MFSTM

Encyclopedia : M : MF : MFS : MFSTM

MFSTM, Magnetic Force Scanning Tunneling Microscopy is a forensic method of recovering data from sanitized hard disk drives.

Forensic recovery in the media

Popular belief is that twenty overwrites and a system clock random generator can sanitize a drive. This is very incorrect. If a hard drive is examined by a forensic expert, data will be recovered. This is so, because the microscope used for sector examination is twenty or more times as sensitive than the hard disk read head. MFSTM can read the .95 or 1.05 minuscule discrepancies in single bit overwrite.

Given the high tech microscope and the understanding of the process of generating pseudo random streams of data, recovery is usually possible, providing that each bit space has not be saturated with enough overwrites to mask the previously written spaces, which are used in forensic recovery.

An enhanced parallel process (some form of polymorphic adaptation) algorithm with a sample of physical entropy (molecular level physical randomness) is needed to thwart MFSTM recovery. At least 1000 overwrites for each bit is needed to render useless current MFM methods.

A single low-level overwrite to each bit completely renders useless any form of software recovery, however.

From Wikipedia, the Free Encyclopedia. Original article here. Support Wikipedia by contributing or donating.
All text is available under the terms of the GNU Free Documentation License See Wikipedia Copyrights for details.