Forensics: Is it possible to recover data after wiping tapes?

Is it possible to recover data after wiping tapes? Absolutely not, and possibly yes.

The answer very much depends on what the term “wiping” means in the question. If a tape is used to store data, then reformatted and the a new set of data overwritten, the previous data cannot be recovered, it has been effectively wiped.

If a tape is wiped using degaussing technology then once again the data has been lost/wiped, and cannot be recovered. 

If a tape has been reformat ed, but not overwritten, it is possible though far from guaranteed that it can data can be recovered. The reason for this is that formatting the tape, much like a hard drive, just changes the data at the beginning, of media. But the actual data is still on the tape. However, unlike hard drives, tape software puts an End of File marker at when it has finished writting data to a media which the tape drive reads and does go past, unless its overwritten. This means that when the tape is re-formatted a new End of File marker is placed at the beginning of the tape, this means that the tape drive will not read past this, so recovery of the old data is not possible, with a regular tape drive, even though the data is still on the tape.

There are solutions to this, but they are only undertaken by specialist tape recovery companies, and very much depend on the tape and tape drive in use.

This offers an excellent opportunity for forensic investigators to recover data that may have been lost.

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: