the like because new data is written to 'fresh' areas of memory. When a file is deleted, only the file name is deleted and the memory locations used flagged as available to be re used once all the other free space is used up. Essentially the same technique has been used in floppy disks and magnetic hard drives. So data can be deleted but it is not overwritten until there is nowhere else to put new information that needs to be recorded. Quick formatting a flash drive, doesn't delete the data on the drive, it just resets it so that all memory positions are shown as being available to be overwritten. A full low level format of a flash drive will irrevokably delete all data.

With smaller sized memory devices that are constantly being overwritten with new data, it is not possible to recover anything more than a few memory blocks of data that has been deleted to make way for overwritting new data.

So with multi-gigabyte and terabyte drives used in typical laptop and desktop computers, there is a very good chance of retrieving huge quantities of deleted data using forensic software. This is because the capcity of the drives means that the deleted data is never overwritten because the drive never fills right up. The memory chips used in the flight data recorder are too limited in capacity for any useful additional data to be recovered apart from the latest recording.

Old style floppy disks which were swapped between computers had relatively wide tracks of data and poor tolerances with regard to the accurate positioning of the read write heads. It was possible to recover previously written files in some circumstances, even though they had been overwritten by new data. Modern hard disks operate to such fine tolerances, that once data is overwritten, there is virtually no chance of successfully recovering the original data. A magnetic hard drive that has been reformatted may retain a faint magnetic trace of data that was written to the drive provided that it has not been overwritten by new data.

The labouriousness and costs associated with forensic data recovery cannot be overstated. It takes ages, costs an absolute fortune and frequently all you end up with is fragments of files that are unsuitable for evidential purposes, but can assist a stalled investigation. I once spent six weeks recovering the contents of eight floppy disks. I would hate to have to try to rebuild more modern memory devices.
G0ULI is offline