Replacing my hard drive

Archived from groups: comp.sys.laptops (More info?)

IS <y@hl.com> wrote:
> I have an IBM T42. It only came with a 40G hard drive which is about full.
> I need to get a new one.

Err .... how about "deleting something"? It works, you know!

> I'm used to having either an operating cd or a restore cd that come with my
> computers but IBM has a partition on the hard drive in case of a system
> restore.

They give you a cd if you ask - within 180 days, I believe. And it's
easy enough to make your own - look it up on the web (I presume you are
talking about MS slp).

> I'm wondering how I can install a new hard drive on my laptop.

Copy your old one to your new one (use a usb housing or some other
computer).

Peter

Archived from groups: comp.sys.laptops (More info?)

IS <y@hl.com> wrote:
> Can't delete anything.

If you want to save it all to a few dvds befre delete, go ahead.

(but in 20+ years of using a computer I have never met the data I didn't
feel good about deleting 90% of! - data is not information).

> That's why I need a larger HD.

How about compression, if simple "delete" does not do it for you!

Peter

Archived from groups: comp.sys.laptops (More info?)

Having worked on many IBM notebooks as an IBM service tech, I recommend
ghosting the old drive to the new drive. I know, it is a lot easier
said than done, seeing that you can only connect one drive at a time,
internally. However, knowing that your old drive is in good working
order, the idea of putting it into an external USB drive cage is a
great idea. You should be able to get a 2.5" USB drive cage for your
notebook drive at a price between $50-$75cdn.

Another suggestion is to pay a local service tech the $100 to do it for
you and be sure that you don't mess it up...otherwise, you may find
that you need my data recovery services. The local tech should have a
few adapters to allow them to connect the 2.5" hard drives to a PC and
quickly do the ghost of your drive.

Best of luck,
Luke Coughey
Vice President
Recovery Force Inc.
866-750-3169
http://www.recoveryforce.com/


Andrew wrote:
> IS <y@hl.com> wrote:
> : Can't delete anything. That's why I need a larger HD.
> : It's not completely full. I'm at about 32G's right now.
> : Thanks for the info. I will try to copy directly on to a new hard
drive.
>
> How about cloning your old hard drive to the new one with a USB
> enclosure? You might have to buy software like Acronis True Image
> (about $35 when I bought it two months ago via NewEgg.com) unless you
> can find a free version that works with NTFS. In theory, you'd clone
> your old drive to the new one, swap drives, and just boot. (Some
> claim a repair install may also be required after the swap, but it
may
> depend on your system configuration).
>
> Andrew
> --
> ----> Portland, Oregon, USA <----
> *******************************************************************
> ----> http://www.bizave.com <---- Photo Albums and Portland Info
> ----> To Email me remove "MYSHOES" from email address
> *******************************************************************

Archived from groups: comp.sys.laptops (More info?)

On Thu, 31 Mar 2005 15:25:35 GMT, Barry Watzman
<WatzmanNOSPAM@neo.rr.com> wrote:

>You could use a program like Drive Image to copy the partitions -- even
>the hidden partitions -- to the drive. Best done on a desktop, where
>the laptop drives are mounted as additional drives. You may still have
>to do a "repair install" to get windows running on the new drive.
>Normally, if things go well, this will retain your installed software,
>data and settings. (and in this case, you would still have the original
>hard drive).

I did this recently using Ghost 9. I backed up the existing hardrive
to DVD+RW. Put in the new bigger hardrive and booted from the Ghost 9
CD. Restored from the DVDs. Didn't take long at all.

Archived from groups: comp.sys.laptops (More info?)

It isn't very likely that you would do an exact clone of the blank
drive to the original, as the original drive is the smaller drive. So,
this would mean that you would be doing a regular ghost of the drive,
thus making the possibility of recovering the data very high. Of
course, the cost to recover the data would be considerably higher than
paying a service company to do the ghost correctly. So, again, I would
suggest finding a good service company to do it, if you are unsure of
what you are doing.

Luke Coughey
Vice President
Recovery Force Inc.
866-750-3169
http://www.recoveryforce.com/

Archived from groups: comp.sys.laptops (More info?)

You haven't answered my question. Suppose that the data was overwritten
once by error, would you still be able to recover it? Suppose that the data
was overwritten ten times by error, would you still be able to recover it?

