Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Can You Ever Really Erase a Computer File?


  • Please log in to reply

#1
coachwife6

coachwife6

    SuperStar

  • Retired Staff
  • 11,413 posts
http://slate.msn.com/id/2121745/

Can You Ever Really Erase a Computer File?
What if you use Evidence Eliminator?
By Daniel Engber
Posted Wednesday, June 29, 2005, at 3:24 PM PT

Robert Johnson, who used to be the publisher of Newsday, was indicted on Tuesday for possessing child pornography and for attempting to destroy evidence. A pair of incriminating movies were found on Johnson's office computer, even though he had apparently used a program called "Evidence Eliminator" to wipe 12,000 files from its hard drive. Can you ever really erase a computer file?

It's not easy. When you delete a file from a standard desktop computer, the file first gets moved to the "recycle bin" or the "trash," which means only that you've placed the intact data in a new directory. You erase the file when you empty your recycle bin. But even then, much of the information remains on the hard disk. Exactly how much depends on the type of computer you're using and which operating system you have.

Here's how it works: The information in each file you create gets stored on your computer's hard disk, where it's spread across multiple "data clusters," or chunks of space that each have a particular address. The computer keeps track of where to look for each file; pieces of a single document, for example, might be stored in clusters all over the disk. If possible, a computer will store files in contiguous clusters, so all the information is kept close together.

When you delete a file, all you've really done is tell the computer that it can reuse the clusters assigned to that file for something new. The data in those clusters remains intact, until the computer reassigns and overwrites those chunks of disk space with new files. Experts say that the original data can remain intact for weeks or months, depending on the particulars of the system.

To make things easier for computer-forensics specialists, standard Windows desktop machines even save basic information about the deleted file, like what it was called, how big it was, and which clusters it used. (Machines running Unix don't preserve quite as much information.) But even without every chunk of original data, specialists can scan for particular kinds of deleted files or pull bits of text from a deleted file that has been partially overwritten.

So, what do programs like Evidence Eliminator do? They first "delete" a file in the conventional sense, and then they overwrite it with zeroes, ones, or random data. Finally, they erase the record of where the original file was stored on the disk. More advanced programs might overwrite the original with something less conspicuous than a string of zeroes, like an ordinary text file.

But even if you do wipe your disk successfully—and overwrite each of your deleted files—traces of the original data remain. Writing to a magnetic disk is not as precise as one might think; when you overwrite a file, the new version doesn't completely cover up the old. The leftover data can be read out with certain imaging techniques, like magnetic-force microscopy and magnetic-force scanning tunneling microscopy. Computer forensics experts say it's possible to recover data beneath dozens of layers of overwriting, and privacy fanatics talk about wiping their disks up to 35 times over to be absolutely safe.

Next question?

Explainer thanks Brian Carrier of Purdue University and John Mallery of BKD Consultants.

Daniel Engber is a writer in New York City and a featured member of www.cryingwhileeating.com.
Photograph of computer on the Slate home page by Tim Boyle/Getty Images.
  • 0

Advertisements


#2
St0rm

St0rm

    banned

  • Banned
  • PipPip
  • 79 posts
Interesting. So when you delete a file it just gets placed among clusters of other files. So theoretically if you deleted enough things, your hard drive would be full of clusters of nothing :tazz: ;)

Edited by St0rm, 12 July 2005 - 01:48 PM.

  • 0

#3
dsenette

dsenette

    Je suis Napoléon!

  • Administrator
  • 26,028 posts
  • MVP
you can always use a degauser (spelling probably wrong) or a brillo pad. or if you really don't want the info to be found you can always use a chunk of thermite

Edited by dsenette, 11 July 2005 - 03:08 PM.

  • 0

#4
EMCguy

EMCguy

    Member

  • Member
  • PipPipPip
  • 729 posts
Thanks for the article.

I used to work at a microwave oven manufacturer, where they would simply throw out old engineering ovens, until they found out that someone was hauling the old ovens out of the dump and rebuilding them from parts. They even got service calls to come out and fix these cobbled creations.

After that, they started to use a pickaxe right thru the waveguide, making it more difficult to refurbish.

Sounds like a pickax is a good privacy tool as well. :tazz:

EMCGuy
  • 0

#5
The_KiD

The_KiD

    Member

  • Member
  • PipPip
  • 94 posts
Is it true that if you split a HDD casing open and put some fairly strong magnets on the disk that it will be erased then?
  • 0

#6
dsenette

dsenette

    Je suis Napoléon!

  • Administrator
  • 26,028 posts
  • MVP
you have to do a little more than that now adays...even that leaves an imprint of some of the data on the head....it's just really hard to get anything usefull. if you use a degauser it actually demagnetizes the drive in which case all of the magnetic information basically falls off the platter.
  • 0

#7
logan11

logan11

    Member

  • Member
  • PipPipPip
  • 225 posts

you can always use a degauser (spelling probably wrong) or a brillo pad. or if you really don't want the info to be found you can always use a chunk of thermite

View Post


im not very good with the hardware side of things when it comes to computers. just wondering.. is that really true? that you can erase them by actually cleaning them?
  • 0

#8
dsenette

dsenette

    Je suis Napoléon!

  • Administrator
  • 26,028 posts
  • MVP
magnetic media like harddrives and floppies basically use a magnetic substance stuck onto a metalic platter. so if you demagnetize the substance it can't stick to the platter anymore. if you manually move this substance around it basically screws up the data (this is less reliable) but to use the brillo pad method you have to do some major hardware monkeying and if someone really wants your data they can still get some of it back. but thermite will make the drive non existant...wonderful stuff
  • 0

#9
Dragon

Dragon

    All Around Computer Nut

  • Retired Staff
  • 2,682 posts
worse case scenario, you could always use C4. that will solve all your problems when it comes to someone wnating to get info off your harddrive. course that might have something to do with the fact that, wiht enough, you would vaporize the entire computer. lol
Posted Image
  • 0

#10
dsenette

dsenette

    Je suis Napoléon!

  • Administrator
  • 26,028 posts
  • MVP
c4 is a little bit of overkill.....but then again...what's more fun than overkill?

Edited by dsenette, 15 July 2005 - 08:00 AM.

  • 0

Advertisements


#11
Dragon

Dragon

    All Around Computer Nut

  • Retired Staff
  • 2,682 posts
my thoughts exactly, hehe
  • 0

#12
Michael

Michael

    Retired Staff

  • Retired Staff
  • 1,869 posts
I remember this and when I want to get rid of a hard drive I will toss it down the garden shredder and see that happens to it....
  • 0

#13
boob

boob

    Member

  • Member
  • PipPip
  • 74 posts
What about formatting a hard drive? Will that not completely erase data?
  • 0

#14
SoccerDad

SoccerDad

    Member

  • Member
  • PipPipPip
  • 190 posts
Even with formatting, the data is recoverable. In fact, you can abort a Windows launched format at about 90%ish and still boot the machine from what was there before. dsenette and Efwis have mentioned the most complete way to make sure that data is gone :tazz:

cya, SD
  • 0

#15
EMCguy

EMCguy

    Member

  • Member
  • PipPipPip
  • 729 posts
Spybot S&D has a shredder tool in it, which supposedly allows you to better erase a file.

From their help menu:

The secure shredder is a tool to get finally rid of files, without any further possibilities of recovery.

Shredding is simple – drop some files from the explorer into the list (or add some using the context menu of the list), select the number of shreds, and click Chop it away.

Usage tracks that are in files will be shredded using this tool, too, using 5 passes.

The first 5 shreds are using pre-defined bit pattern that should make even hardware recovery impossible. Any further pass will use a random bit pattern that is changing every few Bytes.
Please notice: one pass is not enough to shred a file, as the heads of your hard disk won't hit the same track 100,00% of the time. There are small differences of a few µm that will allow pros to reconstruct even overwritten data. That is why multiple shreds are necessary, and why different patterns should be used.

Warning: This tool is designed to remove files so they can not be recovered again! If you use it, be aware of that!
You do not need to use this tool to remove spyware or usage tracks. Spybot-S&D will take care of shredding them on its own.

Disclaimer: I tried my best to finally shred every given to this tool. But I can't guarantee that files will be unrecoverably extinguished.

You can find the secure shredder tool by choosing Secure Shredder from the Tools section in the toolbar to the left.


Never tried it myself, but its nice to know about. :tazz:
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP