Tag Archives: information
When Software Cant Help: SSD, Cloud and Online Services
In the first part of the article, we took a look at programs for recovering data from traditional hard drives. In this second part of the series “When Software Cant Help” well talk about flash-based (solid-state) storage, cloud storage systems and online storage services.
Solid-State Drives (SSD)
Solid-state drives are often used in place of traditional hard disks. SSD drives offer smaller capacities but much higher speed, especially when random access speed is concerned. With no moving parts, SSD drives are more robust mechanically. They can withstand higher shocks, which makes them particularly great for portable applications. Another laptop-friendly feature is a much lower power consumption compared to magnetic hard drives.
SSD drives do come with their share of issues affecting data loss and data recovery situations. These issues are highly dependent on the ways SSD drives record information. With SSD drives, recovering a file deleted a few minutes ago is far from a given. Same goes for formatted disks; however surprisingly, corrupted SSDs may be recovered just as well as traditional hard drives. But lets elaborate.
Why Recovering Deleted Files from SSD Drives May Not Work
All fairly recent SSD drives implement a special set of procedures allowing them to optimize their writing performance. These procedures include background garbage collection and TRIM.
Why do SSD drives need garbage collections and magnetic hard disks dont? Because flash chips have much faster clear writes compared to erase-then-write times. In other words, flash cells that contain information need to be erased (emptied) before new information can be written in, and that erase process is very slow compared to plain write operation. In order to speed up the writes, solid-state disks erase flash cells occupied with deleted information in background. When the system needs to write anything on the disk, the write operation then has enough empty cells to complete quickly.
How does the disk know a particular sector becomes available? The operating system tells the drive via the TRIM command. The TRIM command is issued every time the system deletes a file or formats a volume. The drive will then add released sectors into the garbage collection queue, wiping their content with zeroes slowly but inevitably.
Remember why data recovery works? Windows itself does not wipe or erase the content of a file being deleted, but simply marks its disk space available. Well, this is not the case with SSD drives anymore: SSD drives will wipe available disk sectors in just a few minutes after a file is deleted.
When SSDs Can Be Recovered
SSD recovery may still work if the TRIM command was not issued. This could be the case if any one (or more) of the following is true:
Old version of Windows. Windows versions before Vista did not support TRIM, so SSDs behave pretty much like magnetic hard drives, and can be recovered.
Corrupted data. In a case of corrupted data, damaged file system and similar things, the TRIM command is not issued, and the files remain recoverable.
External SSD drive. SSD drives connected via a USB, FireWire or Ethernet port do not support the TRIM command, and can be recovered with data recovery software.
RAID arrays. TRIM is not supported in RAID configurations.
File system other than NTFS. At this time, Windows only supports TRIM on NTFS-formatted SSD drives. If your SSD drive uses a different file system, the TRIM command is not issued, and the drive remains recoverable.
Tools for Recovering Data from SSD Drives
In order to recover information from an SSD drive, you can use data recovery tools such as Hetman Uneraser, Hetman Partition Recovery, or Hetman Photo Recovery depending on your exact needs. Try Hetman Uneraser if youre recovering from a healthy drive that has not been formatted or repartitioned. If you did format or repartition your SSD drive, or if you have an inaccessible device with corrupted file system, use Hetman Partition Recovery.
Cloud Storage and Online Services
Cloud storage systems are gaining popularity among all kinds of users. Online backups, online photo albums (Flickr, Picasa), online file sharing and online document processing (Google Docs) are all over the place.
They are great as “Desktop”, “Mobile phone” or “My Documents” backups, perfect as redundant storage, and absolutely irreplaceable for sharing information and socializing. However, cloud storage systems are not exactly great as your primary storage. In other words, if you want to replace a big hard drive with an Amazon cloud storage account take a second look.
Granted, cloud storage systems are not susceptible (or much less susceptible than single-hard-drive solutions) to hardware faults and virus attacks. They are usually quite redundant and have excellent self-backup facilities. Your data may be safe there for a while.
Relying exclusively onto a cloud-based storage means giving up complete control over your information. Your data will be subject to someone elses policies (which may change without notice). The amount of storage space available may be limited, while plans allowing larger than a single hard drives worth storage space may cost you more than the cost of a similarly sized hard drive, per month.
Finally, if you delete a file, or if your entire account is compromised and wiped by a hacker, there is no recourse. No data recovery tool can restore deleted information from the cloud. This is a classical case where data recovery tools do not help.
5 Website Security Issues You Should Be Aware Of?
Technology has become more advanced, and with it, hack attacks in the online world are increasing at an alarming rate.
Hackers use known vulnerabilities in third-party softwares to target your website and web server, and use it for their advantage.
The effect of this maybe just defacing of your website, stealing your confidential client data, or even worse, use your server resources to perform illegal activities.
There are some simple tips you can leverage to strengthen your website software and sleep with peace of mind.
- XSS or Cross Site Scripting
- SQL Injection
- DoS or Denial of Service Attack
- Weak Passwords
- Brute-force Attack
- Code Injection
- Unencrypted Protocol
- Debug Mode on Production Server
- Old Software Versions
- No Backup Plan
XSS occurs when a hacker embeds scripting code into a web form or url, and run malicious code to change your web visitor’s experience and steal passwords or other data.
XSS can also be persistent nature, where an attacker can manipulate a specific web page and show it as a login screen to users. The recent XSS comment hack on WordPress 4.2 is an example of such permanent loophole.
SQL injection occurs when a hacker uses a web form field or URL parameter to manipulate your database. Almost all web platforms have a database and generally open source CMS platforms maintain dynamic aspects of the website in database.
