iajoe Posted January 26, 2004 Share Posted January 26, 2004 I keep hearing that deleted files can be read by others afterwards. What are they talking about? I thought they were gone, when they were deleted. Show me how to view my own deleted files. Quote Link to comment Share on other sites More sharing options...
b2cm Posted January 26, 2004 Share Posted January 26, 2004 Use an undelete program for that. Every system utility suite I know have that. For formatted drives, use a data recovery software, i.e. EasyRecovery, Lost & Found. Quote Link to comment Share on other sites More sharing options...
ibe98765 Posted January 26, 2004 Share Posted January 26, 2004 I think we went through this a while back here. Try doing a search.But no, files are not deleted. This is a simplified explanation of what is going on:A file takes some space (in bytes) on the hard drive. An address that the computer software understands tells where the file is saved on the hard drive. There is a master directory called the FAT (File Access Table) that points to the file at this address on the hard drive. Think of the hard drive as a file cabinet and the FAT is an index card that tells you in what draw and how far into the draw the file is, so you can find it when you need it.When a delete is done in DOS or Windows, all that happens is the first character of the file name in the FAT is changed to indicate that the space occupied by the file on the hard drive is available for use. The actual data in the file is still on the hard drive. Using the file cabinet idea, this would be the same as you crossing out that file name on your master index card but still leaving the actual file where it was.If you do a disk defragment, then these old "deleted" file remnants will "usually" get overwritten and the FAT index cleared up. Or you can use one of the file wipe products to truly erase the file. But remember, that the FBI/CIA/NSA, etc. is believed to be able to recover data even if it has been over-written a few times. Just in case this is important to you... Quote Link to comment Share on other sites More sharing options...
beeTee Posted January 26, 2004 Share Posted January 26, 2004 But remember, that the FBI/CIA/NSA, etc. is believed to be able to recover data even if it has been over-written a few times. Just in case this is important to you... yup, I believe you are correct, ibe. also, file recovery experts can also retrieve files after a format has been done to a drive. Any of you guru's know more about this?? I think its a great topic in itself.There is a great security suite available that includes a shred function. check out Steganos for full details on their security/encryption products.I know SuSE (at least) has a "schred" option. but I haven't had the time to explore it. Quote Link to comment Share on other sites More sharing options...
Grasshopper Posted January 26, 2004 Share Posted January 26, 2004 I think Fred Langa talked about this several months ago (or maybe longer ). He said that the only way to guarantee that your data is safe is to take the hard drive apart and break the platters. Hehe. 'Course that only applies to a dead drive... Otherwise, I think the sectors have to be rewritten several times before it becomes impossible to reassembled from undelete. I know Norton has (or used to have anyway) a program called WipeInfo and it had a setting for "government wipe." I think it overwrote the sectors a dozen times or something like that. Never used it so I don't know. Quote Link to comment Share on other sites More sharing options...
nlinecomputers Posted January 26, 2004 Share Posted January 26, 2004 I use Eraser to clean any used hard drives before I sell them. I've purchased used drives on E-Bay and found them intact with OS, personal data, p*rn, and even quicken records on them. Quote Link to comment Share on other sites More sharing options...
Guest LilBambi Posted January 26, 2004 Share Posted January 26, 2004 I use Eraser to clean any used hard drives before I sell them. I've purchased used drives on E-Bay and found them intact with OS, personal data, p*rn, and even quicken records on them.You are so right Nathan!I use Eraser as well. Works great for entire hard drives or on a per file/directory basis.Their site has a lot of great information on file deletion and what that means. Quote Link to comment Share on other sites More sharing options...
DaveyB Posted January 30, 2004 Share Posted January 30, 2004 The reason being that when you put somehing into the recycle bin it just tells the computer not to read that sector of the HDD anymore. The infomation is still there and will be there till you over write it, but if you wish to read it again. Well best not put that.. Might get in to trouble. But if you would like to know send me a PM. Quote Link to comment Share on other sites More sharing options...
Guest LilBambi Posted January 30, 2004 Share Posted January 30, 2004 I don't think he is referring to files in the Recycle Bin. Recycle Bin items are a catchall with ability to restore the files using the Recycle Bin features.I believe he is referring to files that have been deleted, not moved to the Recycle Bin.That is why we are suggesting he use a program like Eraser to how him the deleted files and be able to overwrite these deleted files with multiple passes using DOD specifications.iajoe, am I understanding you correctly, or were you actually referring to items in the Recycle Bin? Quote Link to comment Share on other sites More sharing options...
littlebone Posted January 30, 2004 Share Posted January 30, 2004 Spybot Search And Destroy (an ad-ware and spyware removal tool) also has a tool called "Secure Shredder" built into it. You can simply drag files to the shredding window, press "Chop It Away" and it will overwrite the file several times with a string of data. From Spybot's help file: Secure shredder tool Dictionary The secure shredder is a tool to get finally rid of files, without any further possibilities of recovery.Shredding is simple – drop some files from the explorer into the list (or add some using the context menu of the list), select the number of shreds, and click Chop it away.Usage tracks that are in files will be shredded using this tool, too, using 5 passes.The first 5 shreds are using pre-defined bit pattern that should make even hardware recovery impossible. Any further pass will use a random bit pattern that is changing every few Bytes.Please notice: one pass is not enough to shred a file, as the heads of your hard disk won't hit the same track 100,00% of the time. There are small differences of a few µm that will allow pros to reconstruct even overwritten data. That is why multiple shreds are necessary, and why different patterns should be used.Warning: This tool is designed to remove files so they can not be recovered again! If you use it, be aware of that!You do not need to use this tool to remove spyware or usage tracks. Spybot-S&D will take care of shredding them on its own.Disclaimer: I tried my best to finally shred every given to this tool. But I can't guarantee that files will be unrecoverably extinguished.You can find the secure shredder tool by choosing Secure Shredder from the Tools section in the toolbar to the left. Quote Link to comment Share on other sites More sharing options...
Guest LilBambi Posted January 30, 2004 Share Posted January 30, 2004 Yes, littlebone, that is a very nice feature in SpyBot S&D! Quote Link to comment Share on other sites More sharing options...
iajoe Posted January 30, 2004 Author Share Posted January 30, 2004 I don't think he is referring to files in the Recycle Bin. Recycle Bin items are a catchall with ability to restore the files using the Recycle Bin features.I believe he is referring to files that have been deleted, not moved to the Recycle Bin.That is why we are suggesting he use a program like Eraser to how him the deleted files and be able to overwrite these deleted files with multiple passes using DOD specifications.iajoe, am I understanding you correctly, or were you actually referring to items in the Recycle Bin? Yes, I'm talking about the Norton Protected Recycle Bin. I'm asking this question because of curiosity. Nothing important was deleted, but maybe there might be something in there that's embarassing. I learned how to shred files by means of dsDEL v. 1.00 and analog X super shredder v 1.01. Now I've installed Drive Rescue v. 1.9d, but I don't know how to use that program yet. 1.9 is the thing to recover the files. Quote Link to comment Share on other sites More sharing options...
Guest LilBambi Posted January 31, 2004 Share Posted January 31, 2004 Oh, that Norton Protected Recycle Bin .... that is such a nuisance.If it hasn't truly deleted them using DOD specs ... they are not gone for real. They can be resurrected. We do the best we can to make sure drives are safe for resale by using the DOD specs clearing a hard drive. But that Norton Protected Recycle Bin is another animal entirely.Anyone have any experience with making sure things are truly deleted with the Norton Protected Recycle Bin? I hate it and don't use it. Quote Link to comment Share on other sites More sharing options...
ibe98765 Posted January 31, 2004 Share Posted January 31, 2004 Anyone have any experience with making sure things are truly deleted with the Norton Protected Recycle Bin? I hate it and don't use it.Don't use Symantec/Norton products... Quote Link to comment Share on other sites More sharing options...
Guitar Man Posted January 31, 2004 Share Posted January 31, 2004 LilBambi Posted on Jan 30 2004, 11:36 PM-------------------------------------------------------------------------------- Oh, that Norton Protected Recycle Bin .... that is such a nuisance ibe98765 Posted on Jan 30 2004, 11:50 PM--------------------------------------------------------------------------------QUOTE (LilBambi @ Jan 30 2004, 08:36 PM) Anyone have any experience with making sure things are truly deleted with the Norton Protected Recycle Bin? I hate it and don't use it. Don't use Symantec/Norton products... Read you loud and clear on that one, Fran & ibe ! Been there, done that, and finally got rid of the critter a long time ago... Quote Link to comment Share on other sites More sharing options...
