Hi,

Is it possible to recover data from an HDD without having access to a
readable partition table, FAT and directory table?

Well, the reason I ask this is not because all of these are damaged on
my HDD but there is a software that encrypts all of these and I would
like to know whether this method provides some data security or not.
(Protection against software-based recovery tools would be sufficient
for me, hardware-based data recovery is a whole other thing.)

Regards,
Peter

Previously Peter Frank <peter_frankde@yahoo.de> wrote:
This gives you zero data protection against anyone that wants data
that has a good chance of residing in single clusters, like passwords.
Also media files will leave enough data in one pice to allow
recognition by partial signatures (hashes over pices) and maybe
automated reconstruction. Then there is the problem that in any good
filesystem files will mostly get consecutive clusters. Also files that
fit into one cluster will not need any recovery effort at all.

So all data is there. Some can ge gotten very easily, some might be
harder and some might need some puzzeling together, but if the
contents of a file is recognisable as interesting from cluster-sized
pices (4kB...32kB or so typically) any halfway competent IT person
should be able to find it with reasonable effort.

To sum up: From a security POV this is worthless against an expert
attacker of any level. It might help against people without IT
competence.

Arno

So data itself is not encrypted?!

yes, many software can unlock partition

Peter wrote:
Right, the data itself are not encrypted. This sort of "encryption" is
extremely fast, but - as I was told here - it does not provide good
security at all.

Regards,
Peter - No.2, not to be be confused with you ;-)

Peter wrote:
Right, the data itself is not encrypted. This sort of "encryption" is
extremely fast, but - as I was told here - it does not provide good
security at all.

Regards,
Peter - No.2, not to be be confused with you ;-)

Arno Wagner wrote:

I now tried it out myself with a data recovery tool. All filename and
directory structure information was lost but many files could be
recovered intact from the harddisk. Then, I tried the same thing on a
USB stick (i.e. no partition table, FAT and directory table) and
couldn't recover anything.
Why is that?

Peter

Previously Peter Frank <peter_frankde@yahoo.de> wrote:
Not surprising. Although automated tools are somewhat limited
compared to an expert using his/her skills and imagination.
Good approach though to try to verify what was told you here.

Maybe the stick had far smaller cluster size making recovery more
difficult. Or mey be some flag that tells the filesystem that
writing files to consecutive sectors does not make things faster
on the device and the filesystem just shuffled the clusters more
than on the HDD where writing files to consecuive sectord can gain
you several orders of magitude faster write speed.

But that is just idle speculation. All the data in the files is still
there on the USB stick as well. Addresses, names, passwords, fragments
from media files large enough to recognise them, ...

Arno

If you want to know more about partition problems and their solutions
and programming related issues, you can find the Book Contents ("Data
Recovery with & without Programming") on following link:

http://www.datadoctor.biz/author.htm

regards

Sachin