MiniDV taped over..is it recoverable

p@mast3rs wrote on 3/5/2004, 8:04 AM
As of late, I have been getting more involved with encryption (part of my masters program) and we were asked to think about things that could be recovered using modern technology. naturally, I started thinking about MiniDV and how sometimes we record over on our tapes. My question is this.

If in todays computer age we can recover bits from hard disks etc..., wouldnt it be possible to recover bits stored on a minidv tape that has been recorded over? I can definitely see a benefit to being able to to recover bits from material that has been copied over especially when it comes to criminal activity (i.e. child porn, etc..) However, the saem can be said for the newlyweds who thought it may be fun to capture their "honeymoon" night on DV.

So my question to those who kno more about the way DV is recorded and "erased" from tape is can this be done? Lets say you shot an entire tape of video and then later decided to copy over it with new footage or decided to blank the tape by exporting black video from VV4 to tape. Is the previous recording recoverable?

This topic is going to be part of my paper for this class and i am very interested in hearing what many of you think in regards to this.

Comments

Jsnkc wrote on 3/5/2004, 8:14 AM
I would have to say no, the way data is stored on a hard drive and the way it is stored on tapes are 2 completely diffrent things.
p@mast3rs wrote on 3/5/2004, 8:20 AM
But in theory, isnt digital just 1's and 0's? MiniDV is digitally stored correct? Not trying to be dififcult but just tryign to understand the theory a bit more.
Former user wrote on 3/5/2004, 8:28 AM
Part of the difference is on a hard disk, the bits for a file might be scattered on different parts of the drive. So if you erase a file, the next file recorded might not record over all of the previous bits. Thus you are able to recover parts of the file, and in some cases, enough to recreate a file.

On a tape, it is recorded linearly (sp?). So every bit related to a file is recorded over. It might not be totally erased, but it has been written over. It would be much harder to recover a specific bit and know where it feel it the scheme of things.

Dave T2
Matt_Iserman wrote on 3/5/2004, 8:31 AM
I could be wrong and, if I am, I'm sure someone will correct me...

My understanding is that when you trash a file on your hard drive, the file itself remains; however, the references to the file are removed and that area of the hard drive is identified as available. The data doesn't actually disappear until another file is written in the same location as the deleted file. This is why programs were developed that securely delete files. These programs also blank out the data such that those sectors are truly empty.

The MiniDV equivilent would be for you to change the label on your tape indicating that it is "empty" or "blank". The data is still there, but now the tape is slated for re-use. Then, of course, the original data would not disappear until you record over it.

Hope that helps,
Matt Iserman

riredale wrote on 3/5/2004, 8:43 AM
We're talking two different things. Certainly if you delete something from your trash can on your screen you can usually get it back very easily because, as mentioned, the files themselves have not been written over--only the links have been removed.

But there is more to it than that. Suppose you not only delete a file, but then make sure that something is written over it? There are "Professional Recovery" outfits that specialize in bringing back such data. I guess in the corporate world there are times when getting a file back is worth tens of thousands of dollars or more. For a substantial fee, these recovery places will use all sorts of exotic techniques to "coax" the original magnetic patterns back.

That's why, when you buy a software product that is used to completely erase your hard drive (if, for example, you are donating the drive to Goodwill), it asks you if you want to just fill the disk with 0's, or do you want to do it in different patterns 7 times, like the Department of Defense demands for their stuff? I guess eventually the magnetic domains just get too faint after multiple writes.

So the same should be true for miniDV. I suspect that, if you had irrefutable evidence of a second gunman in the JFK assasination and erased that tape, the feds could get the image back. (Or maybe they wouldn't want to!)
johnmeyer wrote on 3/5/2004, 9:36 AM
miserman is correct: Deleting a disk file only deletes the directory entry, not the data itself. Once you overwrite magnetic media with other information, you cannot recover the original. If you overwrite with all zeros, you might still be able to recover, using very advanced labatory techniques, but usually you overwrite with ones and zeros.

In the analog world, there has been much technology created to recover audio from tapes that have been erased. The erase head on an analog tape applies a bias that removes the original signal. However, some signal can remain. Some of these techniques are being applied to the 18 minute Rosemary Woods gap on the Nixon tapes. No word yet on whether they will succeed.

