Deleting Files... The Hidden Danger

**yamaha147** · 02-28-2012, 06:33 PM

by hoodlum
Posted on TID.

Alright, well this post might be useless but if it helps at least one person then its served a purpose. I'm writing this because it's been on my mind for a little while now and the recent CD pushed me to get this information out to the masses. I'm going to be making a few assumptions on this post like that everyone is using a Windows based OS. If your on something else (FreeBSD, Linux, etc), chances are that this post is useless for you anyway (unless your on a Mac, then your useless). I'm also assuming that people are using a HDD (a regular hard drive) and not a SSD, if anyone is using SSD's and needs help just contact me and I'll update this post with some SSD specific information.

We all know when you want to get rid of a file you delete it. Then, if you remember you head over to the Recycle Bin and get rid of it from there. All is good, the file is gone - WRONG!

Unfortunately, there is more than one way to recover data which has been deleted. This means that if you delete a sensitive document that linked you to something or a picture that could implicate you with a crime or anything at all of a sensitive nature you need to take further steps to ensure the file is gone or the police (or wife, whoever your worried about) can get it back with surprizingly just a little bit of effort and no specific knowledge. I'll get the jibberish out of the way first so you understand whats going on. Whenever you create/save a file, it writes it to a new location on your hard drive. This is completely irrelevant from the location that you saved the file in. A file saved in C:/Jibberish/Videos/Porn.mpg can be right next to C:/Steroids/LabLocation.docx on your hard drive. Windows restricts that space on the HD (hard drive) from being written over by new data but when you delete the file, windows does NOT delete it. All windows does is clear that restriction so that new data CAN overwrite it - this by no stretch of the imagination means that it is gone. The file is still there, in exactly the same location and until it is overwritten (remember, this needs to be overwritten on the HD itself and not just inside windows) it can be retrieved quiet easily. Software doesn’t destroy files when it deletes, it simply marks the space the file was using as being available for re-use. If nothing has needed that space since the deletion, the data is still there and the file can be recovered. It is sometimes quiet surprizing at what you find when you check all the files that were deleted.

If your thinking by now that the only way to get rid of data permanently is to physically damage your hard drive... I have bad news for you, there have been theories on how to retrieve data from a physically damaged HD for awhile but now a company called Seagate have proven that they can recover data from a physically damaged HD - to what extent I do not know. If they can do it, chances are that the higher levels of law enforcement also possess this capability. Fortunately, there are methods of file erasure that no one can counteract.

I'll show you how to retrieve previously deleted files and then I'll show you how to make sure they are gone forever so not even the best of the best can retrieve it. Obviously things get a lot more complicated than what I'm about to show you so keep in mind that much more is possible. Head on over to eSupport UndeletePlus - Easily undelete, unerase, and recover deleted files and grab yourself a free copy of their UndeletePlus software. It isn't what I use (I've been recommended it as the best freeware) however its the most user-friendly and does do the job (sometimes it will miss files which more advanced programs pick up however this post is on data erasure, not data recovery). All you need to do is point the program to the location of your file (it can do the entire HD however this will take a fair bit of time - depending on your computer) and it will return a bunch of files which have been deleted from that location. Most of them will be useless files created by Windows in day-to-day operations however your file should be able to be seen, recovered and then used as if it was never gone. I wish it was harder than that... but unfortunately it is not.

There is another way to recover files which is often overlooked as a security risk. Windows (by default) creates backups and also creates shadow copies of your files. All that you need to do, is restore your computer to a previous backup and you will have those files back and ready to use. There are ways to extract specific files from backups however there is no use going into that here - so remember to turn OFF your windows backup/restore options and to delete (permanently) all old backups otherwise they can be recovered and then used just the same way as any other file. This may mean that in the future and you infect yourself with a harmful virus (harmful viruses are rare these days, most want to go unnoticed and collect details as opposed to wreaking havoc) you may not be able to restore to a previous state as Microsoft will instruct you to do however its your choice. Safety versus convenience, I know what I choose. Details on this can be found at https://windows.microsoft.com/en-AU/w...-deleted-files

Now we get in to the important part. How to permanently delete any data from your computer. I'll skip all the theory as in to why this has to be done and how it works but basically since files aren't normally deleted from your HD when you delete them, we need to write over that data with new data. For example, your file might be 'deleted' in Windows but still sitting there on your HD. So what you need to do, is find the location of that file on your HD and then write over it with useless data (many methods exist due to many theories of potential file recovery but for our sake most will do). The best way to do this is to find a program that allows you to wipe ALL free space on your HD. This may sound like a waste of time, why would you want to write over free space on your HD's if there is nothing there... wrong. Remember, your deleted files are kept there and writing over it is the only way to ensure that they can never be recovered. Don't think that this space wont be able to be used again, once it has been overwritten then it is converted back into free space and Windows can't tell the difference between your useless data and your 'deleted' sensitive files. Writing over all of your blank space is essential the first time around because you never know what deleted file you might have lurking in the corner however if you stay on top of things there is a convenient way to do it. Some programs embed themselves in windows and give you extra deletion options.

I use a program called BCWipe. It is available from Jetico - Permanently Delete Files | Wipe files entirely or selectively with Jetico's military-grade software however they do charge a fair amount for it! I'm not advocating anyone breaks any local piracy laws however if you are in any torrent networks then maybe look around for it. I have seen a very full featured working version of BCWipe V5.02.1 and can confirm the crack works perfectly. If the forum admin's don't mind I can post up a direct download link to this cracked version or if not then if people want to PM me with any questions I may be able to help. I'm sure free programs exist that do the same thing somewhere but I was never able to find a fully featured one that did the job properly.

As you can see, if I want to make sure I delete a particular file for good then I would use the "Delete with wiping" option when I right-click the file instead of the regular "Delete" option. Although this might seem like a little difference, what happens behind the scenes is what makes things permanent. This is what happens when you click "Delete with wiping". Normally just a Yes/No option comes up with the option of more settings, I opened that to show you and then opened the scheme editor. You may also note the pesky Windows option to "Restore to previous versions" above it.

As you can see, it is set to default (and what I use) to use the US Department of Defense wiping scheme. This means that files are written over with junk data (exact method shown in scheme pane) 7 times and can never be recovered. If you write over your file once then the previous program mentioned (UndeletePlus) shouldn't be able to recover it but after 7 times it has absolutely no chance. There is a debate about wether once is enough to write over a file or not and both New Zealand Government Communications Security Bureau and the Australian Government ICT Security Manual in 2008 released that once was their standard. On the other side, the Gutmann method writes over data 35 times. I use 7 times and have never been able to recover even a portion of my files. This is done very quickly, so don't feel that overwriting a file multiple times will slow things down - don't come this far and skimp on safety. Use 2 times as an absolute minimum.

I know I have gone a bit over-board with the explanation but the bottom line is that if your concerned at all then make sure you wipe over your files when you delete them. There should be absolutely no excuses for this because it is quick and literally as simple as a click of the mouse.