Recovering deleted wallet/files from HDD

[fillippone]

I see that he hasn't snooped into Chrome at least, can never be too sure about the rest of the hard drive.

If I would want to read someone's files without them knowing about it, I would create an image of the entire drive. This can easily be done by booting a Linux LIVE OS, or by temporarily plugging the drive into another computer. You wouldn't see any of this on your file system.

Or buy a hardware cloner, clone the drives and read them later.
Put client disk in slot 1 blank disk in slot 2 & push a button. Drink beer. Then put disk back in client PC.
PCs / phones / tablets. We live our life on them now, and even the paranoid people can't remember everything that they may have accidentally stored on one.

-Dave

Dang.
Now you scared me.
Next time I have a problem I will destroy my laptop with an hammer. I am not going to leave my HHDD unattended anymore!

[larry_vw_1955]

Or buy a hardware cloner, clone the drives and read them later.
Put client disk in slot 1 blank disk in slot 2 & push a button. Drink beer. Then put disk back in client PC.
-Dave

those little sata 2 port "docking stations" are not so good as what you might think. if there's one constant about them it is people complaining how it f***ed up their hard drives and made them "raw". doesn't matter the brand.

[Lotus]

Dang.
Now you scared me.
Next time I have a problem I will destroy my laptop with an hammer. I am not going to leave my HHDD unattended anymore!

Exactly. Anything glitches, you nuke the entire thing out. Would be bad though if you later discover it was just an OS bug a day later...

[LoyceV]

Next time I have a problem I will destroy my laptop with an hammer. I am not going to leave my HHDD unattended anymore!

Or use a screwdriver, as that's all it takes to take out the drive.
Or use full disk encryption.
Or an industrial shredder. I prefer a more subtle approach to my hardware.
Seriously though: there's no point to destroy any hardware that doesn't hold data.

[fillippone]

Next time I have a problem I will destroy my laptop with an hammer. I am not going to leave my HHDD unattended anymore!

Or use a screwdriver, as that's all it takes to take out the drive.
Or use full disk encryption.
Or an industrial shredder. I prefer a more subtle approach to my hardware.
Seriously though: there's no point to destroy any hardware that doesn't hold data.

Apparently your AI is not sophisticated enough to detect the rhetorical construction known as “Metonym”.
Or actually your AI is so advanced that pretends to misunderstand something in order to appear more human.

Or it’s just me, who think a joke is fun, while it is not.

[DaveF]

Or buy a hardware cloner, clone the drives and read them later.
Put client disk in slot 1 blank disk in slot 2 & push a button. Drink beer. Then put disk back in client PC.
-Dave

those little sata 2 port "docking stations" are not so good as what you might think. if there's one constant about them it is people complaining how it f***ed up their hard drives and made them "raw". doesn't matter the brand.

Looking at my work notes we have done over 170 Spinning drives to SSD since Jan 1 2020 for a client who was extending the life of some older machines so either you and the people you are talking to are using cheap cloners or we have some amazing luck.

I don't know how the $80 generic ones work, but the 'real' ones are just running an embedded linux controller and dd 'ing (more or less) the entire drive.
The source is only ever mounted in read only so having it come back as 'raw' is just about impossible.

This: https://www.amazon.com/SATA-Hard-Drive-Duplicator-Eraser/dp/B00G6TG5YE
is not the same as this: https://www.mediaduplicationsystems.com/fx2125-sata-sas-usb3.0-hard-drive-duplicator

If you walk into a shop or your tech is using something like the StarTech one. Run away as fast as you can.

The point is the professional ones can do 30+GB a minute if the drives can keep up so yes, you can pull and clone and replace a filled 1TB drive in about an hour.

-Dave

[fillippone]

The point is the professional ones can do 30+GB a minute if the drives can keep up so yes, you can pull and clone and replace a filled 1TB drive in about an hour.

-Dave

Interesting question then is: what if something break on your laptop where you have critical informations? What if your power supply breaks on your laptop? Can you trust your repair shop will not duplicate your hdd?

Any ways of mitigating this? Even if the wallet.dats are encrypted, I bet there will still be loads of passwords saved while browsing, that can do a lot of damage.

When I gave my phone to repair shop, I resettled it to factory setting, but had the luxury of being able to prepare for the event.
What should you do in case of an “ unforeseeable” event?

[Ultegra134]

The point is the professional ones can do 30+GB a minute if the drives can keep up so yes, you can pull and clone and replace a filled 1TB drive in about an hour.

-Dave

Interesting question then is: what if something break on your laptop where you have critical informations? What if your power supply breaks on your laptop? Can you trust your repair shop will not duplicate your hdd?

Any ways of mitigating this? Even if the wallet.dats are encrypted, I bet there will still be loads of passwords saved while browsing, that can do a lot of damage.

When I gave my phone to repair shop, I resettled it to factory setting, but had the luxury of being able to prepare for the event.
What should you do in case of an “ unforeseeable” event?

I used to have a desktop computer but the motherboard died on me and never bothered to repair it. Supposing you have a desktop PC, it's not that hard to mount a HDD and recover your data. If I had one myself, I wouldn't have bothered taking it to a technician, since the laptop itself is pretty cheap.

[LoyceV]

what if something break on your laptop where you have critical informations?

I was serious when I wrote this:

Or use a screwdriver, as that's all it takes to take out the drive.

What if your power supply breaks on your laptop?

I'd probably fix it myself

Can you trust your repair shop will not duplicate your hdd?

You can assume this, but you can only be sure if you don't let your HDD out of sight.

When I gave my phone to repair shop, I resettled it to factory setting, but had the luxury of being able to prepare for the event.
What should you do in case of an “ unforeseeable” event?

Phones are much worse: you can't just take out the disk to send it in for repairs. But phones are also much more likely to get stolen, so I'd say don't store more data on it than you're willing to lose.

[jerry0]

So how do you guys handle when there is an issue and you need to bring it your laptop to a repair shop or return it to the company?  Assuming you can just check your hard drive which is to see what is the problem, isn't this already a big issue?  Like imagine it just shows ledger live or electrum as an icon on you computer when they turn it on.


I mean wouldn't they most likely inspect it?

[Lotus]

If you ever send it to "anybody" then assume it's been compromised. As to how to handle it, the answer is still the same. Use a hardware wallet. That way, even if all its content is stolen and you get it back with keyloggers and trojans, they still can't access your assets.
At the very least, transfer everything off the machine before sending it off and don't use it for local wallets again until you wipe it off.

[cabron]

Giving the laptop with its drive will likely give that computer guy access to old passwords saved on browsers.

I would probably just follow what LoyceV suggested that you take out the HD and then sell it to that computer guy, that's the best and easiest way to do it unless you want the risky option. There could be more files you have there in the hard drive which you can slave later on another computer and scan it all like pictures, txt files, and downloaded files.

[fillippone]

Just like @LoyceV said, remove the HDD before giving the device to someone else. If they ask why the HDD is missing, you could say you need the data for urgent work and ask them to use their own HDD/USB drive for testing.

I am not sure many laptop allows for an easy HDD removal, even more  without breaking warrant (Mac User anyone?).
Also,even if I haven’t any wallet in it, just having access to my email a malicious user could do extremely dangerous actions.
Basically, when to give your laptop to an external technician, you are trusting him not to rip you off.
Maybe it’s worth asking him to assist in person to your repair, so that you don’t leave him with your datas alone. This could be counterproductive for opsec reasons anyway.

[LoyceV]

I am not sure many laptop allows for an easy HDD removal, even more  without breaking warrant (Mac User anyone?).

Suggestion: add it to your opsec-checklist to only buy laptops that allows to easily take out the drive.

[ABCbits]

Just like @LoyceV said, remove the HDD before giving the device to someone else. If they ask why the HDD is missing, you could say you need the data for urgent work and ask them to use their own HDD/USB drive for testing.

I am not sure many laptop allows for an easy HDD removal, even more  without breaking warrant (Mac User anyone?).

Then you're either forced to,
1. Learn removing HDD from your laptop and buy necessary tool (e.g. screwdriver for screw type used on your laptop).
2. Perform secure disk wipe using bootable OS on flash drive.
3. Fully trust the technician.

Basically, when to give your laptop to an external technician, you are trusting him not to rip you off.

