Help - Search - Members - Calendar
Full Version: can a hacker undelete files?
Dumpshock Forums > Discussion > Shadowrun
entropysoda
so...if i find deleted files on some system, can my hacker try to undelete them, or recover the residue of deleted files (as you can in real life...you know even "emptying the recycle bin" doesn't really get rid of the info!)

Just wondering if the storage technology changes things so files are really really gone when deleted, or not?
Cold-Dragon
I don't think there's anything in the books to go against the idea, but being a different style system compared to real world stuff, it's not unreasonable to wonder if deleting also wipes the 'area' too, to prevent deleted viruses from somehow respawning...

I'd have to say GM call, and probably make it a high threshold, something you can 'not quite make it' with so you can get file fragments if it's allowed.
Charon
Well, I'm pretty sure that if a hacker delete a file using the SR4 rules as part of a run, the idea is that the file is finished and that the corp won't make the actions of the PC moot by being able to use hotshot programmer to recover the files.

On the other hand, if the corp deleted some of their data, I guess they are as torough as the plot need them to be.

I'd like to think that when Ares system administrator delete their sensitive files they do as good a job as any PC and it's not just so a hacker can swoop in and recover the data. But I guess if it's essential for the story you can use that plot device.
Jaid
i would allow it, provided you had appropriate hardware and whatnot

[edit] (to clarify: it wouldn't be terribly clear, most likely a poor copy, but it would be possible. presumably, any really sensitive stuff would be deleted, and then the storage device would be destroyed. which gives a good reason for those optical chips to still be kicking around as cheap storage, doesn't it?)
Kesslan
Yeah it's really a hard call in some ways. I mean IRL you should see how far the military goes to make sure it's old hard drives no longer have any information left on them. I once was friends with a guy who used to handle some of that stuff. Was abit of an involved process I'll tell you.

First they deleted everything off the hard drive. Then they tossed them all into a nice big EM magnet. Then they drilled several holes right through the drives. The drives were then dunked into a strong acid bath for 24hrs. THEN they were melted down to slag. And the slag promptly returend to the military so they could comb through the remains and insure there was nothing useable left. However this all applies to magnetic storage.

In 2060's-2070's it's all optical storage. Which is a whole other beast. I'm not quite sure how resiliant these forms of storage are to destruction IRL to be honest. All I know is that it's gotten to the point IRL where 'data crystals' very much exist. One system basically uses a cube of some material or other, and writes multi layered holograms into it as the method of storing data. It's just not terribly efficent atm, and it's also horribly expensive still. But it is functional.

On a hard drive at least, if you delete a file you can still recover it simply because all that's really happened is that the data table has been told 'Sector/clusters X can now be written over'. The data isnt actually deleted at all untill that section of the drive has been overwritten with new data. The moment that happens though, the old data is gone and cannot be recovered. Thats why the recycling bin doesnt -really- remove every last trace of the file. It's simply because untill that actual spot on the drive is used by somethign else, the data is still there, the HD table has simply been told that that space on the drive is now usable by something else.
ixombie
This kind of thing is 100% GM discretion, since it all depends on whether the person who deleted the file did a complete erase or just emptied the recycle bin.

I think in SR4, many OS's, especially those used by corps, would automatically do a secure delete. Less secure systems it would only happen if the person was being extra careful.

Of course, we have no idea how data is stored in SR4, whether optical memory leaves recoverable data when you erase it...

But it all comes down to whether the GM wants you to have the data, or maybe part of the data if you could only recover some, or if the game would be more interesting if you can't get it that easily.
Kesslan
Even if for some reason one were to allow it to be possible. It should NEVER be easy. IRL it's possible, I mean if your HD gets physically damanged you can generally recover at least -some- data from it. But it's not only horribly expensive, but alot of specialty equipment is often required. And it's -not- easy to do.

Generally though, simply due to the very high level of matrix based crime by 2070 I would assume something as simple as a 'secure delete' would be a basic common function.
Rotbart van Dainig
As long as 'deleted' means not 'overwritten' - yes, he can, using the Medic utility.
As long as there are backups/copys out there, he can, too... well, not directly. wink.gif
hobgoblin
the reason why you can recover today are twofold.

first of, magnetic media can hold a "echo" of the magnetic "signal" that makes up a file. this is what companys like ibas base their recovery prosess on.

secondly, most file systems only delete the reference to a file when you tell it to delete it. its similar to removing the card that says where a book is stored in a library but not removing the book itself.

only when a new file is written is said area used. and even then the echo part still holds (supposedly one can recover data even after 7 overwrites or there about).

