How can I SECURELY delete a previously deleted file?

Discussion in 'Computer Support' started by clangers_snout, Sep 21, 2007.

  1. I've deleted a file in WinXP which I meant to securely delete. My
    questions are:

    1) Is there a secure file wipe utility that can find previously
    deleted files (assuming they haven't been overwritten) and then
    securely delete them? I know I can securely wipe free space but the
    time involved in doing this means it is not an option.

    2) Is there a file restore/recovery program that doesn't just restore
    to another disk (i.e. copies the deleted file), but instead resets the
    attributes of the deleted file, but doesn't in any way change or move
    the original deleted file, so that it appears as normal in windows
    again (from which I can then use a secure delete utility as normal)?

    3) any other ways to securely delete a deleted but not overwritten
    file?

    I'll be very grateful for any help.
     
    clangers_snout, Sep 21, 2007
    #1
    1. Advertisements

  2. clangers_snout

    VanguardLH Guest


    Securely wipe unused disk space (where all the deleted files reside).
    They were removed from the file system but perhaps not from the disk
    space. Deleting them added to the free disk space. So wipe the free
    disk space in whatever partition was the deleted file.

    http://www.heidi.ie/eraser/
     
    VanguardLH, Sep 21, 2007
    #2
    1. Advertisements


  3. Thanks, but as I explained this isn't an option. Just calculate how
    long it takes doing a Guttman wipe on 480GB (the amount of free space
    I have). I estimate about 20-30 days!
     
    clangers_snout, Sep 21, 2007
    #3
  4. clangers_snout

    John Holmes Guest

    "contributed" in 24hoursupport.helpdesk:
    Overwrite the file.
     
    John Holmes, Sep 21, 2007
    #4

  5. Yes but how? What do i use?
     
    clangers_snout, Sep 21, 2007
    #5
  6. clangers_snout

    Pennywise Guest

    Google: secure file delete

    There used to be a lot of DOS Programs that would do this.
     
    Pennywise, Sep 22, 2007
    #6
  7. clangers_snout

    who'sthat Guest

    Problem is the number of users who understand DOS is shrinking fast.
     
    who'sthat, Sep 22, 2007
    #7
  8. clangers_snout

    Pennywise Guest

    Then there's that guy who's mouse quit working and he couldn't do
    anything without it :{

    I can totally get around in windows with just a keyboard, your right a
    lot of old common knowledge is being lost.
     
    Pennywise, Sep 22, 2007
    #8
  9. clangers_snout

    who'sthat Guest

    My daughter who's 20 can still get around with just the keyboard and
    she learned that when she was 5. She took Computer 101 in school and
    told the instructor she wanted to test out and he wasn't really
    interested in that until she told him she started with dos when she
    was 5. She got one wrong using Windows 2000 which she hasn't seen in
    that since 2002.
     
    who'sthat, Sep 22, 2007
    #9
  10. clangers_snout

    VanguardLH Guest

    clangers_snout wrote ...

    Geez, what ancient processor are you using? An 8088 maybe? A Gutmann
    wipe of my 120GB drive of the 70GB of free disk space took 32 minutes.
    That means for 480GB it should take 3.7 hours. I have an AMD Athlon
    XP 3200+ for CPU, 4GB RAM, and the test drive was a Western Digital
    120GB EIDE ATA-5 (100Mbps max burst). The CPU might make a difference
    but not the memory, especially if you don't have gobs of other
    programs loaded. Eraser only used 18MB real + 14MB virtual memory, so
    RAM is not an issue. My computer is almost 7 years old so I consider
    it ancient and very definitely a legacy host and figured you had an
    equal or probably much better CPU than do I.

    Even if 4 hours is too much to prolong the jerkiness of system
    response while Eraser is wiping the free disk space (within a
    drive/partition), you can have it schedule the job to run off-hours.
     
    VanguardLH, Sep 22, 2007
    #10

  11. Hello vanguard.

    OK, I had another drive (ATA133) with 25GB free space on it. I used
    "Eraser" to do a Gutmann wipe and it took 10 hours. So for 480GB we
    are looking at 190 hours or 8 days, so less than I thought, but way
    more than I am prepared to wait! My PC is a Intel 940 dual core at
    3.2GHz with 4GB ram so it's pretty fast.
    By the way, I actually found a program that does exactly what I want.
    It's called Restoration (Brian Kato) but it's out of date and doesn't
    do Gutmann wipe. But it does do exactly what I want which is to first
    find all deleted files and then securely wipe them. If you know of
    another program like this that does Gutmann please let me know.
     
    clangers_snout, Sep 22, 2007
    #11
  12. clangers_snout

    VanguardLH Guest

    clangers_snout wrote ...
    I revisited my preferences in Eraser. While Gutmann was selected for
    file wipes, there is a separate tab for Unused Disk Space settings and
    "Pseudorandom Data" (1 pass) was selected. That's why it went so fast
    for me.

    I have Stompsoft's (now Migo Software) Lost Data Recovery but haven't
    need to use it yet. It's not free but maybe its trial is functional.
    There is also Avira's Unerase utility (they bought and restribute the
    Antivir anti-virus product), whichds free. It found 234,601 deleted
    files on my C: drive. Because they are deleted (and these are the
    utility finding them, not digging through Windows recycle bin), they
    have no path so you would have to sort by filename to find whichever
    one you wanted to undelete and then securely wipe it using whatever
    utility you like. The utility gives an idea of the chance of
    undeleting the file (Poor, Average, Good).

    By the way, since your concerned about sensitive data within files (or
    free disk space), remember that 4K pages in the pagefile may still
    contain pieces of your file. You will have to configure Windows to
    wipe the pagefile on shutdown. The clearing of the pagefile is
    performed by Windows on shutdown (which makes it take longer) by
    writing all zeroes into those sectors (not by using Gutmann wiping).
     
    VanguardLH, Sep 23, 2007
    #12
  13. Good point, however I have Bestcrypt which encrypts the swap/pagefile
    so I don't have to worry about that.
     
    clangers_snout, Sep 24, 2007
    #13
  14. Sorry, I forgot to say about the Migo and avira products, they don't
    do what I want because like every other product I have tried, apart
    from Restoration, they recover files by copying them. What I need is a
    program that just resets the MFT pointers to the file ( or however
    it's done, I'm not that techy ), so that Windows sees the file as
    normal again. Restoration finds all deleted files and then gives you
    the option to securely wipe them, but unfortunately it doesn't do
    Gutmann wipe. C'est la vie!
     
    clangers_snout, Sep 24, 2007
    #14
  15. clangers_snout

    VanguardLH Guest


    If you aren't concerned about the pagefile remnants because you are
    using volume encryption (i.e., whole-disk or whole-partition
    encryption), why do you care about the free disk space where the
    deleted files reside? Wouldn't the free space be just as encrypted as
    the pagefile or any other file (in the MFT or not) in that same
    protected volume? I use TrueCrypt to create containers that I can
    mount for encrypted files but I only mount and unmount the Truecrypted
    volume when I need to get at the files. Any file deletes are within
    the container so the free space is still encrypted. The entire volume
    contained in the TrueCrypt file is encrypted whether it is used or
    not. You can have TrueCrypt protect a whole partition but I prefer to
    just create the .tc container file that mounts as a drive for
    on-demand access the files within. I thought BestCrypt has the same
    and maybe more capabilities, like whole-disk encryption. If you are
    encrypting the volume in which the pagefile is contained then it seems
    the free space in the same partition should be encrypted.
     
    VanguardLH, Sep 24, 2007
    #15
  16. I'm not using whole disk encryption. Only the pagefile and my
    encrypted volume are encrypted. The files that I need to securely
    delete were accidently written as normal (no encryption) outside of my
    encrypted volume.
     
    clangers_snout, Sep 24, 2007
    #16
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.