"rollout" <lcoughey@gmail.com> wrote in message
news:1112286966.829627.293440@g14g2000cwa.googlegroups.com...
> It isn't very likely that you would do an exact clone of the blank
> drive to the original, as the original drive is the smaller drive. So,
> this would mean that you would be doing a regular ghost of the drive,
> thus making the possibility of recovering the data very high. Of
> course, the cost to recover the data would be considerably higher than
> paying a service company to do the ghost correctly. So, again, I would
> suggest finding a good service company to do it, if you are unsure of
> what you are doing.
>
> Luke Coughey
> Vice President
> Recovery Force Inc.
> 866-750-3169
> http://www.recoveryforce.com/
>

Archived from groups: comp.sys.laptops (More info?)

Generally speaking, once the data has been overwritten (truly
overwritten, not just "erased" ) even just once, it's irrecoverable. In
fact, it's possible to recover data that has been overwritten multiple
times (perhaps up to a dozen times), but it requires CIA/FBI/NSA levels
of effort to do so. One overwrite is the end of data for "normal"
purposes with tools, levels of effort and costs available to normal
indivudals and corporations (even if they are willing to spend thousands
of dollars on data recovery).


Asteroid wrote:
> You haven't answered my question. Suppose that the data was overwritten
> once by error, would you still be able to recover it? Suppose that the data
> was overwritten ten times by error, would you still be able to recover it?
>
> "rollout" <lcoughey@gmail.com> wrote in message
> news:1112286966.829627.293440@g14g2000cwa.googlegroups.com...
>
>>It isn't very likely that you would do an exact clone of the blank
>>drive to the original, as the original drive is the smaller drive. So,
>>this would mean that you would be doing a regular ghost of the drive,
>>thus making the possibility of recovering the data very high. Of
>>course, the cost to recover the data would be considerably higher than
>>paying a service company to do the ghost correctly. So, again, I would
>>suggest finding a good service company to do it, if you are unsure of
>>what you are doing.
>>
>>Luke Coughey
>>Vice President
>>Recovery Force Inc.
>>866-750-3169
>>http://www.recoveryforce.com/
>>
>
>
>

Archived from groups: comp.sys.laptops (More info?)

"Barry Watzman" <WatzmanNOSPAM@neo.rr.com> wrote in message
news:424CBE8F.5040808@neo.rr.com...
> Generally speaking, once the data has been overwritten (truly overwritten,
> not just "erased" ) even just once, it's irrecoverable. In fact, it's
> possible to recover data that has been overwritten multiple times (perhaps
> up to a dozen times), but it requires CIA/FBI/NSA levels of effort to do
> so. One overwrite is the end of data for "normal" purposes with tools,
> levels of effort and costs available to normal indivudals and corporations
> (even if they are willing to spend thousands of dollars on data recovery).

What I am wondering about is the case where the data has been
overwritten multiple time with different letters. In a clean room
one can rely on the traces around the letters to infer what letters
had been there before being overwritten, but then, I think, in one
letter one can go back three overwritings and the next five
overwritings and the next two, etc., so how can one be sure that
the sequence of recovered letters belong to the *same* generation
(text) being overwritten? One can recover a jumble of letters
belonging to *different* generations of overwriting and therefore
worthless and meaningless.

Another question is, with the normal recovery software tools
out there (including forensic tools), is it possible to recover data
that has been overwritten more than once, say, three times?

Archived from groups: comp.sys.laptops (More info?)

"Barry Watzman" <WatzmanNOSPAM@neo.rr.com> wrote in message
news:424E0599.9080206@neo.rr.com...
> With normal tools it's not even possible to recover things that have been
> overwritten just once.

Is that so, even with forensic tools out there like Encase?

There are people who install Win XP where W98 was, format
the drive in NTFS, install apps like Office 2003, and of course
Win XP and Office 2003 are much bigger then what they replace,
so the whole previous used space (proggies and data) is probably
overwritten, but nothing was backed up and the normal undelete
utilities find nothing. Is it possible to recover any data?

Archived from groups: comp.sys.laptops (More info?)

"J. Clarke" <jclarke.usenet@snet.net.invalid> wrote in message
news2p7iu01h18@news3.newsguy.com...
>
> It might be for an agency with the resources to go over the platter
> surface
> with the proper instruments but it would be hideously expensive.

Suppose the data had been overwritten multiple times with different
letters. In a clean room, with the custom-written firmware routine
unique to the specific model of drive and the drive being reflashed
with that firmware, one can rely on the traces around the letters
(actually, around the bits) to infer what letters (what bits) had been
there before being overwritten, but then, I think (and I would like to
ask you and anybody else who knows about this whether this is true),
in one letter one can go back three overwritings and the next five
overwritings and the next two, etc., so how can one be sure that the
sequence of recovered letters belong to the *same* generation
(text) being overwritten? One can recover a jumble of letters
belonging to *different* generations of overwriting and therefore
worthless and meaningless. Is this so or am I imagining things?