Denial of Service (DoS) or Distributed Denial of Service (DDos) attacks are by far the most notorious kinds of attacks.
That is because, any level of hacker with a small investment can bombard a victim website, with millions of requests, and make them look like they are legit users.
This eventually crashes the web server, and makes the site offline, requiring manual intervention to bring it back online.
We should all use complex passwords, because the weakest link is all it takes to break the chain. It is imperative to use strong passwords for admin areas, but equally important for all users to protect the security of their accounts.
One account compromised can lead to another and that could lead to admin account hacked. It is recommended to have passwords with minimum 8 letters, digits and special characters to avoid quick password guesses.
These attacks are trial-n-error methods to guess your username and password. Weak passwords are prone to getting hacked easily.
Methods like temporary blocking of IP and accounts, and multi-factor authentication, help mitigating such attacks.
Websites with file upload capability, or sites missing proper client and server side form validation, can be dangerous.
The risk is that any file uploaded, could contain a script which can be leveraged as root-kit ie. administrator access to your website.
Lack of form validation on simple form fields could lead to malicious code being inserted into the database, and could cause undesirable results in your website.
An unencrypted channel allows man-in-middle attack to steal information from your users.
It preferred to use security certificate SSL, whenever passing personal information between the website and web server or database.
Some developers may accidentally enable debug mode on the live production server, which dumps extensive error logs to the browser.
Thus a hacker can obtain valuable information about the softwares used by the webserver and target his attack much better. Its crucial to hide as much internal information about server to minimize and delay the attacks.
It may seem obvious, but ensuring you keep all software up to date is vital in keeping your site secure. This applies to both the server operating system and any software you may be running on your website such as a CMS or forum.
When website security holes are found in software, hackers are quick to abuse them.
No matter how much vigilant you are, attackers can find new loopholes to doom your website. So besides prevention, you should also have a backup-restore plan.
Just in case your site is compromised, you should have a team which can quickly restore the last known backup, and avoid reputation and sales loss.
Coversine provides a simple affordable solution to all these problems. Your own security professional who will maintain your site’s uptime, performance and security, all-in-one for as low as $10 per month.
The subscription takes care of performance checks, and regular updates to softwares and apps as well.
5 Website Security Issues You Should Be Aware Of?
Technology has become more advanced, and with it, hack attacks in the online world are increasing at an alarming rate.
Hackers use known vulnerabilities in third-party softwares to target your website and web server, and use it for their advantage.
The effect of this maybe just defacing of your website, stealing your confidential client data, or even worse, use your server resources to perform illegal activities.
There are some simple tips you can leverage to strengthen your website software and sleep with peace of mind.
- XSS or Cross Site Scripting
- SQL Injection
- DoS or Denial of Service Attack
- Weak Passwords
- Brute-force Attack
- Code Injection
- Unencrypted Protocol
- Debug Mode on Production Server
- Old Software Versions
- No Backup Plan
XSS occurs when a hacker embeds scripting code into a web form or url, and run malicious code to change your web visitor’s experience and steal passwords or other data.
XSS can also be persistent nature, where an attacker can manipulate a specific web page and show it as a login screen to users. The recent XSS comment hack on WordPress 4.2 is an example of such permanent loophole.
SQL injection occurs when a hacker uses a web form field or URL parameter to manipulate your database. Almost all web platforms have a database and generally open source CMS platforms maintain dynamic aspects of the website in database.
Denial of Service (DoS) or Distributed Denial of Service (DDos) attacks are by far the most notorious kinds of attacks.
That is because, any level of hacker with a small investment can bombard a victim website, with millions of requests, and make them look like they are legit users.
This eventually crashes the web server, and makes the site offline, requiring manual intervention to bring it back online.
We should all use complex passwords, because the weakest link is all it takes to break the chain. It is imperative to use strong passwords for admin areas, but equally important for all users to protect the security of their accounts.
One account compromised can lead to another and that could lead to admin account hacked. It is recommended to have passwords with minimum 8 letters, digits and special characters to avoid quick password guesses.
These attacks are trial-n-error methods to guess your username and password. Weak passwords are prone to getting hacked easily.
Methods like temporary blocking of IP and accounts, and multi-factor authentication, help mitigating such attacks.
Websites with file upload capability, or sites missing proper client and server side form validation, can be dangerous.
The risk is that any file uploaded, could contain a script which can be leveraged as root-kit ie. administrator access to your website.
Lack of form validation on simple form fields could lead to malicious code being inserted into the database, and could cause undesirable results in your website.
An unencrypted channel allows man-in-middle attack to steal information from your users.
It preferred to use security certificate SSL, whenever passing personal information between the website and web server or database.
Some developers may accidentally enable debug mode on the live production server, which dumps extensive error logs to the browser.
Thus a hacker can obtain valuable information about the softwares used by the webserver and target his attack much better. Its crucial to hide as much internal information about server to minimize and delay the attacks.
It may seem obvious, but ensuring you keep all software up to date is vital in keeping your site secure. This applies to both the server operating system and any software you may be running on your website such as a CMS or forum.
When website security holes are found in software, hackers are quick to abuse them.
No matter how much vigilant you are, attackers can find new loopholes to doom your website. So besides prevention, you should also have a backup-restore plan.
Just in case your site is compromised, you should have a team which can quickly restore the last known backup, and avoid reputation and sales loss.
Coversine provides a simple affordable solution to all these problems. Your own security professional who will maintain your site’s uptime, performance and security, all-in-one for as low as $10 per month.
The subscription takes care of performance checks, and regular updates to softwares and apps as well.