Question:

How does encryption affect the forensic recovery of data from a drive that has been overwritten?

I am interested in the feasibility and methods of retrieving data from a drive that has been intentionally erased by overwriting it with zeros, ones, or random patterns. I understand that some techniques, such as magnetic force microscopy, can recover overwritten data by detecting the residual magnetization of the bits. However, I wonder if encryption adds another layer of complexity to this process, since the original data is transformed by an algorithm and a key before being overwritten. Does encryption make the recovery of data more difficult or impossible, or is there a way to reverse the encryption after recovering the overwritten data?

: [How to Recover Your Files From a BitLocker-Encrypted Drive]

Answer:

Data recovery is the process of retrieving data that has been deleted, lost, corrupted, or damaged from a storage device, such as a hard drive, a flash drive, or a memory card. Data recovery can be performed by forensic experts, who use specialized tools and techniques to recover evidence from digital devices. However, data recovery is not always possible, especially when the data has been overwritten or encrypted.

Overwriting is a method of erasing data by replacing it with new data, such as zeros, ones, or random patterns. Overwriting makes the original data less accessible, but not necessarily unrecoverable. Some forensic techniques, such as magnetic force microscopy (MFM), can recover overwritten data by detecting the residual magnetization of the bits on the disk surface. MFM can reveal the previous state of the bits, even after multiple overwrites, by measuring the magnetic force between a tiny probe and the disk.

Encryption is a method of protecting data by transforming it with an algorithm and a key, making it unreadable without the key. Encryption can be applied to the entire disk (full-disk encryption) or to specific files or folders (file-level encryption). Encryption can also be performed before or after overwriting the data. Encryption adds another layer of complexity to the data recovery process, since the recovered data is still encrypted and requires the key to decrypt it.

The effect of encryption on the forensic recovery of data from a drive that has been overwritten depends on several factors, such as the type and strength of the encryption, the availability of the key, and the number and pattern of overwrites. Generally speaking, encryption makes the recovery of data more difficult or impossible, unless the key can be obtained or guessed.

If the data is encrypted before being overwritten, the recovery of the original data is unlikely, since the encryption algorithm will produce random-looking data that will be indistinguishable from the overwriting data. Even if the encrypted data is recovered, it will still be encrypted and require the key to decrypt it. The key may be stored on the device, on another device, or in the user’s memory. Forensic experts may try to locate the key by searching the device, examining the user’s online accounts, or interrogating the user. However, if the key is not found or remembered, the encrypted data will remain inaccessible.

If the data is overwritten before being encrypted, the recovery of the original data may be possible, depending on the number and pattern of overwrites. If the data is overwritten only once, MFM may be able to recover the original data by detecting the residual magnetization of the bits. However, if the data is overwritten multiple times, or with a random pattern, MFM may not be able to distinguish the original data from the overwriting data. In this case, the encrypted data may be recovered, but it will still be encrypted and require the key to decrypt it. The key may be obtained by the same methods as above, or by brute force, which is a trial-and-error method of guessing the key by trying all possible combinations. However, brute force is only feasible for weak encryption or short keys, since strong encryption or long keys will take too long to crack.

Therefore, encryption affects the forensic recovery of data from a drive that has been overwritten by making it more difficult or impossible, unless the key can be obtained or guessed. Encryption can also be combined with overwriting to increase the security of the data and reduce the chances of recovery. Forensic experts need to consider the type and strength of the encryption, the availability of the key, and the number and pattern of overwrites when attempting to recover data from a drive that has been overwritten.

References

: [Practical Approaches to Recovering Encrypted Evidence]