Archived from groups: comp.sys.laptops (More info?)

Paul Rubin wrote:

> "J. Clarke" <jclarke.usenet@snet.net.invalid> writes:
>> > Suppose the data had been overwritten multiple times with different
>> > letters. In a clean room, with the custom-written firmware routine
>> > unique to the specific model of drive and the drive being reflashed
>> > with that firmware, one can rely on the traces around the letters
>> > (actually, around the bits) to infer what letters (what bits) had been
>> > there before being overwritten,
>>
>> One can rely on this can one? I think you will find that this requires a
>> precision in positioning and sensing that is beyond that of the standard
>> read heads that come on the disk. In other words you're not likely to
>> achieve it with custom firmware.
>
> There's a famous paper by Peter Gutmann that describes some methods
> like magnetic force microscopes:

I'm well aware of this. It's "maybe", not "can rely on" and reflashing
firmware does not turn a read head into a magnetic force microscope.

> http://www.cs.auckland.ac.nz/~pgut [...] e_del.html
>
> There's more stuff like this in Ross Anderson's book "Security
> Engineering".

And how, exactly, is relevant to the efficacy of "custom-written firmware
routine unique to the specific model of drive and the drive being reflashed
with that firmware" in reading such data?

Further, would you _rely_ on the use of magnetic force microscopes and the
like to recover data? I agree that it's a possibility, but I certainly
would not use it as a substitute for a good backup.

> Another way in which data can leak through repeated erasure is if the
> drive automatically remaps what it thinks is a bad sector. That is,
> when you read your file normally, the drive encounters some
> correctable errors on the media, so it copies the data to new sectors
> and updates an internal sector translation table. This is completely
> invisible to the host PC and can't be detected by normal host software
> (sometimes there are drive-specific special commands for use by the
> manufacturer's diagnostic software, that get this info out). Now when
> you overwrite the file, even a million times, you only overwrite the
> data's new location, but the original "bad" (but recoverable) sector
> doesn't get touched.

One might be able to recover some data that way with custom firmware, but
that's also not what the OP seemed to be trying to rely on.

> On the defender's side (defender = the person trying to prevent the
> data from being readable by an attacker), there's another paper by Di
> Crescenzo et al about how to use a little bit of nonvolatile ram to
> make a file system or database completely unrecoverable as long as you
> have a way to erase the ram. It's called "How to forget a secret":
>
> http://www.macfergus.com/pub/forget.html
>
> I came up with a similar idea for an old sci.crypt post sometime later:
>
> http://tinyurl.com/55v9t
>
> The application was a secure email server.

--
--John
to email, dial "usenet" and validate
(was jclarke at eye bee em dot net)

Archived from groups: comp.sys.laptops (More info?)

Paul Rubin wrote:

> "J. Clarke" <jclarke.usenet@snet.net.invalid> writes:
>> Further, would you _rely_ on the use of magnetic force microscopes and
>> the
>> like to recover data? I agree that it's a possibility, but I certainly
>> would not use it as a substitute for a good backup.
>
> Data recovery is never a good substitute for backups. The stuff I
> posted about magnetic force microscopes was just supposed to show what
> extreme efforts can do. Of course it's not reliable, but as a
> security developer I'm more interested in preventing data recovery
> than assisting it. Therefore if there's a recovery method that has
> any chance of working, I have to consider it and take steps against it.

Well that's all very interesting but what does it have to do with the
statement to which it was a response?

As for "preventing data recovery", the only way you can be sure is with
power tools or a suitable application of high explosive.

--
--John
to email, dial "usenet" and validate
(was jclarke at eye bee em dot net)

Archived from groups: comp.sys.laptops (More info?)

"Paul Rubin" <http://phr.cx@NOSPAM.invalid> wrote in message
news:7xhdinpdk4.fsf@ruckus.brouhaha.com...
>
> Data recovery is never a good substitute for backups. The stuff I
> posted about magnetic force microscopes was just supposed to show what
> extreme efforts can do. Of course it's not reliable, but as a
> security developer I'm more interested in preventing data recovery
> than assisting it. Therefore if there's a recovery method that has
> any chance of working, I have to consider it and take steps against it.

Since you're on the side of the defender, which recovery tools
out there (including forensic tools) do you dislike most for
being most effective at recovering data?