It seems to me rather pointless, not because it would not be interesting (it would be) but because it would have IMHO no practical use.
I have seen "office" computers (the one that a secretary uses, where the activity is mostly e-mails and updating a number of pre-existing documents) where deleted data could be recovered after years (usually the disk is used - say - at the most 20 or 30% of capacity), and I have seen systems used during the day to do some work and during the nights and weekends to senselessly and blindly download Gbytes of torrents/movies where you couldn't get on Monday something deleted the previous Friday.
Also since Windows 7 - if I recall correctly - there is automatic/scheduled defrag, which while not necessarily really wiping the data may well make a mess of it overwriting partially files.
And of course automatic Windows Updates. <img src="images/smiles/icon_sad.gif" alt="Sad" title="Sad" />
But let's say that we can categorize a given PC in one of (say) five "types", each with a given "recoverability rating":
10%
30%
50%
70%
90%
Then we empirically establish that we (still say) can subtract 1% for every 24 hours of activity of the PC after the deletion.
So you have a "10%" PC where the file has been presumably deleted 15 days ago (of which 11 were working days of around 8 hours each).
Our nice hypothetical formula will tell us that we have a probability of (10-(11*8/24))/100=6.33% to recover the deleted file.
What do you do?
1) You look for the file (but with a seriously apathetic and uninspired attitude)
2) You don't look for the file (since you decided previously that anything below 10% is not worth even the attempt)
What would you do if you didn't know that the particular item was rated at 6.33%?
1) You look for the file (optionally with an optimistic or neutral attitude)
2) You don't look for the file (because it is too much work, would cost too much, it is not possible, etc. [1])
jaclaz
[1] This is what usually the corporate IT guys say whenever you ask then anything that could - even hypothetically - result in some work for them.
↧