Velocity Reviews - Computer Hardware Reviews

Velocity Reviews > Newsgroups > Computing > Computer Security > Wipe deleted files?

Reply
Thread Tools

Wipe deleted files?

 
 
Ken Zones
Guest
Posts: n/a
 
      12-03-2006
I thought that after a 'free space' wipe on a hard drive that all the
files that had been deleted would be overwriten.
I used 'Directory Snoop' to view the files before and after a wipe. I could
still see and recover the same files.
The only way I could seem to get rid of the deleted files was to use the
'Purge' function on the D Snoop program.

My question is there any other way to get rid of deleted files besides doing
a D Snoop prurge or using a full disc
wipe? I find it hard to believe that 'Directory Snoop' is the only software
that can find and overwrite deleted files
in a simple manner.

Tx


 
Reply With Quote
 
 
 
 
Arthur T.
Guest
Posts: n/a
 
      12-03-2006
In Message-ID:<(E-Mail Removed)>,
"Ken Zones" <(E-Mail Removed)> wrote:

>I thought that after a 'free space' wipe on a hard drive that all the
>files that had been deleted would be overwriten.
>I used 'Directory Snoop' to view the files before and after a wipe. I could
>still see and recover the same files.


You didn't mention what program you used to do the freespace
wipe, nor what options you used. There are many programs which
will do what you want, some free.

--
Arthur T. - ar23hur "at" intergate "dot" com
Looking for a z/OS (IBM mainframe) systems programmer position
 
Reply With Quote
 
 
 
 
Guest
Posts: n/a
 
      01-07-2007
i have found "deleted" files content still residing on disk after some
"cleanup/wipe" programs also.

only way i have found is to use a hooking program that intercepts the
windows system delete command and then actually overwrites the file itself
(usually with zeros) BEFORE it changes the directory to show it as
"deleted".

never expect the operating system to do anything that will sustain extra
time usage, you must do it yourself or get a program that does.


"Ken Zones" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> I thought that after a 'free space' wipe on a hard drive that all the
> files that had been deleted would be overwriten.
> I used 'Directory Snoop' to view the files before and after a wipe. I

could
> still see and recover the same files.
> The only way I could seem to get rid of the deleted files was to use the
> 'Purge' function on the D Snoop program.
>
> My question is there any other way to get rid of deleted files besides

doing
> a D Snoop prurge or using a full disc
> wipe? I find it hard to believe that 'Directory Snoop' is the only

software
> that can find and overwrite deleted files
> in a simple manner.
>
> Tx
>
>
>



 
Reply With Quote
 
Ertugrul Soeylemez
Guest
Posts: n/a
 
      01-08-2007
<(E-Mail Removed)> (07-01-07 20:27:54):

> i have found "deleted" files content still residing on disk after some
> "cleanup/wipe" programs also.
>
> only way i have found is to use a hooking program that intercepts the
> windows system delete command and then actually overwrites the file
> itself (usually with zeros) BEFORE it changes the directory to show it
> as "deleted".


That isn't secure either, because even Windows does feature a filesystem
cache. If you write random content to the file, and then delete it
right afterwards, you risk that the random data isn't written onto the
disk, because the operating system considers that as unnecessary (since
the file is already deleted anyway). Some Linux filesystems are that
smart. I don't know, if Windows is.

On the other hand, forcing that data to be written (`synchronizing')
will have a noticable impact on system performance. So resort to the
following approach.


> never expect the operating system to do anything that will sustain
> extra time usage, you must do it yourself or get a program that does.


There is only one way to ensure that no sensitive data remains on disk.
Don't let it be written to it in the first place. Create encrypted
partitions for such purposes. Encrypt your swap space and any other
temporary storage also.


Regards,
E.S.
 
Reply With Quote
 
Sebastian Gottschalk
Guest
Posts: n/a
 
      01-08-2007
Ertugrul Soeylemez wrote:

> <(E-Mail Removed)> (07-01-07 20:27:54):
>
>> i have found "deleted" files content still residing on disk after some
>> "cleanup/wipe" programs also.
>>
>> only way i have found is to use a hooking program that intercepts the
>> windows system delete command and then actually overwrites the file
>> itself (usually with zeros) BEFORE it changes the directory to show it
>> as "deleted".

>
> That isn't secure either, because even Windows does feature a filesystem
> cache.