for rewriteable CDs and DVDs its a different story. there the physical material changes shape after each write, so recovering from that may well be harder. data on a damaged cds and dvds however can be recovered as the file system used on them have built in redundant data. basically it stores the same data on multiple locations, and use math to check the validity of it to. so there it becomes a question of accidental vs deliberate deletion.

same with flash memory as its based on similar principles iirc. thats why you can wear out a usb stick if you insist on writing to the same bit each and every time.
TheOneRonin
As Robert van Dainig put it, any 2-bit company worth their nuyen will have backups...and probably offsite storage as well. The #1 most important job of a network admin is data integrity. Deleting a file from a host should never end up as more than a minor inconvenience for a corp.

IT Sec Officer: "Sir, someone hacked our New Orleans host last night and deleted all files pertaining to the Project Restoration proposal! What do we do?"

IT Admin: "See if you can recover the tree from Shadowcopy. If not have the Vienna and Sydney offices pull the data from their replication hosts. If that ends up taking too long, run downtown to the Offisite Data Storage complex and recover the chips from last night's backup."



And that's how my company of 200 employees does it. I seriously doubt that data deletion would be any more of an inconvience in 2070.

Data alteration on the other hand....
Lovesmasher
QUOTE (TheOneRonin)
As Robert van Dainig put it, any 2-bit company worth their nuyen will have backups...and probably offsite storage as well. The #1 most important job of a network admin is data integrity. Deleting a file from a host should never end up as more than a minor inconvenience for a corp.

IT Sec Officer: "Sir, someone hacked our New Orleans host last night and deleted all files pertaining to the Project Restoration proposal! What do we do?"

IT Admin: "See if you can recover the tree from Shadowcopy. If not have the Vienna and Sydney offices pull the data from their replication hosts. If that ends up taking too long, run downtown to the Offisite Data Storage complex and recover the chips from last night's backup."



And that's how my company of 200 employees does it. I seriously doubt that data deletion would be any more of an inconvience in 2070.

Data alteration on the other hand....

Also, for every admin or corp-hacker on a system, you've probably got 5 middle managment and 10 lower level functionaries who are constantly messing stuff up, just like today.

Ares Corp Hacker: "Ares IT. Explain quickly."
Mr. Johnson: "I broke my cupholder."
Ares Corp Hacker: "Security, this is Hacker 445, I need a 'clean up' on employee number J88342 immediately please."
Security Agent: "Hacker 445, I thought we asked you to stop issuing orders to kill employees."
Rotbart van Dainig
QUOTE (hobgoblin)
the reason why you can recover today are twofold.

first of, magnetic media can hold a "echo" of the magnetic "signal" that makes up a file. this is what companys like ibas base their recovery prosess on.

Peter Gutmann's theory is based on the idea that the area magnetic information is written to is not the whole storage area reserved for - and thus, this tolerance would allow you to see previous writes under a REM.

Even though this may be true for select bits in laboratoy conditions, it becomes useless on the large scale:
The average hard-drive a) has had enough write cycles to make that residue data essentially random and b) this tolerance is decreasing every day, especially with perpendicular recording.
Draug
Anyone here played Half-Life 2? Valve had their source code stolen, and they had to start all over, didn't they? It's sort of in line with this stuff anyway...
Rotbart van Dainig
QUOTE (Jarl)
Anyone here played Half-Life 2? Valve had their source code stolen, and they had to start all over, didn't they? It's sort of in line with this stuff anyway...

..and the dog ate their homework, too.
James McMurray
I would base it on the system and user rights. Joe Schmoe's commlink or desktop is going to be "helpful" for him and not permanently delete files. That way when he screws up and deletes the million nuyen proposal It can still retrieve. However, anyone with power user rights or higher would have the ability to purposefully permadelete things, as well as the ability to set it up so that permanent is the default.
hobgoblin
QUOTE (Lovesmasher @ Dec 12 2006, 04:58 PM)
QUOTE (TheOneRonin @ Dec 12 2006, 09:31 AM)
As Robert van Dainig put it, any 2-bit company worth their nuyen will have backups...and probably offsite storage as well.  The #1 most important job of a  network admin is data integrity.  Deleting a file from a host should never end up as more than a minor inconvenience for a corp.

IT Sec Officer: "Sir, someone hacked our New Orleans host last night and deleted all files pertaining to the Project Restoration proposal!  What do we do?"

IT Admin: "See if you can recover the tree from Shadowcopy.  If not have the Vienna and Sydney offices pull the data from their replication hosts.  If that ends up taking too long, run downtown to the Offisite Data Storage complex and recover the chips from last night's backup."



And that's how my company of 200 employees does it.  I seriously doubt that data deletion would be any more of an inconvience in 2070.

Data alteration on the other hand....

Also, for every admin or corp-hacker on a system, you've probably got 5 middle managment and 10 lower level functionaries who are constantly messing stuff up, just like today.

Ares Corp Hacker: "Ares IT. Explain quickly."
Mr. Johnson: "I broke my cupholder."
Ares Corp Hacker: "Security, this is Hacker 445, I need a 'clean up' on employee number J88342 immediately please."
Security Agent: "Hacker 445, I thought we asked you to stop issuing orders to kill employees."

ah, thats pure BOFH material rotfl.gif
Serbitar
easy solution:

- deleting something by just erasing the file entry is threshold 1
- deleting something by overwriting it several times is threshold 2-3

So you have both and the option to have a "somebody forgot to overwrite it" in your story line.
Draug
Me likes it. Nice, easy fix.
Rotbart van Dainig
QUOTE (Serbitar)
- deleting something by overwriting it several times is threshold 2-3

Sr4 uses solid state storage... so 'overwritten' means 'gone for good'.
Digital Heroin
QUOTE (Rotbart van Dainig)
QUOTE (Serbitar @ Dec 13 2006, 03:39 AM)
- deleting something by overwriting it several times is threshold 2-3

Sr4 uses solid state storage... so 'overwritten' means 'gone for good'.

Care to cite a source for that?
kzt
QUOTE (Rotbart van Dainig)
Sr4 uses solid state storage... so 'overwritten' means 'gone for good'.

And solid state means unrecoverable because of exactly what?

"FlashBack™ data recovery can recover files from all types of flash media that have been lost due to system or battery failure, format or deletion and corruption caused by hardware or software malfunction. FlashBack™ data recovery services can take any digital film card, CompactFlash, SmartMedia, Memorystick, Multimedia Card (MMC), SecureDigital card (SD), IBM Microdrive, ATA PC card, Linear Flash card, Minidisks, Mavica CDs, Kodak Picture disk, Kodak CD; from any manufacturer, and using sophisticated software and hardware tachniques, recover lost images, documents or other important data stored on a removable flash device."
ShadowDragon8685
QUOTE
Ares Corp Hacker: "Ares IT. Explain quickly."
Mr. Johnson: "I broke my cupholder."
Ares Corp Hacker: "Security, this is Hacker 445, I need a 'clean up' on employee number J88342 immediately please."
Security Agent: "Hacker 445, I thought we asked you to stop issuing orders to kill employees."


Completely OT, but this opens the door to the "IT guys and the morons they have to deal with" comedy, 2070 style.
hyzmarca
I have this nice little portable shredder program that I carry around on a memory stick for when I have to use public computers. 25 overwrites later and the data is gone. It is far more useful than deleting from the recyce bin, especially since permission to empty the recycle bin can be denied in some cases and using a portable program is far more convenient than hacking an admin account (although this is trivial on an XP machine due to the fact that the passwords are not encrypted).
Lovesmasher
QUOTE (ShadowDragon8685)
QUOTE
Ares Corp Hacker: "Ares IT. Explain quickly."
Mr. Johnson: "I broke my cupholder."
Ares Corp Hacker: "Security, this is Hacker 445, I need a 'clean up' on employee number J88342 immediately please."
Security Agent: "Hacker 445, I thought we asked you to stop issuing orders to kill employees."


Completely OT, but this opens the door to the "IT guys and the morons they have to deal with" comedy, 2070 style.

I'm considering playing my next hacker as Nick Burns: Your Company's Computer Guy.

http://www.youtube.com/watch?v=R7RuolTf9ho
Kesslan
QUOTE (Lovesmasher)
QUOTE (ShadowDragon8685 @ Dec 12 2006, 11:20 PM)
QUOTE
Ares Corp Hacker: "Ares IT. Explain quickly."
Mr. Johnson: "I broke my cupholder."
Ares Corp Hacker: "Security, this is Hacker 445, I need a 'clean up' on employee number J88342 immediately please."
Security Agent: "Hacker 445, I thought we asked you to stop issuing orders to kill employees."


Completely OT, but this opens the door to the "IT guys and the morons they have to deal with" comedy, 2070 style.

I'm considering playing my next hacker as Nick Burns: Your Company's Computer Guy.

http://www.youtube.com/watch?v=R7RuolTf9ho

Nah I prefer the hacker trying to get the corp J wacked.

