ABSTRACT

The aim of this seminar paper is to examine data recovery and its security measures in computer

systems. It is aimed at threating recovery data loss in hand device, hard drive failure, data

corruption or accidental deleting of files.

Unfortunately, despite of constantly growing reliability of storage devices, loss of digital

information remains a common phenomenon. General causes of data loss include hardware or

software failures, power cuts, software malfunctions (including computer viruses) or simply

human errors.

Therefore, this paper simply discuss common data loss and how it is recovered in modern computer

system

1
 CHAPTER ONE

INTRODUCTION

1.1 BACKGROUND OF THE STUDY

Data recovery is the process of salvaging and handling the data through the data from

damaged, failed, corrupted, or inaccessible secondary storage media when it cannot be accessed

normally. Often the data are being salvaged from storage media such as internal or external hard

disk drives, solid-state drives (SSD), USB flash drive, storage tapes, CDs, DVDs, RAID, and other

electronics. Recovery may be required due to physical damage to the storage device or logical

damage to the file system that prevents it from being mounted by the host operating system (OS).

The most common data recovery scenario involves an operating system failure, accidental

damage etc. (typically on a single-disk, single-partition, single-OS system), in which case the goal

is simply to copy all wanted files to another disk. This can be easily accomplished using a Live

CD, many of which provide a means to mount the system drive and backup disks or removable

media, and to move the files from the system disk to the backup media with a file manager or

optical disc authoring software. Such cases can often be mitigated by disk partitioning and

consistently storing valuable data files (or copies of them) on a different partition from the

replaceable OS system files. (Charles et al, 2006)

Another scenario involves a disk-level failure, such as a compromised file system or disk

partition, or a hard disk failure. In any of these cases, the data cannot be easily read. Depending on

the situation, solutions involve repairing the file system, partition table or master boot record, or

hard disk recovery techniques ranging from software-based recovery of corrupted data, hardware-

software based recovery of damaged service areas (also known as the hard drive's "firmware"), to

hardware replacement on a physically damaged disk. If hard disk recovery is necessary, the disk

2
itself has typically failed permanently, and the focus is rather on a one-time recovery, salvaging

whatever data can be read.

In some case, files have been "deleted" from a storage medium. Typically, the contents of

deleted files are not removed immediately from the drive; instead, references to them in the

directory structure are removed, and the space they occupy is made available for later overwriting.

In the meantime, the original file contents remain, often in a number of disconnected fragments,

and may be recoverable.

The term "data recovery" is also used in the context of forensic applications or espionage,

where data which have been encrypted or hidden, rather than damaged, are recovered.

1.2 AIM AND OBJECTIVES OF THE STUDY

The data loss or impairment has become very common due to the internal (software or

hardware faults) or external (operator fault and environmental faults) faults. This often poses the

grave problem of losing all those outcomes of many hardships endured to achieve the specific task.

Data which cost years of hardships may be lost in a flash due to a single mistake!

The aim of this work is to reveal the importance of Data Recovery and the objectives are as follow;

i. To explain data recovery

ii. To explain how data recovery can be carried out

iii. To recommend measure that will prevent data loss

3
1.3 Significance of the Study

Data Recovery has become essential activity for the people in the computer world. The

valuable data can get corrupt or lost at any point of time or the partitions might become

inaccessible. In these situation(s) data recovery procedure will be helpful.

The importance of data recovery can be measured by the number of organizations opting for data

recovery services from the data recovery service providers.

1.4 Definition of terms

Shin (2006) defined the following terms

a) Data:- Data is distinct pieces of information, usually formatted in a special way.

b) Data recovery:-Data recovery is the process of salvaging and handling the data through

the data from damaged, failed, corrupted, or inaccessible secondary storage media when it

cannot be accessed normally.

c) Data loss:- Data loss is an error condition in information systems in which information is

destroyed by failures or neglect in storage, transmission, or processing. Information

systems implement backup and disaster recovery equipment and processes to prevent data

loss or restore lost data.

4
 CHAPTER TWO

LITERATURE REVIEW

2.1 A LITERATURE ON THE CAUSES OF DATA LOSS

The causes of data loss is categorize into two name (Shin, 2006)

1. Physical damage;

2. Logical damage.

1. Physical damage

A wide variety of failures can cause physical damage to storage media. CD-ROMs can have their

metallic substrate or dye layer scratched off; hard disks can suffer any of several mechanical

failures, such as head crashes and failed motors; tapes can simply break. Physical damage always

causes at least some data loss, and in many cases the logical structures of the file system are

damaged as well. Any logical damage must be dealt with before files can be salvaged from the

failed media.