And a journaling filesystem, thus your data will end up in the journal as
well. And not-in-place updates, thus you may not actually overwrite the
data, but instead allocate new clusters.

> If you write random content to the file, and then delete it
> right afterwards, you risk that the random data isn't written onto the
> disk, because the operating system considers that as unnecessary (since
> the file is already deleted anyway). Some Linux filesystems are that
> smart. I don't know, if Windows is.


It is, however that depends on your configuration. Generally, if there's
time to write data, it will write data, to minimize the loss on power
failure.

> On the other hand, forcing that data to be written (`synchronizing')
> will have a noticable impact on system performance.


Even Windows is smart enough for a feature to bypass the write cache, thus
you won't trash the write cache.
 
Reply With Quote
 
support@shredagent.com
Guest
Posts: n/a
 
      01-18-2007
Also, it's a good idea to use some file shredder that will run in
background and wipe all files that are deleted in your system. It is
better than using wipe free space function and it's better that keep
deleted files in-secure.

On 8 ., 04:10, Ertugrul Soeylemez <(E-Mail Removed)> wrote:
> <(E-Mail Removed)> (07-01-07 20:27:54):
>
> > i have found "deleted" files content still residing on disk after some
> > "cleanup/wipe" programs also.

>
> > only way i have found is to use a hooking program that intercepts the
> > windows system delete command and then actually overwrites the file
> > itself (usually with zeros) BEFORE it changes the directory to show it
> > as "deleted".That isn't secure either, because even Windows does feature a filesystem

> cache. If you write random content to the file, and then delete it
> right afterwards, you risk that the random data isn't written onto the
> disk, because the operating system considers that as unnecessary (since
> the file is already deleted anyway). Some Linux filesystems are that
> smart. I don't know, if Windows is.
>
> On the other hand, forcing that data to be written (`synchronizing')
> will have a noticable impact on system performance. So resort to the
> following approach.
>
> > never expect the operating system to do anything that will sustain
> > extra time usage, you must do it yourself or get a program that does.There is only one way to ensure that no sensitive data remains on disk.

> Don't let it be written to it in the first place. Create encrypted
> partitions for such purposes. Encrypt your swap space and any other
> temporary storage also.
>
> Regards,
> E.S.


 
Reply With Quote
 
Ertugrul Soeylemez
Guest
Posts: n/a
 
      01-18-2007
http://www.velocityreviews.com/forums/(E-Mail Removed) (07-01-18 07:25:54):

> Also, it's a good idea to use some file shredder that will run in
> background and wipe all files that are deleted in your system. It is
> better than using wipe free space function and it's better that keep
> deleted files in-secure.


You don't need to do this for an encrypted filesystem. It is (almost)
impossible for an outside attacker to get to your data. If someone
hacks their way into your system through a network, then you're lost
anyway. A shredder won't help a lot in this case.


Regards,
E.S.
 
Reply With Quote
 
support@shredagent.com
Guest
Posts: n/a
 
      01-18-2007
Agree, for encrypted file systems there are other security problems,
file shredder is good for end user who runs XP on FAT32 drive. File
shredder is really must-have tool in this case.

On 19 ., 00:50, Ertugrul Soeylemez <(E-Mail Removed)> wrote:
> (E-Mail Removed) (07-01-18 07:25:54):
>
> > Also, it's a good idea to use some file shredder that will run in
> > background and wipe all files that are deleted in your system. It is
> > better than using wipe free space function and it's better that keep
> > deleted files in-secure.You don't need to do this for an encrypted filesystem. It is (almost)

> impossible for an outside attacker to get to your data. If someone
> hacks their way into your system through a network, then you're lost
> anyway. A shredder won't help a lot in this case.
>
> Regards,
> E.S.


 
Reply With Quote
 
 
 
Reply

Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Re: Are deleted pictures REALLY deleted? khoshhon@gmail.com Computer Support 3 01-01-2009 08:53 AM
Re: Are deleted pictures REALLY deleted? John Holmes Computer Support 7 12-31-2008 04:46 PM
Re: Are deleted pictures REALLY deleted? Bucky Breeder Computer Support 0 12-31-2008 02:58 PM
Re: disk wipe---DOD short wipe versus DOD long wipe John O A+ Certification 0 06-13-2008 01:52 AM
Re: disk wipe---DOD short wipe versus DOD long wipe John O A+ Certification 1 06-05-2008 12:02 AM



Advertisments