Deleting files

The way I understand it, the file is basically deleted in the sense that the OS cannot recover it through any normal means. Physically, though, the hard drive sectors are not ''deleted'' or ''wiped clean''. That''s why sector-scanning programs are able to "undelete" files.

However, you can obtain data recovery programs that will recover files after they have been wiped out from deletion or a crash. The undisputed uber-program in this category is Spin Rite . Gibson Research Corporation does impressive stuff.

Deleting a file off your computer does not mean you are actually clearing the bits of data that make up that file; you''re merely removing a "pointer" which points to the file''s location on the hard-drive. The location of the file''s data is recognized as writeable space, thus in time it will eventually be overwritten.

In order to truely "delete" a file, you will usually have to zero out the file multiple times (usually writing patterns of 0''s and 1''s to it). The government uses a standard (I can''t recall what it is) for zeroing and deleting files.

In some cases, old data can be found by use of software utilities that look for data on the hard-drive that is not linked to any pointers.

In other cases, data recovery requires the aid of a 3rd party company that uses various expensive technologies (magnetic level reading, etc)..these companies also cost many a pretty-penny for their services.

---

swift URL | browse my bookmarks [server may not always be on]

Sensimed | Info/download

quote:

---

In order to truely "delete" a file, you will usually have to zero out the file multiple times (usually writing patterns of 0''s and 1''s to it). The government uses a standard (I can''t recall what it is) for zeroing and deleting files.

---

Interesting. Why does it have to be done multiple times? Once isn''t enough? Does the government have special programs that "zero" space that isn''t pointed to?

I''m not completely sure as to why, but using multiple passes of various patterns, followed by a "cleansing" sweep of all zeroes is a relatively effective method.

If for no other reason, a few passes is better than one.

Also, other methods for totally erasing data are writing "junk" data to the file (how many times is speculative), followed by the final pass of writing zeros.

Oh, here''s a site I just found with some more in-depth information on the topic:

"Ho To Permanently Erase ALL DATA from a Hard Disk Drive"

---

swift URL | browse my bookmarks [server may not always be on]

Sensimed | Info/download

If I''m not mistaken there''s a faint magnetic residue left from a file even when it''s been zeroed. To wipe this residue clean beyond the ability to recover, you need to zero it over seven times.
Or something like that, Norton has a tool that will wipe information permanent-like.

-This is where the world drops off
-ryan@lecherousjester.com

Wow, I had no idea how much stuff you''d have to do to really delete a file. Some of these programs I''ve seen go to all kinds of lengths. Deleting temp files, internet browswer cache, swap files, cookies, etc.

So which would be better for security? A "clean up my computer after me" program that does it all, or using an encrypted file system? I don''t even know how you get an encrypted file system, but I''ve heard of them. Dunno if it''s even related to this.

Encrypted filesystem (if you find one) sounds safe if you use big enough encryption key. But on negative side it would slow down HD access quite a bit.

What comes to these "cache cleaning", etc, programs, they will work if you want to hide information from your computer illiterate mom/dad, etc.. But if you have some really sensitive ($$$) information, and can assume that someone (very professional) out there is after it, then it''s probably better to go for some strong encryption, or other stronger methods of hiding/erasing data.

quote:

---

Original post by Run_The_Shadows
If I'm not mistaken there's a faint magnetic residue left from a file even when it's been zeroed. To wipe this residue clean beyond the ability to recover, you need to zero it over seven times.
Or something like that, Norton has a tool that will wipe information permanent-like.

-This is where the world drops off
-ryan@lecherousjester.com

---

The reason it *might* still be recovered after a single pass is because the read/write head of the harddrive is not 100% accurate. Imagine that the head goes along dropping big round colorful stickers (magnetic dots) to represent 1s and 0s. When a 1/0 in the file is written a sticker is dropped in one place. When the file is overwritten a new sticker is dropped in *approximately* the same place, however it is likely that it's not dead center, and so a bit of the old sticker would be sticking out at the edge. The harddrive head can't detect it because the radius of the stickers is much larger than its margin of error, but with a clean lab and expensive equipment you could. Multiple passes do two things: one is that they help account for the margin of error by brute force (dumping 6 or 7 stickers), and two is that it simply makes it harder to pick out which is the tiny bit of original sticker within all that noice.

[edited by - michalson on December 27, 2002 8:30:08 AM]

Slightly offtopic, but if you decide to use NTFS encryption, be sure to remove the encrypt attribute from your data before reinstalling Windows or deleting a user. Files with the encrypt attribute can only be accessed from the user under which it was encrypted (the owner of the file maybe?).

FYI: sysinternals.com makes available a file shredder utility and also provides a source code sample to demonstrate how the shredding is done.

---

"Beautiful maiden," answered Candide, "when a man is in love, is jealous, and has been flogged by the Inquisition, he becomes lost to all reflection."

Michalson, that''s such a clear analogy Good one.

When you delete a file, will that space be the first to be overwritten once you create a new one? When you defrag your computer does it seperate untouched free memory space from deleted memory space? Also, is it faster to write to new memory space than freed memory space?

[edited by - manastone on December 28, 2002 2:14:20 PM]

Wouldn''t the Swap file over write the file pretty quickly ?

On my Macintosh, I have (as part of the PGP series of cryptotools) a program called Wipe. What it does is overwrite a certain file with 1's and 0's over and over (the number is user-specifiable) hence making it hard or impossible to recover the file.

It should be noted that pre-OS X Macintosh operating systems do not use a swap file, and as such do not need it to be blitzed. OS X and later (as well as most *nixen) need you to wipe their swap partitions just in case there's something in there that's must-delete-this-file-within-the-next-10-minutes-or-be-killed.

Of course, the best way to get rid of data is the Magnetic Doorframe trick (as seen in Neal Stephenson's Cryptonomicon).

Resist everyone
Talk on RavForum(tm)


[edited by - ravuya on December 28, 2002 5:59:54 PM]

Is that why computers'' boot times get longer and longer over time?

---

tcache
Contact Me
-----------
Games don''t affect kids. If Pac-man had affected us, we''d all be sitting in darkened rooms munching pills and
listening to repetitive electronic music. -- Kristian Wilson(Nintendo Inc., 1989)

No.

quote:

---

Original post by vtwin
The government uses a standard (I can''t recall what it is) for zeroing and deleting files.

---

I do not know the name of the standard either, but I know what it does.

When a file that the government does not want seen is deleted, they use a variety of methods to ensure that it will not be retrievable. Methods are renaming the item to a random value, overwriting it with random data 7 times, and truncating the item''s length to zero (to make it impossible to tell where the file''s data starts and stops).

Iolo''s System Mechanic provides a nice program called Incinerator that will do this for you. Even better, you can have it overwrite the file with random data up to 10 times, making beyond government quality in erasing files.

-Boco