Bit of a bonus video to my usual content, sometimes I create tech security related videos for my students and this one is a a nice short Digital Forensic related technique for recovering data that you might find interesting and potentially helpful plus it's still gaining access to something that is thought to be inaccessible, enjoy! This same technique can be used for any type of file as long as you know the Hex header and footer of the file type you're trying to find - google is your friend HxD can be found at the following link, I am not a beneficiary in any way, its just a great tool. mh-nexus.de/en/hxd/ Please note, be very careful when accessing a hard drive with this tool, open it in read only mode, if you make a write change to disk surface you need to really know what you are doing, it's fine to use in the way shown in this demo where the recovered data is written out to a separate disk, also making write changes to a disk you are trying to recover from could cause further data loss.
@qutube1002 ай бұрын
Lovelly stuff LPP i think we are quite like minded thee and me!
@paulg4132 ай бұрын
I think I've spent my whole life just taking stuff apart 🤣🤣
@BeercanBushcraft2 ай бұрын
Nice one Paul mate 👍 I use a bit of old aluminium, oh different type of file, it's the old HXD fix 😂 Cheers and all the best to you and yours 👍 🍻
@paulg4132 ай бұрын
🤣🤣 cheers Tinnie 🍻🍻
@gprider15252 ай бұрын
Excellent, might try this. I've been trying to find an old spreadsheet from years ago from an old hard drive, thanks for the tip
@paulg4132 ай бұрын
Theres a good list of file signatures here en.wikipedia.org/wiki/List_of_file_signatures best of luck
@gprider15252 ай бұрын
@@paulg413 cheers
@SouthpawPickingPete-qi8qr2 ай бұрын
Fascinating look into forensic recovery, quite interesting how some things are never truly removed!
@paulg4132 ай бұрын
Thanks Pete, its a hugely interesting area of Security, I really love doing these classes 👍👍
@roysammons24452 ай бұрын
Nice!!! If there were 50 images the info you were searching through would clearly be an awful lot more right?
@paulg4132 ай бұрын
Oh yes, I'd use this technique to work out if there was something here and if its only 1 or 2 then recover them manually but if it's got loads of data then switch over to a tool like Autopsy which will automate the file carving, this is more to show whats going on 'under the hood' and build some familiarity with using Hex Editors
@THazebomb2 ай бұрын
Cool video, what about permanently deleted files on android 13 with file based encryption?
@paulg4132 ай бұрын
Theres a lot of variables in your question, files can be recovered on Android devices but it depends on exactly how the file was deleted and if further data has been written to the device, there will be other indicators leading to the past presence of a file of interest, of course if an encrypted is recovered then it will still be encrypted but even then not all 'encryption' is equal
@THazebomb2 ай бұрын
@@paulg413 thank you for the response! It was more aimed towards a photo or video file. Also what about after a factory data wipe
@paulg4132 ай бұрын
@@THazebomb the same answer pretty much, a factory data wipe doesn't actually wipe any data, it just marks the file system as absent so a new one can be created on top of the old, there are ways to perform a secure erase and they don't involve a factory wipe. it;s hit and miss to erase prior contents if just using the phone normally, you would have to use software that writes to every location in storage multiple times to be certain that the data can't be recovered, there's a good article here www.appgeeker.com/android-data-recovery/recover-android-data-after-factory-reset.html