Do BIBM images contain deleted files 'under the surface'?
Posted: Tue Nov 26, 2013 9:42 pm
This has probably been asked before, but I've done a few searches and can't find any relevant posts. I know that BIBM takes a snapshot of an HD's _structure_, but does it get all the 1s & 0s _exactly_ as they are? I suspect not since the images are smaller than the drive itself, but thought I'd ask anyway. Here's the problem:
Most posts are about just using an image in the event that your HD goes bonkers and you need to get your system back to where it used to be. But what if you find that you need to recover data deleted some time ago (and emptied from Windows recycle bin), after which you used bibm to securely wipe the drive so that it's definitely gone forever?
I have GetDataBack, quite a nice and effective little app, but once BIBM does a gov-grade wipe, obviously the data is totally gone from the drive as it currently stands and no-one and nothing is going to get it back. However, what about an image taken BEFORE the wipe? When the image was taken, the data was already deleted from Windows and the recycle bin emptied, so the data would no longer have been available to the OS, but the image was taken prior to the wipe, soon after deletion, at a time when the data would still have been available for recovery with something like GetDataBack. Can I restore that image and then use GetDataBack to get at that deleted data? Again, I suspect not, but it never hurts to check.
Most posts are about just using an image in the event that your HD goes bonkers and you need to get your system back to where it used to be. But what if you find that you need to recover data deleted some time ago (and emptied from Windows recycle bin), after which you used bibm to securely wipe the drive so that it's definitely gone forever?
I have GetDataBack, quite a nice and effective little app, but once BIBM does a gov-grade wipe, obviously the data is totally gone from the drive as it currently stands and no-one and nothing is going to get it back. However, what about an image taken BEFORE the wipe? When the image was taken, the data was already deleted from Windows and the recycle bin emptied, so the data would no longer have been available to the OS, but the image was taken prior to the wipe, soon after deletion, at a time when the data would still have been available for recovery with something like GetDataBack. Can I restore that image and then use GetDataBack to get at that deleted data? Again, I suspect not, but it never hurts to check.