Most physical damage cannot be repaired by end users. For example, opening a hard disk drive in

a normal environment can allow airborne dust to settle on the platter and become caught between

the platter and the read/write head, causing new head crashes that further damage the platter and

thus compromise the recovery process. Furthermore, end users generally do not have the hardware

or technical expertise required to make these repairs. Consequently, data recovery companies are

often employed to salvage important data with the more reputable ones using class 100 dust- &

static-free cleanrooms.

5
2. Logical damage

The term "logical damage" refers to situations in which the error is not a problem in the hardware

and requires software-level solutions.

A. Corrupt partitions and file systems, media errors

In some cases, data on a hard drive can be unreadable due to damage to the partition table

or file system, or to (intermittent) media errors. In the majority of these cases, at least a portion of

the original data can be recovered by repairing the damaged partition table or file system using

specialized data recovery software such as Test disk; software like dd rescue can image media

despite intermittent errors, and image raw data when there is partition table or file system damage.

This type of data recovery can be performed by people without expertise in drive hardware, as it

requires no special physical equipment or access to platters. Sometimes data can be recovered

using relatively simple methods and tools; more serious cases can require expert intervention,

particularly if parts of files are irrecoverable. Data carving is the recovery of parts of damaged files

using knowledge of their structure.(feenberg, 2010)

B. Overwritten data

When data have been physically overwritten on a hard disk drive it is generally assumed that the

previous data are no longer possible to recover. In 1996, Peter Gutmann, a computer scientist,

presented a paper that suggested overwritten data could be recovered through the use of magnetic

force microscope. In 2001, he presented another paper on a similar topic. Substantial criticism has

followed, primarily dealing with the lack of any concrete examples of significant amounts of

overwritten data being recovered. Although Gutmann's theory may be correct, there is no practical

evidence that overwritten data can be recovered, while research has shown to support that

6
overwritten data cannot be recovered. To guard against this type of data recovery, Gutmann and

Colin Plumb designed a method of irreversibly scrubbing data, known as the Gutmann method and

used by several disk-scrubbing software packages.( Gutmann, 2011)

Solid-state drives (SSD) overwrite data differently from hard disk drives (HDD) which

makes at least some of their data easier to recover. Most SSDs use flash memory to store data in

pages and blocks, referenced by logical block addresses (LBA) which are managed by the flash

translation layer (FTL). When the FTL modifies a sector it writes the new data to another location

and updates the map so the new data appear at the target LBA. This leaves the pre-modification

data in place, with possibly many generations, and recoverable by data recovery software.

C. Accidental deletion of a file or folder

Depending on the file system, each OS acts differently to delete a file. For Windows FAT

file system the OS marks file directory entries as unused and destroys file allocation information

(except beginning of file), for NTFS – just marks file entry as unused, deletes record from directory

and marks disk space as unused; for most Linux/Unix file systems it destroys file descriptor

(information about file location, file type, file size etc.) and sets disk as free.

The main purpose of each file deletion is to release storage space used by the file for a new file.

Storage space is not wiped immediately (for performance reasons) making actual file data remain

on a disk until this storage space is reused to store a new file. (feenberg, 2010)

7
 D. File system format

File system format can be started by mistake, for example, by specifying a wrong disk

partition or unclear actions as to storage handling (e.g. NAS devices usually format internal storage

after attempt to re-configure RAID).

Format procedure creates empty file system structures on the storage and overwrites any

information below. If file system types coincide, it destroys existing file system structures by

overwriting them with the new ones; if file system types differ – the structures are written to

different locations and may destroy user data. (feenberg, 2010)

E. Logical damage of a file system

This kind of failure may occur due to power loss or hardware failures. Sometimes logical damages

are also caused by software failures. Modern file systems have a high level of protection against

file system logical damages, nevertheless, useless against hardware or software malfunctions.

Even small piece of wrong data written to a wrong location on the storage may destroy file system

structures, break file system object links and make file system non-readable. ( Gutmann, 2011)

F. Loss of information about partition

This kind of failure may occur due to different reasons, including failed 'fdisk' operation or user

errors that usually results in loss of information about partition ( Gutmann, 2011)

8
2.2 A REVIEW OF THE TOP 23 DATA RECOVERY SOFTWARE

These 23 free data recovery tools run the gamut. There’s bound to be a tool in this list that

can bring a dead data back too. As long as the drive is not physically dead, there is a chance.

(Jesmond, 2014)

1. Recuva data recovery software

With both free and pay editions, Recuva is an incredibly powerful tool for recovering data from

Linux and Window partitions. With support for all Windows versions from XP through Windows

8.1, this is a great tool to bring dead data back to life. It is one tool that has saved me multiple

times over the years. (Jesmond, 2014)

Recuva – Features

 Undelete files on your computer: Deleted a file by mistake? Recuva brings lost files on

your computer, USB drive, camera or iPod.

 Recovery from damaged or formatted disks: Even if you've formatted a drive so that it

looks blank, Recuva can still find your files on it.

 Recover deleted emails: Emptied your email trash and need it back? Recuva's got you

covered with full support for Microsoft Outlook Express, Mozilla Thunderbird, or

Windows Live Mail.

 Recover deleted iPod music: Deleted music from your iPod or MP3 player? No problem,

Recuva will get this back for you along with any additional track data.

 Restore unsaved Word documents: Did Microsoft Word crash or did you forget to save that

important Word document. No problem with Recuva! As it can intelligently rebuild Word

documents from their temporary files.

9
  Quick-Start Wizard: If you need your files back right away without fiddling with options,

Recuva's Quick-Start Wizard is the answer.

 Deep Scan: Recuva can find most files within a minute. Or, set the Deep Scan to look for

more deeply-buried results.

 Securely delete files you want to erase forever: Recuva also allows you to permanently

erase any traces of deleted files.

 Portable version: Take Recuva with you wherever you go with the portable version.

 Full Windows OS support and many languages: Recuva has support for every modern

version of Windows and 37+ languages.

2. Pandora Recovery

With a free version for recovering data from secondary drives, and a pay version you can put on a

USB key to recover an operating system drive, Pandora Recovery has a versatile offering that can

bring back most data without issue. (Jesmond, 2014)

3. PC INSPECTOR File Recovery

Completely free, PC INSPECTOR File Recovery is a great recovery tool for Windows systems. It

can recognize data types even when the header is missing, so you can recover from deletions,

formatting, or even total volume loss.

4. PC INSPECTOR Smart Recovery

Also free, Smart Recovery is a tool focused on recovery files from external media, like flash drives

and SD cards. It’s a bit older than File Recovery, but still works great and can handle proprietary

file formats.

10
5. FreeUndelete

The name of this tool from OfficeRecovery says it all. It’s free for personal use, and it undeletes

files that you have deleted, even if you SHIFT-DEL or empty the Recycle Bin. What it lacks in

fancy features it more than makes up for in efficiency and simplicity. (Jesmond, 2014)

6. ADRC Data Recovery Software Tools

This suite of tools includes undelete, copy, raw copy, imaging, and boot sector repair. NTFS.com

Data Recovery Software Tools include several standalone products that can handle almost any

data recovery scenario. In addition to the free versions, there are pay versions with even more

features. You can download a free trial of a bootable ISO with all of the tools on one image from

http://www.boot-disk.com. Make sure you look closely at each tool’s free version, as they include

a lot when you get into the details. (Jesmond, 2014)

7. Active File Recovery

This is probably the first tool to try, as it can handle undeletes, deletes that bypass the Recycle Bin,

formatted or corrupted files, lost partitions, and more.

8. Active Partition Recovery

This tool can help you to recover a formatted or repartitioned drive in its entirety. It can also fix

lost MBR and GPTs and can read from VMware virtual disk images.

11
9. Active UNDELETE

This tool can run on Windows and recover data from non-Windows file systems including Linux

Ext#, UFS, EFS, and HFS+.

10. NTFS Data Recovery Toolkit

NTFS Data Recovery Toolkit is a set of tools for analyzing problems with NTFS partitions and

files, and Data Recovery in Manual and Automated modes.

Built specifically for NTFS volumes, this toolkit includes a disk editor, partition manager, and

recovery tools. It also has great instructions on how to use each tool.

Manual mode allows you to analyze disk's structures and define the problem using included

freeware Disk Editor. You can fix the problem using either Disk Editor, or included freeware

Partition Manager, or Microsoft Windows(c) system utilities.

