On Tue, Oct 12, 2010 at 3:57 PM, John Mahoney <jmahoney@xxxxxxxx> wrote: >> >> >> dd if=/dev/zero of=/dev/sdx1 bs=128KB >> > > I just wanted to make a note here that is probably obvious to 99% of people > here. If you do this test on a partition you are using as a filesystem then > it will destroy that filesystem. > I was just about to blindly copy and paste this command and it came to my > had that this may not be obvious to everyone. > -- > John That is the danger of this list. I just assumed the reader would know the above was dangerous. I guess now the time to tell everyone about my just conceived flash drive data recovery service! Not really, but one thing you may realize from the above is that with these low-end flash drives the unallocated EBs do still have the old data in them, so it is possible to recover data one EB at a time from the unallocated EBs if you have the right hardware. note: I don't have the hardware, but I know of at least one drive recovery company that will disassemble a thumb drive, de-solder the chips and recover data directly from the flash memory chips. They only charge $800 for a typical recovery as I understand it. I don't know how useful the recovered data is since I don't think you get the physical to logical mapping for the EBs. Greg -- Greg Freemyer Head of EDD Tape Extraction and Processing team Litigation Triage Solutions Specialist http://www.linkedin.com/in/gregfreemyer CNN/TruTV Aired Forensic Imaging Demo - http://insession.blogs.cnn.com/2010/03/23/how-computer-evidence-gets-retrieved/ The Norcross Group The Intersection of Evidence & Technology http://www.norcrossgroup.com -- To unsubscribe from this list: send an email with "unsubscribe kernelnewbies" to ecartis@xxxxxxxxxxxx Please read the FAQ at http://kernelnewbies.org/FAQ
