What freeware program will ensure deleted computer files cannot be recovered

Factual Questions
21

It’s a matter of time and money; most police departments and county sheriffs are going to have stuff like EnCase and FTK, which they can use to image a drive and grab any existing files, recycle bin and free-space files in the span of a couple days.

If they want to try and recover overwritten files, that typically takes a clean room and/or specialized equipment, a lot more time, and probably most importantly, a lot more money.

In your case, I’d probably just encrypt your porn and personal files in a TrueCrypted partition (or some other encryption utility), and then just reformat that partition when you’re done with it.

If you do that, they’d have to reconstruct the partition, and then try and crack your password or (harder) decrypt the files on the partition, assuming they can tell how it was done in the first place.

If you really want to get crazy, TrueCrypt allows for a hidden encrypted partition within another one, or something along those lines. So they might identify the outer one, but they’d never know the second one is even there.

22

Yeah, I’d be curious to know how that works. Over 50% recovery seems like a hell of a lot to me. Even assuming the drive comes to you in one piece, how would you go about reconstructing data that has been securely wiped, like, say, written over 7 times (or whatever number) with a random string of digits.

I guess I could see it being possible if you know what the random bits are, but I don’t see how it works in theory otherwise. I would assume the theory is something like there is an electrical charge, and when you write it over, there is still some “latent” charge left behind that you could detect with a microscope? But if keep rewriting that data, I’d assume the true data later is pretty quickly completely obfuscated. And how do you know where the “true data” is? Even that is going to be sitting on top of old data often enough that it has itself written over, plus continuous blocks of data are not necessarily stored on continuous segments on the disk, so one part of your file might be sitting on a fresh part of the hard drive, and another may be overwriting old parts of the hard drive. Not that I have anything to worry about, but I’m interested in the theory of how this can be done–just the actual reconstructing data part. I’m not too concerned about the physical part of putting back together a blown-up drive.

23

The reason for the 35-times or 7-times random write is this:

Oversimplified - Disks are divided into circular TRACKS, which are then divided into SECTORS. Disk head read-write is essentially like a cassette tape recorder. When you write, you run current through a magnet (the head) change the orientation of magnetic particles suspended in a gel (emulsion). To read, the head reads the magnetization as it passes over it and a current is induced in the head.

Writing once, you may not completely re-orient all the magnetic bits. Supposedly, there may be residual magnetization from previous bits. Hence, re-write the same place over and over again with random values (sort of like “scribble all over”) so the original setting can’t be distinguished.

Also, the head wanders. The head has very precise control to stay in the circular track, but with vibrations, thermal changes, etc. the control is not extremely precise. As I understand it tech now or at one time used the feedback from the wandering head - as the read signal faded, it indicated “you’re wandering off track” and like tuning the old analog radio, dialed the head back to the center of the track. As a result, there may be some residual magnetization left in spots because not every re-write covers the exact same track real estate as the previous write.

Of course, that sort of data recovery is NSA territory. You gotta really really want to get the data to spend the time analyzing, finding fragments of files, and trying to reconstruct files from the pieces (sort of like the Deas Sea Scrolls - type jigsaw puzzles.)

The simplest data recovery is this - when you delete a file, you don’t. A file is a directory entry that points to a chain of sectors that make up the file. “DELETE” flags the directory entry as deleted (special code in first byte of name) and appends the file sector chain to the free space sector chain. As a result, depending on amount of free space and how much you write to the disk, your complete file (the whole sector chain) may be intact and findable. that’s what “un-erase” programs do.

It’s a bit more complex, too. When you write a file, it uses a series of sectors obtained from the free space chain. If there’s not exactly, let’s say, even 4K’s of data, then if sectors are 4K the final sector of th file will write the end of the file, followed by a code bytes saying “this is the end”. If there was data in the sector from before, it may still be there unchanged - so fragments of your old file hang around as the tail end of new files.

Similarly, with MS Office and many other programs, when you “SAVE” it may not re-write the file; It writes the new file as a temporary file, deletes the old file, renames the new; so yor free space may contain 10 copies of your document even though all you did was edit it 10 times. Plus, windows likes to put stuff in the recycle bin for easy recovery. Empty recyle bin just sticks it in the free space queue.

Some programs like to keep logs - sort of like phone call records. The data might not be there, but file names, times, etc. might be. Plus, if an error (or even some informational records) may show up in event viewer.

Internet explorer likes to keep megabytes of old data, including cookies pushed to you by websites that indicate details like the time and date you visited. This sort of operating system data is hidden from normal prying, you have to enable “show hidden files” and “show system files” to see these.

Also, some program data (last files opened, etc.) may be hiding in your registry entries for that program.

So there are plenty of ways to dig through a computer and see what someone was doing, whether they googled “Cholorform” for example… That does not even begin to cover what places like google have kept on their website logs, tied to your IP address, OS and browser versions, and other computer-identifying data.

24

There is no way your company was doing this. On a modern hard drive, overwritten data cannot be recovered. See below.

The Gutmann method has also been debunked. See below:

http://www.infosecisland.com/blogview/16130-The-Urban-Legend-of-Multipass-Hard-Disk-Overwrite.html

To answer the OP’s question, DBAN is a good free program that will wipe a hard drive.

25

True or not, or government conspiracy to mislead us into removing our tinfoil hats… the fact is that erasing all blank disk space, file tails, etc. multiple times cannot hurt; while NOT erasing at least one pass with a random data wipe program leaves a huge amount of data exposed to forensic discovery techniques.

Of course the existence of random data on blank space in itself indicates that a wipe was done, which itself tells the investigator something, that an active attempt to hide data was done. IIRC there are programs you can install as services that wipe the blank space at regular intervals as an operating sytem utility - thus removing the certainty that wiping was specifically done at point X.

26

I don’t think any “conspiracy to mislead us” exists. The myth stems from the Gutmann paper, which is quite outdated. Even Gutmann has reconsidered his former position:

Your point about inferring something nefarious from the fact that a drive has been wiped is a valid one, though.

Here’s a link to a summary of the Wright article:

27

I fully believe that Dangerosa’s company was able to recover bits from a securely-destroyed hard drive with 50% accuracy. Anyone with any experience at all in computer science could do the same.

28

Ha! S/he slipped that one past everyone!

29

Definitely empty the recycle bin for a start. The recycle bin only indicates intent to delete at some point in the future - your files still 100% exist and are trivially recoverable. After actually deleting, space is randomly reclaimed for use by other files, and recovery requires special software and crossed fingers. If you fill up your drive or use the software listed above, it’s truly gone.

I see what you did there. +1.

30

Wow…somebody call James Randi! :smiley:

Or would it be something like “An infinite number of computer techs, with an infinite number of hard drives and an infinite number of software tools, will still have no girlfriend” :smiley:

32

Shirley you must be spam.

reported