The one hope you might have on your DV tape project would be to look at the edges of the recording. The tape often does not travel over the head identically from one pass to the next. If it is recorded on a different machine, the differences in head alignment can cause a further misalignment. Therefore, sometimes there is still a little original signal at the edges. This would be your one hope in recovering an old DV tapel.
metrazol wrote on 3/5/2004, 11:48 AM
Well, y'all have some good points, but technology has been advancing in data recovery.
The data on the tape is stored linearly, obviously, and when you overdub, the record head simply switches the 1's and 0's just like it did when the tape was blank (all 0's or junk or whatever, it doesn't matter). Now, that means when you play back the tape, you only get the new video, not the old. The latest write gets read. Right. Except for one thing. Just like on your hard drive, just overwriting once does not remove all traces of that particular bit's (any single 1 or 0) former state.

Anybody have an electron microscope? You could, in theory, and I bet somebody at the NSA has tried this, scan the tape that has been erased or overdubbed and determine all prior states of the digital bits. It's what they do with hard disks and it may very well work, to some degree, with digital video tape. The only way to guarantee no one ( and I mean that high level no one, for you black helicopter types) reads your hard disk at some point in the future is to melt it. Yes, melt, as in melt into liquid. The same might be true of tape.

Now, to be honest, there really isn't a huge community of people who need that kind of protection, but it's a fun thought, eh?
Chienworks wrote on 3/5/2004, 12:20 PM
The only problem with the edge idea is that the signal is recorded radially on the tape, in diagonal lines that run from one side over to the other. So, if there was anything left from the previous recording it wouldn't be a super-thin track along the edge, it would be the beginnings or ends of each radial slice.

Of course, if the tracking is positioned just right, the old tracks might end up right between the new tracks and might be readable that way. Probably this wouldn't be possible in LP mode because the tracks touch. In SP it might just happen to work out. I wouldn't count on it though.
farss wrote on 3/5/2004, 2:39 PM
Any helical scan tape can become unrecoverable even without recording over it. A change in length of the tape of only 1% due to base stretching will render the tape unreadable, and thats from the spooks in Eastern Europe who make a living trying to recover these things.
Digital media is far different from analogue audio tape, people get excited because most PCs don't actually 'erase' the data on a hard drive and therefore assume anything can be recovered. I would seriously doubt your chances of getting anything back from a hard drive even after one overwrite. The guys who design these things spend a fortune on R&D to get the smallest possible magnetic domain from which data can just be read and then relyi on a large amount of error correction data as well.

Probably to some extent this might (and I seriously doubt it) have been possible with some of the early HD technology, given how the bits are crammed in on todays drives I'd have to say once its overwritten it's gone.

Also the type of magnetic media (as in the actual thing that store the 1s and 0s) make a difference. In the older oxide media what happens is the average orientation of the dipoles is shifted. Even after a rewrite some 'ghost' of what was there before would remain so by looking at the faint remnants of signal and subtracting the new data it was sometimes possible to recover fragments.
However this was obviously an inefficient way to store data. Modern media on both tape and hard drives uses dipoles that are all aligned, that way you need much less of them per bit. When they're changed from a zero to a one all the dipoles flip over, orginal data is gone. That's also why the modern tapes don't have the archival properties of the older metal particle tapes, once you loose bits off ME tapes (like used in DV25) its gone for good.
RichMacDonald wrote on 3/5/2004, 3:17 PM
A good friend of mine (who shall remain nameless :-) spent a fun day at the local FBI quarters about a month ago. They were "rushing" him to see if he would join their computer forensics team, so he got to see all the cool toys. Yes it is possible to recover the data from the deleted files. It is possible to recover most of the data from areas that have been written over once. Quite easily, apparently. Two overwrites and you can basically forget it. If I get a chance, I'll ask about DVTape, but I assume the same principles apply. (Talking without a shadow of a fact, though.) While we think we're dealing with 0s and 1s, we're actually dealing with the range 0...1 and an arbitrary decision that anything below 0.5 is 0 and anything about 0.5 is 1. (Your numbers may vary, of course, but you get my drift). So you need tools to read the actual fractional value (easy), then you need software to perform statistics on the results and infer the original/previous values by removing the later overwrites (very hard).

Oh yes, and while the tools were geek heaven, the fact that my friend would be spending most of his day looking at child porn outweighed all other positives.