8/1/20

We wiped a drive and got data back!

It is very well known, that if a drive gets wiped, then the data is gone for ever.

This is because wiping means writing zeroes to the drive, hence no data is any longer available and nothing can get recovered.

That is, until now.


Here's what we did.


We took a Palmer drive (WD Palmer, model WD10SPZX-00Z10T0 (SATA)).


These drives are factory locked, no access to Service Area is possible without unlocking the drive.


We unlocked the drive and zero - filled it to make sure it contains absolutely no data.



Then, we initialized the drive under Windows Disk management panel



and threw in some data 



We checked in Hex that now the drive contains data, 



indeed, now sectors are occupied.

Then, we took a complete backup of the drive's Service Area.
You actually need to get a complete image of the SA. Not everything is needed, but for the sake of time we just took a complete backup.




After we were done, we zero-filled the drive to completely wipe all sectors.





Done.
Now the drive is zeroed.




Everything is wiped.
Data is gone.
Right?
WRONG.


Read further.

We went ahead and restored drive's Service Area using the backup we took in the previous steps.




We restored some other parts of the Service Area too.



We powered off and on the drive, and...





We got back 318 files with 800MB capacity.
The files were working normally.


What really happened?

These drives are SMR drives. They use special type of translator, a completely new type that has nothing to do with tratidional translators used in previous architectures.

They store some sort of cache (NOT media cache) in SA and it is possible to recover up to 8GB of data, even if the drive is wiped.
This brings new data into the fields like Forensics and Crime Investigation.
However, it's absolutely necessary to have FULL SA backup before the wiping occurs.