THough back OT though..
Thats the one thing I allways found 'off' about the average job where you go in, wipe the data. Cause you'd have to trace the remote backups, and all the hard copy backups. I actually do that sort of thing IRL. Monitor the network, handle the hard copy backups, and just in this one building we wind up with a minimum of two sets just in this one building.

We also do backups of no less than something like 10 other sites, and they do their own backups ontop of that. So if you wanted to destroy all the data backups you'd litterally have to hit something like 5 buildings spread across all of north america.

Arguably it could still be done if you went right to the source -before- it got backed up, but anything of great value is backup in stages anyway, so then the next best bet is making subtle alterations to the files.

In the end that really means that unless it's a very small company you couldnt very easily 'destroy' research like that. THough the flipside is you could hire 5 groups of runners, and have each of them hit the sites around the same time, still making it possible. But then there's five times as many things to go wrong.
Serbitar
QUOTE (Rotbart van Dainig)
QUOTE (Serbitar @ Dec 13 2006, 03:39 AM)
- deleting something by overwriting it several times is threshold 2-3

Sr4 uses solid state storage... so 'overwritten' means 'gone for good'.

Thats the intention.
Kesslan
Personally I dont argue why something is permently deleted in SR when you go to the data and say.. YOU DIE NOW! and the data goes *AIIEE!!* and dies.

What of course I do question, is why the hell the corp has no backups? Of course some GMs I've played under very much take this into consideration and I've had more than afew 'simple' runs go bad because we thought the security footage was kept onsight, and it may well have been, but it was also at the same time transmitting to a secondary backup site that was guarded like fort knox.

Of course if you want to handle it all easily you can just work under the assumption that the center your characters are hitting is simply the last remaining bastion of that stored data and the J is hring you to take it out. Or that it's just one of several and he's hired others to hit the other sites the same day. Or maybe he's infact hiring you to hit all the locations, you infact see some of this in the SR3 souce/adventure books.

I'm sure alot of stuff is ultimately just ignored etc since it would really be far too complex to worry about, and far simpler and overall fun for the average gamer to just ignore all these little tiny details. Otherwise you wind up with a super detailed system that hardly anyone understands. SR3 sort of suffered from this, between special rules for vehicles, magic, matrix and standard combat. I've found it's very common to run across people (And hey I'm one of those) who's knowledge of a certain area of rules is hazy at best, and totally non existant at worst (For me it's with some of the magic rules I'm -still- hazy about with SR3)

SR4 just basically goes and does what SR3 suggested GMs do and thats implement a quick and dirty matrix/rigger set of tests to handle the day to day tabletop interaction so that hacking that maglock via the matrix doesnt take 1 hour to do, and instead represetns X ammount of time in game world, and is handled quick and dirty via a simple test (With advanced rules to come out later for those that want them)

Rotbart van Dainig
QUOTE (kzt)
QUOTE (Rotbart van Dainig)
Sr4 uses solid state storage... so 'overwritten' means 'gone for good'.

And solid state means unrecoverable because of exactly what?

Because there isn't even the theoretical residue data due to write head tolerances.

Overwritten means exactly that: Different data has been written to the specific location.
Deleting Data just means removing the file table entries, thus the data stays... until being overwritten randomly.

So it's perfectly possible to recover accidently deleted files on a thumb drive - but once you filled it again with something else, it is gone.
KarmaInferno
I'd add modifiers for the amount of time between deletion and recovery.

The longer you wait the more chance the area will be overwritten randomly.

Conversely if you engage recovery just seconds after the delete there should be a very good chance of recovering most of the file.


-karma
hobgoblin
about data destruction missions:

it could also be that what the J is doing isn't trying to force a permanent loss of R&D, but a setback so that his employer can then get a product to market first.

and a data destruction is so much cleaner then a firebombing or similar, as if its done right cant be seen as a criminal action at first glance.
Blog
Cause if there wasnt a way to 'win' it wouldnt be a fun game.

But yea IRL. There is undelete, backups galore, redundancy.

in SR memory is rather cheap, so I can see 'portable drives' locked in a firesafe somewhere. Heck my backups are a collection of Tapes, DVD, CD, USB sticks, disconnected harddrives.

But how fun would that be in the game if all your work would mean nothing. So lets stretch reality a little bit.