Automated mode simplifies your work by avoiding low-level disk surface analysis, and lets you

concentrate on a recovery of specific data using included File Recovery and Partition Recovery

software tools. (Jesmond, 2014)

Recovery Toolkit includes:

 How to recover NTFS — step by step guide for problem discovery and fixing in manual
and automated modes. Examples provided.
 Disk Editor — freeware software for viewing, inspecting and editing content of raw disk
sectors on USB and HDD disks, Floppy and CD/DVD/Blu-ray media.
 Partition Manager — freeware software that helps you create, delete, format, change
properties and name partitions on your computer
 Partition Recovery — software tool for scanning disks and detecting deleted or severely
damaged volumes, and for recovering deleted or damaged NTFS partitions
 File Recovery — software utility for scanning disks and detecting deleted or damaged
volumes and files, and for recovering deleted or otherwise lost files on NTFS.

12
11. Unformat

For all your external drive needs, Unformat can recover entire disks including external USB,

thumb drives, and SD cards that you’ve accidentally deleted.

12. Active UNERASER

This tool can be used to recover data lost due to damaged, formatted, or deleted partitions and

includes several other tools including a partition manager, a disk monitor, and more.

13. Active Boot Disk Lite

Sometimes the data is not lost; it is just inaccessible because the operating system won’t boot. This

tool is a bootable operating system image that can be used to gain access to the hard disk when the

installed operating system won’t boot, so you can copy off data to external media before

reinstalling. (Jesmond, 2014)

14. WinHex

A multitasker that includes a disk editor, imaging software, encryption and checksumming, format

converter, and more. It is more targeted towards investigation and forensics than simple data

recover, and has several different levels of licensing, depending upon required features. It has an

evaluation version that is free to try for as long as you need.

15. TestDisk

Software designed to recover lost partitions or repair drives that are no longer bootable. It can

repair most file systems (NTFS, FAT, EXT) and also recover data from deleted partitions.

13
OpenSource, it can run under most versions of Windows, Linux, BSD, and Mac operating systems.

It also can be deployed as a bootable image to recover from unbootable systems.

16. Wise Data Recovery

A freeware application to recover data from hard drives and removable media. It is simple to use

and fast to find data, making it an excellent choice when you need your files back quickly.

17. Data Recovery Wizard

This tool can recover data that has been deleted, formatted, or from drives that have been corrupted.

The free version has a 2GB cap, but often the data you are trying to save is much smaller than that,

so most users can do a lot with a 2GB trial. It has both Windows and Mac versions.

18. EaseUS MobiSaver Free

This tool offers hope for mobile devices too, with a free data recovery tool for both iOS and

Android platforms. This app can recover specific data types from iOS devices and most files from

Android devices.

19. SoftPerfect File Recovery

Also from EaseUS, this tool can restore deleted files from FAT and NTFS partitions on fixed and

removable media. It is a self-contained executable and runs on everything from XP through

Windows 8.

14
20. Puran Data Recovery

This tool can read files from damaged physical media, like corrupted flash or scratched optical

drives. If your operating system can show the files, then this tool will read them off, ignoring any

bad sectors to recover as much usable data as possible. (Jesmond, 2014)

21. Puran File Recovery

Another tool that goes after deleted files and brings them back from the dead. There is a portable

version that can be put on a flashdrive or bootable disk like BartPE, and it supports both FAT and

NTFS partitions.

22. CD Recovery Toolbox

Designed to recover data from damaged CDs and DVDs. If they are scratched or smudged or faded,

but there is still some readable data on the disk, this is a tool that can bring back as much

salvageable data as possible.

23. UndeleteMyFiles Pro

It may sound like a pay-for edition, but it is absolutely free and comes with a collection of tools

for data recovery, including File Rescue, Media Recover, Deleted File Search, Emergency Disk

Image, and Mail Rescue. It also has a secure file wipe utility, showing it plays both sides. (Jesmond,

2014)

15
 CHAPTER THREE

ANALYSIS OF DATA RECOVERY AND OPERATION

3.1 OPERATION OF DATA RECOVERY

3.1.1 How does recovery work?

Fortunately, the information that still remains on the storage can be recovered to a safe

location. Recovery chances depend much on the data loss situation itself, but you should take into

account that no information is recoverable after overwriting. For this reason you should never write

anything to the storage until the last file is recovered.

Data recovery software serve to get data back after information loss with maximum possible result.

Commonly, data recovery operation bases on storage scan to find specific information (deleted

files, lost file systems) and assemble structures of a damaged file system.

3.1.2 Data recovery chances

Data recovery chances depend much on the actual cause of data loss and further user's

actions. To get maximum data recovery result it's strongly recommended to stop any write access

to the storage and run data recovery software immediately.

Any deleted file remains on the storage until the storage space is re-used by other data. After file

deletion OS may re-use disk space anytime to store a new file. Thus, even minor write to the

storage may cause permanent data loss. Internet browser may result in overwriting of deleted files

as well by saving cache or cookies to the storage. If you install the software to the same drive, your

data are also under the risk of overwriting.

Another factor that influences data recovery chances after file deletion is file deletion

algorithm dependent on the file system. For Windows NTFS file system recovery chances are quite

16
high, because if file descriptor remains on the disk, the software may easily take all required

information about the file. Unlike NTFS, BSD UFS file system destroys information about file

start, location and size permanently and together with high degree of file fragmentation typical of

this file system leaves very slim chances for successful data recover.

Figure 3.1 Structure of the hard disk

Source: www.datarecovery.net

Other file systems (like FAT) feature average chances for data recovery. Here only part of

information is destroyed (like information about file fragments), but information about file name,

start and size still remains on disk. Heuristic algorithms still allow to 'guess' file fragments and

recover good files. Please keep in mind, that due to lack of real information about allocation of file

fragments any data recovery software may fail to detect real file position, especially if several

fragmented files were deleted close to the same location on the storage.

The scope of these factors make any file recovery software use a set of deterministic and

heuristic algorithms to guess deleted file location. Please consider that these algorithms differ from

vendor to vendor making recovery results differ as well.

17
3.1.2 Recovery after file system format

After file system format a part of information on the storage is destroyed due to overwriting

with new information of a new file system. Again, data recovery chances after format depend much

on the original and new file systems.

For instance, if a file system was formatted with FAT, it overwrites huge amount of storage

space at disk start with zeros (empty block allocation tables) and therefore destroys any previous

data. Even if previous file system was also FAT, the information about allocation of previous files

will be lost completely. Other file systems usually allocate more or fewer structures to different

storage locations.

Recovery chances are much dependent on original and new file systems. Sometimes

recovery chances are higher if the file system is formatted with the same file system type (e.g.

NTFS), sometimes - not (e.g. FAT over FAT has worse recovery chances than XFS over FAT).

Efficient data recovery software usually produce quite good recovery result after file system

format. Most file systems (except those like FAT) may still keep file allocation information,

directory records, file names etc. that allows to successfully reconstruct the file system. However,

since new structures are written to the disk, some user information can be damaged and some files

or folders can be lost.

3.1.3 Recovery after file system damage

To this type of data loss data recovery software usually apply the same methods as for a

formatted file system. Data recovery chances depend much on the actual file system damage that

can be a damage of user files, file folders, file location, file name or all at once. Anyway, efficient

data recovery software will help you achieve the highest possible data recovery results.

18
3.1.4 Loss of information about partition

This type of data loss cause is probably the most unsubstantial. Working with this type of

damage data recovery software identifies file system start by known file system structures scanning

the storage. If the loss didn't affect the file system itself, the data can be retrieved in its original

form in the full scope.

3.1.5 Hardware failure/ Recovery techniques

Recovering data from physically damaged hardware can involve multiple techniques.

Some damage can be repaired by replacing parts in the hard disk. This alone may make the disk

usable, but there may still be logical damage. A specialized disk-imaging procedure is used to

recover every readable bit from the surface. Once this image is acquired and saved on a reliable

medium, the image can be safely analyzed for logical damage and will possibly allow much of the

original file system to be reconstructed.

Media that has suffered a catastrophic electronic failure requires data recovery in order to

salvage its contents. A common misconception is that a damaged printed circuit board (PCB) may

be replaced during recovery procedures by an identical PCB from a healthy drive. While this may

work in rare circumstances on hard drives manufactured before 2003, it will not work on newer

hard drives. Each hard drive has what is called a System Area. This portion of the drive, which is

not accessible to the end user, contains adaptive data that helps the drive operate within normal

parameters. One function of the System Area is to log defective sectors within the drive; essentially

telling the hard drive where it can and cannot write data. The sector lists are also stored on various

chips attached to the PCB, and they are unique to each hard drive. If the data on the PCB do not

match what is stored on the platter, then the drive will not calibrate properly. In most cases the

19
hard drive heads will click, because they are unable to find the data matching what is stored on the

PCB.

3.1.6 Recovery of wiped/overwritten data

It is simply impossible. The myth about the possibility to recover lost files after overwriting

is inherent from successful attempts to recover data from old diskettes and hard disks. These

devices (with storage capacity from kilobytes to megabytes) used very wide magnetic trace and

simple digital encoding to store the information. For this reason it was possible to read 'traces of

data' after wiping or overwriting by calibrating read 'head' sensitivity and position.

