CAN OVERWRITTEN DATA BE RECOVERED?
During the past few years I have been questioned on numerous occasions (by technicians from Revenue Canada, the R.C.M.P., the Department of National Defense and several Universities) about the availability of technologies to read trace magnetic signals that have been overwritten. It is commonly quoted that data can be recovered if it has been only overwritten once or twice and that it actually takes up to ten overwrites to securely protect previous data.
If a head positioning system is not exact enough, new data written to a drive may indeed not be written back to the precise location of the original data. Due to this track misalignment, it is possible to identify traces of data from earlier magnetic patterns alongside the current track. (At least that was the case with high capacity floppy diskette drives, which have a rudimentary position mechanism. Due to the embedded positioning systems and extreme high densities of new drive technologies, it has yet to be proven if the same can be said for the latest high speed, high capacity disk drives.)
It has been suggested that an electron microscope could be used to read and interpret any patterns that were not fully overwritten by the process. Theoretically this can be done - but in practice it is little more than a myth.
Electron microscopes have been used to detect and identify magnetic regions smaller than the fluxes used to represent data on a 200 megabyte disk drive. Unfortunately, at best, this type of process could be accomplished at a rate of perhaps 1 bit per second. Furthermore, since virtually every drive in production today records two or more magnetic fluxes (due to R.L.L. recording) to represent each bit the actual rate could be considerably slower.
The number of bits in a single 512 byte (character) sector is 4096 and there are over 200,000 sectors on a one hundred megabyte hard drive. This represents almost 820 million bits to be read back.
If data could be recovered at the rate of 1 bit per second - this process would take 9,259 days (or over 25 years) to recover 100 MB of information. This is assuming that you could read back and interpret each bit correctly, for example on data that has never been overwritten. If you are trying to read "traces" of data that were previously written there, in the most likely scenario you may be able to correctly recover, interpret and identify 30-40 percent of the signals.
THAT DOES NOT MEAN YOU WOULD RECOVER 30-40% OF THE DATA - BUT ONLY 30-40% OF THE INDIVIDUAL BITS IN EVERY CHARACTER.
A "10101011" pattern may come back as "?010?01?" and every single character on the drive would be scrambled in a similar manner. The mathematical probability of decrypting such a puzzle into usable data is infinitesimal.
It could be claimed that data can be recovered from any drive in the world with a guaranteed success rate of 50% "at the bit level". This sounds interesting until you consider that if you overwrote the entire surface of the drive with either all "0" or all "1" and since the original drive contained nothing but patterns of binary ones and zeros - half the bits would be correct - but obviously no data could be recovered.
In conclusion, overwritten data cannot be read back or recovered by any current disk drive technology or laboratory technique.