Or look at it this way. Lets say that normal deletes (by general uses) do have a trash can of sorts where undelete can happen. However when a hacker wants that file dead. Its not only a deletion, but some additional countermeasures to 'search and destroy' all copies when they are accessed.
hobgoblin
QUOTE
But how fun would that be in the game if all your work would mean nothing.


who cares as long as the J pays up?
ShadowDragon8685
QUOTE (hobgoblin)
QUOTE
But how fun would that be in the game if all your work would mean nothing.


who cares as long as the J pays up?

You will, because you took his nuyen.gif and didn't render services.

At the best, he blacklists you and trashes your rep. At the worst, he sends headcrackers after you.
Kesslan
QUOTE (ShadowDragon8685)
QUOTE (hobgoblin @ Dec 15 2006, 10:47 AM)
QUOTE
But how fun would that be in the game if all your work would mean nothing.


who cares as long as the J pays up?

You will, because you took his nuyen.gif and didn't render services.

At the best, he blacklists you and trashes your rep. At the worst, he sends headcrackers after you.

Yeah, I mean it's one thing if the J says I need data on sever X destroyed. OK.. done!

J: Did you get the backups?

Runners: The contract, did not include us having anythign to do with the backups, so no. In the future, perhaps you should take that into consideration, as it would seriously increase the cost of you hiring us to do the job.

The J Could still crap on your rep, but you'd be quite right in pointing out that you did infact fufill the job as it had been stated.
Moon-Hawk
Well, yeah, but, I've never had a Johnson who didn't say "Destroy all copies of X files" for this very reason. The only time the above situation should come up is if the Johnson is a total n00b. Which I freely admit will happen sometimes, but in that case he's hardly in a position of trashing the runners, what with him being a total n00b and all. smile.gif
Butterblume
QUOTE (Moon-Hawk)
Well, yeah, but, I've never had a Johnson who didn't say "Destroy all copies of X files" for this very reason.

This screams for a johnson who, after the run, pulls out his copy of the files and says
I can't pay you, you didn't fullfill your contract - there are still copies out there spin.gif

My char would insist that the Johnson specifies how many copies there are, and where they are kept. Or the Johnson has to say 'Find and destroy all copies", which would result in much better payment.
Moon-Hawk
QUOTE (Butterblume)
QUOTE (Moon-Hawk)
Well, yeah, but, I've never had a Johnson who didn't say "Destroy all copies of X files" for this very reason.

This screams for a johnson who, after the run, pulls out his copy of the files and says
I can't pay you, you didn't fullfill your contract - there are still copies out there spin.gif

My char would insist that the Johnson specifies how many copies there are, and where they are kept. Or the Johnson has to say 'Find and destroy all copies", which would result in much better payment.

Okay, that crap will get the J shot. Don't taunt the sociopaths you're hiring! wink.gif

As for the second, yeah, find costs extra, but Mr. J wants the job done right, right? cool.gif
Konsaki
If the johnson left such open ended objectives and pulled that crap of pulling out a chip with the info to deny payment, he would get a bullet in the brain or something to that effect... Problem with open ended objectives like that is it would be akin to saying plant enough trees until you stop global warming...
Negotiation rolls should be factored in to keeping the Johnson from pulling shit like that...
Rotbart van Dainig
QUOTE (Moon-Hawk)
Well, yeah, but, I've never had a Johnson who didn't say "Destroy all copies of X files" for this very reason. The only time the above situation should come up is if the Johnson is a total n00b.

On the contrary - I never had a Johnson demanding more than to destroy data at specific locations.
Everything more is just wishfull thinking - once something goes digital, it's really hard to exterminate. (Just ask DEUS...)
Drraagh
May be a little off topic, and also ressurecting a dead horse as it were, but I just stumbled on this and had an interesting thought.

I worked for this one company that backed up their data in two locations; once daily to a secondary system and once weekly to a secure off-site system. So, if their main backup went down, they only lost a few days work. However, there was one guy who would print out any changes he did as well, just in case the worst happened and he lost something important.

Now, what I can see happening in Shadowrun is a decker deleting all traces of a file (perhaps the delete command does deleting that instance and then goes recursive to try and find other copies. Sort of like the rm -rf unix joke, though not as deadly). So, now the company is left with no backups since they lost everything. However, you've got some guy who printed off some relevant parts of the information. Just imagine having to re-enter that. You'ld either be moving page by page over OCR or entering it by hand. nyahnyah.gif However, it would make a good backup system, though it would take time to recover so corps would fall behind.
hobgoblin
rm -rf would only be deadly if followed by a /. and if done inside someones brain...

thats all iirc btw...
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.
Dumpshock Forums © 2001-2012