Modern systems use very thin tracks, high precision of head calibration and extremely high signal

frequency near to the top of technology limit. Performance of modern chips only allows to pick

good discrete signal from disk platter and never identifies any 'signal traces'. This scheme is

impossible for any digital device (discreet signal frequency to handle such data lays much beyond

the theoretical limit of electronic circuits).

3.2 Future advances

The data recovery industry is looking forward to attain a good number of goals in the near future.

• Highly drive independent part replacement methods, which contains provision for easy tuning in

case of the hyper tuned parameters; researches are on the way in this area and as far as now a good

extend of drive independence have been attained.

• Improvements in algorithms that can predict the data in highly unrecoverable sectors and thus

overcoming the failure to recover data due to ignorable bad sectors.

20
• Improvement in algorithm that can extract data which is over written more number of times,

Although the present algorithms can extract data to a great extend, improvement in the algorithm

can use the result of the MFM and STM more efficiently.

3.3 Challenges in data recovery

a) Attempts made to recovery data from physical damage of storage devices such as hard disk,

flash drive, memory, CDs and DVDs may be in futility.

21
 CHAPTER FOUR

SUMMARY CONCLUSION AND RECOMMENDATIONS

4.1 SUMMARY

The recovery data from the logically and/or physically damaged disk drives, and the recovery of

over written data is now been done with a good amount of success. The data recovery now have

become a handy tool to the end-users as far as the logical damages are concerned, although the

recovery of data from a physically damaged drives and over written data, which is done by the

magnetic data recovery methods have still to reach at the end users, the data recovery industry has

grown through heights of technology, that nowadays the situation is such that, data can be

recovered from any physically damaged drive until it’s magnetic platters remain as such.

And in case of the magnetic recovery also the present state-of-the-art has contributed a lot to the

data recover industry that the magnetic recovery had reported recover of data that had been over

written up to 17 times. i.e. Through part replacement the recovery of data from physically damaged

drives has become easy. And with the use of magnetic force microscopy and Signal tunneling

microscopy the magnetic recovery of over written data also have become possible to great extent.

4.2 CONCLUSION

It can be concluded that data recovery software are boon for such individuals and companies who

lose their data due to accidental deletions, virus attacks, unexpected system shutdowns, hard drive

failures, system crashes and other undefined reasons. The data recovery software is definitely

useful in the hour of need and data recovery services prove themselves when the software is unable

to get back data. You can also give a try to data recovery services when there is a severe damage

caused to your device.

22
4.3 RECOMMENDATIONS

1. Regular backup of data in a separate and safe place

2. Seek the services of an Engineer or Technician in the case of physical damage

3. Do not install data recovery software on the same drive from which you are trying to

recover data. Installed software might actually overwrite the data you’re trying to recover.

4. The first recovery attempt is the best opportunity for success, and the recovery method you

choose can greatly impact the outcome.

23
 REFERENCE

Bennison, P. F, and Lasher, P. J. (2004) ”Data security issues relating to end of life equipment”,

Electronics and the Environment Conference, 2004 IEEE International Symposium on

May 10-13, 2004

Charles H. S. and Glenn S. (2006) ”Drive-Independent Data Recovery: The Current State-of-the-

Art”, IEEE transactions on Magnetics, IEEE volume 42. www.datarecovery.com.

Retrieved 02/12/2014

Cranor, L. F. and Geiger, M. (2006) ”Counter-Forensic Privacy Tools: A Forensic Evaluation”

McGraw Hill Books, New York

Feenberg, D. (2004) "Can Intelligence Agencies Read Overwritten Data? A response to

Gutmann.". National Bureau of Economic Research. www.agencydata.com Retrieved

02/12/2014

Garfinken, S.L. and Shelat, (2003) ”Remembrance of Data passed: a study of disk sanitization”,

Security and privacy, IEEE International Symposium on February 2003.

Jesmond D. (2014) "A review of data recovery softwares. www.datarecovery2014.com Retrieved

04/12/2014.

Joshua J. S. (2006) East Carolina University, ”Magnetic Data Recovery The Hid- den Threat”,

infosecwriters, December 2006

Peter G. (2013) “Secure Deletion of Data from Magnetic and Solid-State Memory”, McGraw Hill

Books, New York

Shin J. (2006) Data Remanence in Semiconductor Devices, Peter Gutmann, IBM T.J. Watson

Research Center. www.imagedevice.com. Retrieved 04/12/2014

Zeno, K. (2011) "How Does Data Recovery Work?". DP publications Indian.

24