Just like many people instantly bought into Maxey’s claims about the 450 gb of new material he’s discovered on the laptop he got from Rudy G. , many people will also instantly buy into “there is no virus, 100,000 people across America entered into a massive conspiracy to poison us all with local water supplies”_
We’re in an INFORMATION WAR.
Psy-ops are being launched in your left and in your right.
Be careful who you follow.
GET RID OF ALL YOUR AUTHORITY FIGURES who appeal to your confirmation biases.
Research for yourself.
Don’t just instantly adopt some new claim some guy you never heard of two weeks ago presented to you.
The biggest danger MAGA has right now is that so many people have detached from reality they literally ready to believe anything.
You actually need MORE discernment and skepticism right now, not LESS.
Be your own authority.
(Brian Cates)
Its possible, if some of the recovered files are compressed
No. Especially in a hard drive, you're limited to physical capacity. It is actually impossible to recover more than the total sum of a drive.
When you delete something on a PC, it (usually) goes to the recycle bin. When you delete it from the recycle bin, what happens is that the place where the file you deleted resides still exists; the data is still there. But in an ELI5 style explanation, it tells the PC that it's okay to overwrite the data.
Once that data is overwritten, it's gone. This is the function of a product like Bleach Bit, or..really any software.
The software overwrites the data that was stored there with blank data over and over again until all segments have been completely wiped.
The only way you can actually recover data is if this process hasn't happened yet.
Let me try to explain a little bit more clearly:
Let's say you have 5 slots -- A, B, C, D, E -- and you download a video file.
That video file may take up A, C and E. B and D are still open, but the number of slots don't change.
Now let's say you delete it, and then download another video file. That file may take up B and D.
In this case, the video file previously deleted could (most likely) be recovered because none of the slots have been overwritten with new data.
Then say you downloaded a third file. This file takes up A.
Now recovery is almost impossible, because A has been overwritten. There are functionally no further layers.
Reconstruction of a majority of the file may be possible by software designed to do it, by recovering C and E but the complete sum is not possible to recover because A no longer has any trace of data remaining in that slot.
The end result is, for average users, a corrupt file with missing or incomplete data to varying degrees. For law enforcement, they may be able to recover portions of the whole and display it but not always.
If a 500GB storage has a 500GB total capacity (because a 1GB does not equate to 1024 megabytes when it comes to drive manufacturers anymore, this is not likely but for the sake of this discussion it's easier) there is no way to recover more than 500GB of data.
Compression will "complicate" this, but not really. If it's compressed to 100GB, it is functionally 100GB. You will not be able to somehow recover this and 500GB of other files.
So ultimately, it depends on if those files were compressed on the PC or not. And considering that he took it and left it at a PC repair shop with sensitive data on it...
..It's unlikely that Hunter knew enough or cared enough to actually do this.
Only other possibility, and I swear it's been floated around already as a source of this supposed data, was access through the laptop to various cloud based storage, including Apple's.
In this case, you could "technically" retrieve more information than the sum of the laptop's storage, but it's also not technically from the laptop, and that wasn't really the argument here.
The last bit to this novel is a little bit of a bonus:
Windows also has a neat little bug (feature, of course) that essentially, with no better word to describe the process, uncreates a file. What this does in practice is remove traces of existence entirely, as if it was never created in the first place.
People tend to run into this issue with using undo and redo a lot and losing important files they're trying to back up.
When you use data recovery software, including big wig paid software with a good reputation, the file will not appear. Unlike a corrupt or incomplete file, an "uncreated" file will just simply not have an entry at all. It's possible that, in the cases of hard drives, this is recoverable by accessing the physical plates in a professional environment... but I haven't been able to see any instances of success using this method.
TL;DR novel: Data is limited by capacity, and the way deletion works only allows recovery up until that space is filled by other data. If a data problem arises for you with important data, immediately shut down and take it to a professional data recovery business. Data recovery is time sensitive (in that the more you use your PC, the more likely it will be overwritten) so don't play games with it
I think the extra data found is bunk, but I would mention that when data gets overwritten it is not gone gone. There are some pretty advanced forensic techniques where you can still recover data (depending on the hardware). In the typical hard drive, data is stored magnetically, and the onboard hardware determines if a bit is a 1 or 0 depending on that. However the physical pieces of iron being magnetized are not just an on/off, there is a threshold where a 0 becomes a 1. If a bit was previously a 0 and overwritten as a 1, that "1" is not as strongly magnetized as if it was originally a 1 and then written as a 1 again. That is the reason why programs like bleach bit will typically write to those sectors over and over again, they'll write all 1's then all 0's then randomly so the data cannot be recovered.
That technique is pretty limited though, and requires specialized hardware, and you'll still end up with fragmented data if you get anything at all. You def could not recover 300GB that way.
Yes, and it requires the original hard drive to recover. Image copies won't have any of the residual magnetic pieces.
This is all correct. There is one other caveat concerning the data on Hunters hard drive however. We do not know the actual quantity of data that was stored on his drive, because all we have seen is from copies.
Example: If 500GB of data is shown to us on a copy of the drive, we cannot know how much space it used on the original drive because that data may have been compressed on the original, and not compressed (or compressed differently) on the copy of the drive. In that case, our estimations as to the maximum data the drive can hold could be inaccurate.
I worked for a company where someone left the company... their computer was turned back in.
I reformatted it, reinstalled an OS gave to someone else.
There was VERY important data on that hard drive. They sent it out someplace and they recovered it. It cost a LOT of money.
I never thought they'd get it back - I was surprised.
Most magnetic storage media actually has a memory beyond the standard 1/0 that the drive will report to you for a bit. That's why most "milspec" drive wipers do 7-8 passes of random data, because it clears that previous memory.
This is a pretty good video explaining the effect, and why multiple passes are required.
This is, of course, with the stipulation that I also doubt the ability to extract hundreds of gigabytes beyond the capacity of the drive.
Also true!