Tuesday, 20 January 2009

A response to Dr Gutmann

In his paper, Dr Gatmann has added a refutation to my work without having read it. This is to answer some of his unfounded claims. Much of what he has stated is taken out of context from a SANS Forensic Blog post on the paper.

I know an MFM is not actually an electron microscope, the comment is "A MFM is a variety of what most people simply term an electron microscope." However, as an SEM (a scanning electron microscope) was used in MFM mode, the use of the term electron microscope is valid.

There is a series of posts that will go into detail coming over the following weeks that I am posting on the SANS Forensic site. This will also incorporate the use of Spin-Stand Microscopy.

At NO point did I state that the experiment used "an MFM to perform an error-cancelling read." Rather, the MFM was used to read BOTH track and off-track data.

One area that we demonstrate is that the assertion, "in conventional terms, when a one is written to disk the media records a one, and when a zero is written the media records a zero. However the actual effect is closer to obtaining a 0.95 when a zero is overwritten with a one, and a 1.05 when a one is overwritten with a one." Made by Dr Gutmann is false. This is demonstrably not the case. This is noted in the peer reviewed paper that Dr Guitmann has not as yet read.

True, all the drives I tested are either PRML or ePRML. I was unable to obtain an unused RLL based drive - not a single one. Old used ones yes, new ones, no. In section 3, Dr Gutmann does note PRML drives (contrary to what he states in his rebuttal).

I used MFM based methods and some spin-stand techniques. The point is that it can be demonstrated that data recovery is stochastic and independent. This means that you may be able to recover individual bits and encoded sections, but you do not obtain any data recovery. Recovery of a bit is not the same as data recovery.

I do not believe that recovery of an RLL based drive from the 1990's would be successful. Yes I do say that bits could be recovered, but again, the issue is that this is not data recovery. Assuming that the occasional success equals data recovery is the flaw in Dr Gutmann's paper.

Springer has the copyright for the paper. The link to the paper at Springer is:

Dr Gutmann's work is not science. There is no experimental verification of anything he has purpored in his paper. To be a valid scientific paper, Dr Gutmann would need to quantify the recovery reats for pre and post wipe data recovery. This is not a single encoded message, but actual data. This was never done.

What was presented as science was a hypothesis and no more. More it is a hypothesis that does not hold.

No comments: