They say when you delete a file, it isn't actually deleted....

Forums › Desktop computing › They say when you delete a file, it isn't actually deleted....

1 | 2 | 3

Ramjet007

319 posts

Ultimate Geek

#618177 2-May-2012 06:42

ccleaner has a free space wipe with different levels. You can use it to empty the rec bin too.

ChevronX

280 posts

Ultimate Geek

#618186 2-May-2012 07:27

Ramjet007: ccleaner has a free space wipe with different levels. You can use it to empty the rec bin too.

Yep, which is really handy but annoying when you accidenctly press "Wipe Blank Space" while doing a normal scan.

"The Atlantis base, brings greetings from the pegasus galaxy, you may cut power to the gate!."- Dr Weir (Rising) New Zealand · Luke.Geek.NZ

myopinion

938 posts

Ultimate Geek

#618200 2-May-2012 08:50

As an aside, to undelete files I have successfully used Recuva. Takes a while but works well.

http://www.piriform.com/recuva

gzt

17125 posts

Uber Geek

Lifetime subscriber

#618211 2-May-2012 09:22

hashbrown:
Athlonite: It's been done before where data has been recovered after upto 7 overwrites has occurred so an single zero fill isn't as secure as you think

Reference?

Athlonite: I recently recovered data from a laptop that had the zero fill done on it by someone not on friendly terms with it's owner

Would you mind sharing the basic technique you used?

+1.

networkn

Networkn
32351 posts

Uber Geek

ID Verified

Trusted

Lifetime subscriber

#618212 2-May-2012 09:25

gzt:
hashbrown:
Athlonite: It's been done before where data has been recovered after upto 7 overwrites has occurred so an single zero fill isn't as secure as you think

Reference?

Athlonite: I recently recovered data from a laptop that had the zero fill done on it by someone not on friendly terms with it's owner

Would you mind sharing the basic technique you used?

+1.

Colinspocket

30 posts

Geek

#618468 2-May-2012 17:46

networkn:
gzt:
hashbrown:
Athlonite: It's been done before where data has been recovered after upto 7 overwrites has occurred so an single zero fill isn't as secure as you think

Reference?

Athlonite: I recently recovered data from a laptop that had the zero fill done on it by someone not on friendly terms with it's owner

Would you mind sharing the basic technique you used?

+1.

+2

+3

Trololol

Brendan

716 posts

Ultimate Geek

Trusted

#618659 3-May-2012 00:47

From memory....

The magnetic 'cells' on the surface of the disk have a variety of values between 0 and 1 in reality, because the disk is an analog system. Logic circuits on the drive controller board use various data integrity checks / error correction to determine if the cell should be a 1 or a 0.

When a sector (group of cells) requires too many of these integrity checks to provide a clear reading, it is marked as 'bad' and a sector from the 'spare' bank is logically swapped in to replace it. Modern hard drives have gargantuan rates of such faults and therefore suitably large supplies of replacement sectors and even more impressive error correction logic.

Simply erasing a file from your hard drive does not remove the file contents; it simply marks the space as available (as others have said). It is not secure.

Over-writing the file with random patterns of data will make recovery of the file harder and harder. But because the surface of the disk is an analog media and because you can never position the write heads perfectly every time (physics makes it impossible), some part of the magnetic cell will retain a 'shadow' of the original data.

Over writing (secure erase) aims to make it impractical to recover this information - but it cannot be made impossible. A suitably powerful investigator - the NSA say - suitably motivated could use an electron microscope, and other such equipment to take a RAW analog reading from each cell on the drive. They might even be able to swap in their own controller board that spits out raw analog results and not need the microscope (it'd be faster).

Taking this information thus retrieved, they could load the image into a supercomputer which could use all sorts of heavy duty data mining, signal finding (such as used in radio astronomy, de-cyphering, probabilistic, quantum interference, bayesian logic) algorithms to find your secrets.

As this would keep a team of engineers busy with a super computer for weeks and cost millions of dollars, your porn collection is likely safe - or you'll end up laughing longest anyway.

If you had used some decent encryption on your files, you might be even safe then - decent encryption makes the files look as much like random noise as possible, and thus would confound the pattern seeking data mining phase. Unless they 'extract' the password out of you...

Note also: the mechanism of swapping a faulty sector with a spare replacement means the original sector is sitting there, impervious to most formats and secure wipes (as it is mapped out by the drive itself). A suitably technical investigator would not need any electron microscopes or super computers to read that...

Solid State Drives, flash disks, etc are essentially the same for this discussion, it's all analog at the base level. But the packaging of these devices makes the task more difficult: how to get at the raw cells without destroying the thing...

But there are ways. If they can retrieve data of burnt hard drives, they can retrieve it off broken microchips. It's just not likely unless you have planted a nuclear bomb somewhere etc. Or know some major dirt on the yanks.

The solution is simple enough: investigate a program called "true crypt", and use it's shadow drive facility. You then have powerful encryption and plausible deniability.

It's how I store all my nuclear bomb plans. And porn. And Nuclear porn. And all my dirt on the SIS (since they will be reading this - yes, you John, I know...).

Sharesies kids

Free kids accounts - trade shares and funds (NZ, US) with Sharesies (affiliate link).

Bung

6484 posts

Uber Geek

Subscriber

#618683 3-May-2012 07:21

Brendan: From memory....

Over-writing the file with random patterns of data will make recovery of the file harder and harder. But because the surface of the disk is an analog media and because you can never position the write heads perfectly every time (physics makes it impossible), some part of the magnetic cell will retain a 'shadow' of the original data.

From memory a lot of that theory has been made effectively obsolete with modern very high density drives. I think Gutman's paper has an epilogue saying that most of the earlier techniques mentioned in his paper are only practical on older drives.

ChevronX

280 posts

Ultimate Geek

#618685 3-May-2012 07:36

Whats the data recovery like on Solid state drives?

"The Atlantis base, brings greetings from the pegasus galaxy, you may cut power to the gate!."- Dr Weir (Rising) New Zealand · Luke.Geek.NZ

alienwithin

136 posts

Master Geek
Inactive user

#618709 3-May-2012 09:11

myopinion: As an aside, to undelete files I have successfully used Recuva. Takes a while but works well.

http://www.piriform.com/recuva

very good program, used it last year when i screwed up. reinstalled my computer no realising I had also formated my back ups, both of them of photos and videos of a friend that had passed over, thank god for Recuva

ChevronX

280 posts

Ultimate Geek

#618719 3-May-2012 09:32

alienwithin:
myopinion: As an aside, to undelete files I have successfully used Recuva. Takes a while but works well.

http://www.piriform.com/recuva

very good program, used it last year when i screwed up. reinstalled my computer no realising I had also formated my back ups, both of them of photos and videos of a friend that had passed over, thank god for Recuva

Recuva and Testdisk = Data Recovery arsenal!

"The Atlantis base, brings greetings from the pegasus galaxy, you may cut power to the gate!."- Dr Weir (Rising) New Zealand · Luke.Geek.NZ

kyhwana2

2566 posts

Uber Geek

#619112 3-May-2012 22:51

ChevronX: Whats the data recovery like on Solid state drives?

Depends on the drive. Most have various forms of Garbage collection and most have Trim, which zero's out the data as soon as you delete something..

So practically, it's pretty crap.

ChevronX

280 posts

Ultimate Geek

#619266 4-May-2012 09:02

kyhwana2:
ChevronX: Whats the data recovery like on Solid state drives?

Depends on the drive. Most have various forms of Garbage collection and most have Trim, which zero's out the data as soon as you delete something..

So practically, it's pretty crap.

So the old saying, don't delete if you don't want to lose it still applies =D

"The Atlantis base, brings greetings from the pegasus galaxy, you may cut power to the gate!."- Dr Weir (Rising) New Zealand · Luke.Geek.NZ

freitasm

BDFL - Memuneh
79280 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#619267 4-May-2012 09:03

I sold one of my two 500 GB Seagate Desktop drives on Trade Me yesterday. The buyer sent me an email saying "any games or movies left on the drive appreciated"...

keewee01

1737 posts

Uber Geek

Trusted

#619319 4-May-2012 09:43

freitasm: I sold one of my two 500 GB Seagate Desktop drives on Trade Me yesterday. The buyer sent me an email saying "any games or movies left on the drive appreciated"...

ROTFLMAO - leave em' some infected applications and trojans to teach them a lesson!

1 | 2 | 3