True, but it's less likely they will do something obvious (e.g. charging very high "repair" cost) rather than cloning HDD which hardly could be detected.

[Ultegra134]

Just like @LoyceV said, remove the HDD before giving the device to someone else. If they ask why the HDD is missing, you could say you need the data for urgent work and ask them to use their own HDD/USB drive for testing.

I am not sure many laptop allows for an easy HDD removal, even more  without breaking warrant (Mac User anyone?).
Also,even if I haven’t any wallet in it, just having access to my email a malicious user could do extremely dangerous actions.
Basically, when to give your laptop to an external technician, you are trusting him not to rip you off.
Maybe it’s worth asking him to assist in person to your repair, so that you don’t leave him with your datas alone. This could be counterproductive for opsec reasons anyway.

The main reason I bought a refurbished laptop was firstly, because it was cheap, and secondly, they are easily accessible. I do not even need a screwdriver to take the back out. On top of that, in case something breaks, it's easily replaceable, even if we're talking about a full replacement.

[vapourminer]

I don't know how the $80 generic ones work, but the 'real' ones are just running an embedded linux controller and dd 'ing (more or less) the entire drive.
The source is only ever mounted in read only so having it come back as 'raw' is just about impossible.

This: https://www.amazon.com/SATA-Hard-Drive-Duplicator-Eraser/dp/B00G6TG5YE
is not the same as this: https://www.mediaduplicationsystems.com/fx2125-sata-sas-usb3.0-hard-drive-duplicator

If you walk into a shop or your tech is using something like the StarTech one. Run away as fast as you can.

can confirm the startech is junk. i have it (maybe not exactly this model but a similar startech) and while its never corrupted the source drive its only successfully duplicated maybe half the drives i tried. like 4 or 5 drives out of 10 or so. and man its slow af. waste of money.

i never leave any old or failed disks anywhere or in anything i giveaway or sell. the drives are destroyed. even if it dies when in the warranty period im not sending a drive back for a replacement so i just write it off.

[Lucius]

Maybe it’s worth asking him to assist in person to your repair, so that you don’t leave him with your datas alone. This could be counterproductive for opsec reasons anyway.

I have seen that some of the services that offer data rescue in my country offer just such a service - means that the client is present when rescuing data (which of course means a higher price). Yet even in such a situation, is it possible to be 100% sure that the data is being copied to only one location, and that this person is not doing another secret backup simultaneously?

i never leave any old or failed disks anywhere or in anything i giveaway or sell. the drives are destroyed. even if it dies when in the warranty period im not sending a drive back for a replacement so i just write it off.

Exactly what I do all my life, I never sell or throw away old computers or mobile phones. I still have my first cell phone over the age of 20 which was state-of-the-art technology at the time, but quite inconvenient to carry because of its size and weight - who would say that today's smartphones are even bigger and similar in weight

[figliar0]

Maybe it’s worth asking him to assist in person to your repair, so that you don’t leave him with your datas alone. This could be counterproductive for opsec reasons anyway.

I have seen that some of the services that offer data rescue in my country offer just such a service - means that the client is present when rescuing data (which of course means a higher price). Yet even in such a situation, is it possible to be 100% sure that the data is being copied to only one location, and that this person is not doing another secret backup simultaneously?

Of course not. If he will use his computer how can you say that data is not copied somewhere else? You cannot be sure if he do not have som program copying your data elsewhere on the background.

[fillippone]

Maybe it’s worth asking him to assist in person to your repair, so that you don’t leave him with your datas alone. This could be counterproductive for opsec reasons anyway.

I have seen that some of the services that offer data rescue in my country offer just such a service - means that the client is present when rescuing data (which of course means a higher price). Yet even in such a situation, is it possible to be 100% sure that the data is being copied to only one location, and that this person is not doing another secret backup simultaneously?

Of course not. If he will use his computer how can you say that data is not copied somewhere else? You cannot be sure if he do not have som program copying your data elsewhere on the background.

I think that, being on the place while my PC is repaired , I could personally be pretty sure about what's getting on, and being able to spot any fraudulent action.

Just remember that self custody is hard. So you can securely hand over the custody of your assets to a professional custodian (not an exchange).