Hmm. Organic RAM failure evident.<br><br>I vaguely recall it was a 400GB drive and the total recovery fee was going to be around $20k. I also recall the failure was not pebkac style but drive failed (did they get a backup plan? Did they do _ANYTHING_ I told them concerning backups? Do I still talk with those bozo's? All are NO!) and was not mountable by any means. That may be why the cost was closer to $1/MB. The price was based on amount of recovered data not drive size.<br>
<br><div class="gmail_quote">On Fri, Apr 16, 2010 at 2:00 PM, Greg Freemyer <span dir="ltr"><<a href="mailto:greg.freemyer@gmail.com">greg.freemyer@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
fyi: I whole heartedly agree, the mac wipe failure sounds like a<br>
process failure, not a technology failure.<br>
<br>
As to: $1/MB ???????? for recovery<br>
<br>
You must not be telling the whole story. Or maybe you meant $1/GB.<br>
<br>
That most expensive I'm aware of is a raid array failure. That can be<br>
$5K/drive or so, but that is still way below $1/MB.<br>
<br>
Or maybe you just needed a few relatively small files recovered. It<br>
is still a lot of work to search the whole drive for a few fragments<br>
and try to rebuild things.<br>
<br>
I could see us charging $1K or even $2K to recover a specific deleted<br>
file that was a real challenge to rebuild. And if it was only 50 MB<br>
or so, you might say that worked out to $20/MB, but that's not really<br>
a fair to describe the price.<br>
<font color="#888888"><br>
Greg<br>
</font><div><div></div><div class="h5"><br>
On Fri, Apr 16, 2010 at 12:44 PM, Jim Kinney <<a href="mailto:jim.kinney@gmail.com">jim.kinney@gmail.com</a>> wrote:<br>
> sounds like the wipe tool on that Mac was crap and just did a delete. Drive<br>
> recovery is $$$$$$$$$!!!!<br>
> The last one I ran for a client was $1/MB.<br>
><br>
> On Fri, Apr 16, 2010 at 12:24 PM, scott boss <<a href="mailto:scott@sboss.net">scott@sboss.net</a>> wrote:<br>
>><br>
>> A friend of mines wife wiped her mac laptop HD. Not the govt 35pass<br>
>> but a single pass wipe. He sent it off to one of those disk recovery<br>
>> companies and he got 99% of the disk back and the HD was much larger<br>
>> than 20g. She had over 20g of photos alone.<br>
>><br>
>> Ymwv!!<br>
>><br>
>> Sent from my mobile...<br>
>><br>
>> On Apr 16, 2010, at 12:04, Brian Pitts <<a href="mailto:brian@polibyte.com">brian@polibyte.com</a>> wrote:<br>
>><br>
>> > On 04/16/2010 11:31 AM, Greg Freemyer wrote:<br>
>> >><br>
>> >> NIST has a sanitation paper that says disk drives of 20GB or larger<br>
>> >> capacity are not recoverable even via laboratory means after a single<br>
>> >> wipe with zero's.<br>
>> >><br>
>> >> So your just wasting cpu cycles using /dev/urandom. Just use<br>
>> >> /dev/zero. And just do it once.<br>
>> ><br>
>> > The link you shared to a discussion of that paper a while back is<br>
>> > dead.<br>
>> > Do you know of any more sources? I'd really like to have something to<br>
>> > wave at the "you must wipe it 27 times" people.<br>
>> ><br>
>> >> Also, ext2/3 reserves x% of the drive for root, so if your doing the<br>
>> >> above as a normal user, your missing that x%. I think x% is 5%,<br>
>> >> but I<br>
>> >> don't recall for sure. And 5% of 1TB is 50GB, so it is a big deal.<br>
>> ><br>
>> > At Free IT Athens, we run sfill and sswap from the secure-delete suite<br>
>> > of tools as a post-install action to securely erase all unused space<br>
>> > on<br>
>> > a system being refurbished. sfill sipes the disk space and inode<br>
>> > space,<br>
>> > and sswap takes care of the swap partition.<br>
>> ><br>
>> > --<br>
>> > All the best,<br>
>> > Brian Pitts<br>
>> > _______________________________________________<br>
>> > Ale mailing list<br>
>> > <a href="mailto:Ale@ale.org">Ale@ale.org</a><br>
>> > <a href="http://mail.ale.org/mailman/listinfo/ale" target="_blank">http://mail.ale.org/mailman/listinfo/ale</a><br>
>> > See JOBS, ANNOUNCE and SCHOOLS lists at<br>
>> > <a href="http://mail.ale.org/mailman/listinfo" target="_blank">http://mail.ale.org/mailman/listinfo</a><br>
>> _______________________________________________<br>
>> Ale mailing list<br>
>> <a href="mailto:Ale@ale.org">Ale@ale.org</a><br>
>> <a href="http://mail.ale.org/mailman/listinfo/ale" target="_blank">http://mail.ale.org/mailman/listinfo/ale</a><br>
>> See JOBS, ANNOUNCE and SCHOOLS lists at<br>
>> <a href="http://mail.ale.org/mailman/listinfo" target="_blank">http://mail.ale.org/mailman/listinfo</a><br>
><br>
><br>
><br>
> --<br>
> --<br>
> James P. Kinney III<br>
> Actively in pursuit of Life, Liberty and Happiness<br>
><br>
><br>
> _______________________________________________<br>
> Ale mailing list<br>
> <a href="mailto:Ale@ale.org">Ale@ale.org</a><br>
> <a href="http://mail.ale.org/mailman/listinfo/ale" target="_blank">http://mail.ale.org/mailman/listinfo/ale</a><br>
> See JOBS, ANNOUNCE and SCHOOLS lists at<br>
> <a href="http://mail.ale.org/mailman/listinfo" target="_blank">http://mail.ale.org/mailman/listinfo</a><br>
><br>
><br>
<br>
<br>
<br>
</div></div>--<br>
<div class="im">Greg Freemyer<br>
Head of EDD Tape Extraction and Processing team<br>
Litigation Triage Solutions Specialist<br>
<a href="http://www.linkedin.com/in/gregfreemyer" target="_blank">http://www.linkedin.com/in/gregfreemyer</a><br>
CNN/TruTV Aired Forensic Imaging Demo -<br>
<a href="http://insession.blogs.cnn.com/2010/03/23/how-computer-evidence-gets-retrieved/" target="_blank">http://insession.blogs.cnn.com/2010/03/23/how-computer-evidence-gets-retrieved/</a><br>
<br>
The Norcross Group<br>
The Intersection of Evidence & Technology<br>
<a href="http://www.norcrossgroup.com" target="_blank">http://www.norcrossgroup.com</a><br>
<br>
_______________________________________________<br>
</div><div><div></div><div class="h5">Ale mailing list<br>
<a href="mailto:Ale@ale.org">Ale@ale.org</a><br>
<a href="http://mail.ale.org/mailman/listinfo/ale" target="_blank">http://mail.ale.org/mailman/listinfo/ale</a><br>
See JOBS, ANNOUNCE and SCHOOLS lists at<br>
<a href="http://mail.ale.org/mailman/listinfo" target="_blank">http://mail.ale.org/mailman/listinfo</a><br>
</div></div></blockquote></div><br><br clear="all"><br>-- <br>-- <br>James P. Kinney III<br>Actively in pursuit of Life, Liberty and Happiness <br><br>