Forensics: Is it possible to recover data after wiping tapes?

Is it possible to recover data after wiping tapes? Absolutely not, and possibly yes.

The answer very much depends on what the term “wiping” means in the question. If a tape is used to store data, then reformatted and the a new set of data overwritten, the previous data cannot be recovered, it has been effectively wiped.

If a tape is wiped using degaussing technology then once again the data has been lost/wiped, and cannot be recovered. 

If a tape has been reformat ed, but not overwritten, it is possible though far from guaranteed that it can data can be recovered. The reason for this is that formatting the tape, much like a hard drive, just changes the data at the beginning, of media. But the actual data is still on the tape. However, unlike hard drives, tape software puts an End of File marker at when it has finished writting data to a media which the tape drive reads and does go past, unless its overwritten. This means that when the tape is re-formatted a new End of File marker is placed at the beginning of the tape, this means that the tape drive will not read past this, so recovery of the old data is not possible, with a regular tape drive, even though the data is still on the tape.

There are solutions to this, but they are only undertaken by specialist tape recovery companies, and very much depend on the tape and tape drive in use.

This offers an excellent opportunity for forensic investigators to recover data that may have been lost.

Tapes: LTO

Below is a table showing release dates and generic information about the LTO tape format:

Generation LTO-1 LTO-2 LTO-3 LTO-4 LTO-5 LTO-6
Release Date 2000 2003 2005 2007 TBA TBA
Native Data Capacity 100 GB 200 GB 400 GB 800 GB 1.6 TB 3.2 TB
Max Speed (MB/s) 15 40 80 120 180 270
WORM Capable? NO NO YES YES PLANNED PLANNED
Tape Thickness 8.9 μm 8.9 μm 8 μm 6.6 μm
Tape Length 609 m 609 m 680 m 820 m
Tape Tracks 384 512 704 896
Write Elements 8 8 16 16
Wraps per Band 12 16 11 14
Linear Density (bits/mm) 4880 7398 9638 13300?
Encoding RLL 1,7 PRML PRML PRML
Posted in Tapes. Tags: . Leave a Comment »

LTO Technical Details

LTO (Linear Tape-Open) is a tape standard developed by HP, IBM, and Seagate as a competitor to DLT.

A standard LTO tape stores data in 384 data tracks, which are in turn divided into 4 data bands of 96 tracks each. The data bands are filled one-at-a-time, in a linear fashion.

LTO tapes contain 4KB of non-volatile memory; this storage space contains data about the tape and can be read without the time required to read the magnetic tape itself.

Tapes: DLT

DLT  – stands for Digil Linear Tape. Its a format of back up tapes that was invented by DEC, though later taken over by Quantum. The DLT format has now been superceed by the S-DLT – or Super DLT.

Below is a Table of tape sizes – from Wiki

Name Formats (GB) Color Supported by (ro=read only)
CompacTape I 0.1 Gray TK50/70
CompacTape II 0.3 Gray TK70
DLTtape III 2.6, 6, 10 Light brown DLT260/600, DLT2000/2000XT/4000/7000
DLTtape IIIXT 15 White DLT2000XT/4000/7000/8000
DLTtape IV 20, 35, 40 Dark brown DLT4000/7000/8000, SDLT220/320 (ro)
Cleaning Tape III 20 cleans Beige DLT2000/2000XT/4000/7000/8000
SDLTtape I 110, 160 Dark green SDLT220/320, SDLT600 (ro), DLT-S4 (ro)
SDLTtape II 300 Dark blue SDLT600, DLT-S4 (ro)
DLTtape S4 800 Dark purple DLT-S4
SDLT Cleaning Tape 20 cleans Light gray SDLT220/320/600, DLT-S4
DLTtape VS1 80, 160 Ivory/Black VS160, DLT-V4, SDLT600 (ro)
DLT VS Cleaning Tape 20 cleans Brown DLT1, DLT-VS80
DLT VS160 Cleaning Tape 20 cleans Light gray DLT-VS160, DLT-V4
Posted in Tapes. Tags: , . Leave a Comment »

Tapes: LTO

LTO stands for Linear Tape Open. Its a tape format that designed by Seagate, HP, and IBM

LTO tapes are a popular tape format, not least because they can store a huge amount of data. Currently LTO 4 tapes (the largest available) can store up to 1.6 terra bytes. Currently there are four different LTO tapes, though LTO 5 and LTO 6 are on the drawing board.

LTO-1

  • Size: 100 GB (native) 200 GB (compressed)
  • Media Colour: Black, except HP which produces a blue tape
  • Release Date: September 2000.
  • Speed: 20 Mb/s

LTO-2

  • Size: 200 GB (native) 400 GB (compressed)
  • Media Colour: Purple, except HP which produce a dark red tape
  • Release Date: February 2003.
  • Speed: 40 Mb/s

LTO-3

  • Size: 400 GB (native) 800 GB (compressed)
  • Media Colour: Slate-Blue or Blue-Gray, except HP which produce a yellow one.
  • Release Date: November 2004
  • Max Speed:80 MB/s

Note: Introduced WORM feature.

LTO-4

  • Size: 800 GB (native) 1600 GB (compressed)
  • Colour: Green/Teal or Blue-Green
  • Release Date: May 2007
  • Max Speed:120 MB/s.

Note: Now has a feature of 256-bit AES-GCM drive level encryption.

Posted in Tapes. Tags: , . 2 Comments »
Follow

Get every new post delivered to your Inbox.

Join 31 other followers