DaveyB Posted January 31, 2004 Share Posted January 31, 2004 lilbambi, i just re-reading old posts it doesnt matter if it is sent to the recycle bin or if you use a program to remove it, it can still be read, just makes it a little bit harder. I will contribute a article about this later. Quote Link to comment Share on other sites More sharing options...
ImHB Posted February 4, 2004 Share Posted February 4, 2004 Anyone know of an older version of Eraser that will work on Win. 3.1? Quote Link to comment Share on other sites More sharing options...
nlinecomputers Posted February 4, 2004 Share Posted February 4, 2004 Inside of the zip file is eraserd.exe which is a DOS based version of the program. Close as your going to get in the Win 3.1 enviromentWin 3.1? Gee shouldn't you upgrade to something modern like DOS 6.0 or Windows 95? Quote Link to comment Share on other sites More sharing options...
Guest LilBambi Posted February 4, 2004 Share Posted February 4, 2004 Thanks Nathan!I wasn't sure about that. We cross posted in different threads LOL! I posted in the other thread. Quote Link to comment Share on other sites More sharing options...
ImHB Posted February 4, 2004 Share Posted February 4, 2004 Thanks Nathan -- you are so right - this is an old IBM PS/2 Mod 80 that has been sitting and collecting dust - finally decided to junk it but first want to be sure the hard drive is wiped clean just in case it doesn't make it to the dump. Amazing - it still runs quite nicely (very slow though) but unfortunately anyone looking for donations want state-of-the-art equipment Quote Link to comment Share on other sites More sharing options...
nlinecomputers Posted February 4, 2004 Share Posted February 4, 2004 Well if you are trying to do a drive wipe then eraser has a boot disk that you can create "Boot'n'Nuke" that will wipe the drive clean.It is a good idea to do that. You'd be amazed at how many DON'T do such things. If I was a dishonest man I'd have a fist full of perfectly good credit card numbers. Quote Link to comment Share on other sites More sharing options...
littlebone Posted February 25, 2004 Share Posted February 25, 2004 While researching the encryption feature of MS Win XP Pro, I came across this snippet on the MS web site: Cipher.exe Command-line UtilityThe Cipher.exe command-line utility may be used to overwrite deallocated file clusters on the NTFS disk to reduce the risk of discovery of plaintext shreds left over from file conversion. Cipher.exe /W makes three disk write passes on all unused clusters on the disk. The first pass writes 0. The second pass writes 0xF. The third pass writes pseudorandom data.CIPHER /W:directory /W Removes data from available unused disk space on the entire volume. If this option is chosen, all other options are ignored. The directory specified can be anywhere in a local volume. If it is a mount point, or points to a directory in another volume, the data on that volume will be removed. Note Cipher.exe wipes all deallocated files from the specified disk even if a specific folder is named. It may not be possible to wipe files smaller than 4K in size as they may exist in the Master File Table (MFT) and not in separate clusters on the disk.To run Cipher.exe 1. Log on as an administrator of the local machine. 2. Close all applications. 3. Open a command prompt by selecting Start, then Run, and entering CMD as the command. 4. Type "Cipher /W:<'directory'>" (without the quotes), where <'directory'> is any directory on the drive you want to clean. For instance, "Cipher /W:c:\ " will cause the deallocated space on the C: drive to be overwritten. 5. Cipher.exe will begin running, and will display a message when it's completed. Important Cipher.exe /W may take a very long time to run, especially on large volumes. It is not possible to stop it once it has started. Running the chkdsk.exe command on the volume after completion is a best practice. Also, it is not recommended that the cipher.exe /W be run multiple times; the intent of the process is a one time cleanup of the disk. Note NTFS drives can be mounted as directories. For instance, a drive could be mounted as C:\folder1\D_Drive. This usage enables drives of this type to be cleaned.The new cipher tool is also available for Windows 2000 by downloading from the Microsoft Web site: http://support.microsoft.com/default.aspx?...;298009&sd=tech Here is the link to the encryption white paper, although most of it is not relevant to this topic. I copied that part that is relevant and quoted it above.MS Link to file encryption in XP Pro and Server 2003 Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.