How to Wipe Out Deleted Files - Page 1
Forum section: electronics / general

author: bostonman
author_rank: Super Contributor
timestamp: April 12, 2020, 02:34:26 am
content: I tried using a hard drive file recovery program to see which files I deleted years ago. Unfortunately, I came across files containing important personal information that I deleted and hoped new files over wrote them. Obviously I don't want these files to be recovered again, and looking to wipe them from existance.After research, I found a free program (which I already had) called CC Cleaner to wipe out deleted files. I ran it and currently doing another scan. So far the program has found many files implying CC Cleaner didn't wipe out everything. I'm uncertain why, I would think it would write junk files to take the place of the ones I want deleted, and then delete those.Does anyone know how I can wipe out these files for good without compromising files that I want to keep? If a program is the best option, I'd prefer a free one.

author: bostonman
author_rank: Super Contributor
timestamp: April 12, 2020, 02:49:47 am
content: The file being corrupt was my thought, however, I was able to view pictures. Since the recovery software I am using is unlicensed, I'm unable to actually recover them, but allowed to preview.

author: james_s
author_rank: Super Contributor
timestamp: April 12, 2020, 03:04:31 am
content: When you delete a file, all that actually happens is the entry in the allocation table is removed, the data itself is still present on the drive until something else overwrites it. There are loads of secure delete programs out there, some wipe the entire drive but it sounds like you want the other variety which securely deletes individual files. They work by overwriting the file with random data and then removing it from the table.Keep in mind some software caches things in other locations, web browsers of course, and things like Office applications auto-save, some media software creates thumbnails or copies data into a library so depending on what the files are and what you're doing with them there can be other copies in various forms scattered about.

author: james_s
author_rank: Super Contributor
timestamp: April 12, 2020, 03:16:45 am
content: That can be very dangerous when a novice is trying to nuke a few specific files and leave the rest of their data alone. Someone who is not used to Unix may be surprised by the way there is no safeguard or confirmation for certain commands. Years ago I once accidentally deleted the whole /bin folder on my work PC because I bumped Enter before I was done typing the path.

author: bostonman
author_rank: Super Contributor
timestamp: April 12, 2020, 03:24:15 am
content: This may be a silly question, or maybe it's too time consuming, but why can't a simple program be created that will write a large text file and keep writing until the drive is full, then delete the file?

author: rdl
author_rank: Super Contributor
timestamp: April 12, 2020, 03:35:45 am
content: As already said, you have to watch out for other software leaving traces of crap all over the place. If you use Windows, you'd be surprised how much stuff it hides in the registry, just do an internet search for "shellbags" for instance.This is what I've always used on my Windows machine:https://eraser.heidi.ie/For reasons I don't remember, I continue to use an older version (6.0.10.2620). There must be something I didn't like about the newer versions.

author: james_s
author_rank: Super Contributor
timestamp: April 12, 2020, 04:50:58 am
content: Quote from: bostonman on April 12, 2020, 03:24:15 amThere are lots of programs that do roughly that. I can't name any off the top of my head since I have not had a reason to use one in years and years but I'm certain there is no shortage of them out there.

author: magic
author_rank: Super Contributor
timestamp: April 12, 2020, 06:25:39 am
content: Quote from: bostonman on April 12, 2020, 03:24:15 amYes, it works. I'm not aware of suitable software for Windows, on Unix you would simplycat /dev/zero >dummy_fileor something like that. Much quicker and safer than nuking a whole partition. That being said, some systems may have quotas or reserved space which would prevent you from overwriting all free area on the filesystem unless special effort is made to bypass or disable them.And there is a caveat about flash memories. On those, "overwritten" data may still remain alive in the flash chips for a while even if they aren't accessible from outside.

author: james_s
author_rank: Super Contributor
timestamp: April 12, 2020, 06:27:44 am
content: https://www.techrepublic.com/article/how-to-completely-and-securely-delete-files-in-windows/

author: magic
author_rank: Super Contributor
timestamp: April 12, 2020, 06:33:52 am
content: All those "shredders" and "erasers" are designed for spinning rust, too. When you overwrite your data on an SSD, the effect is the same as if you performed TRIM on them except that you are wearing out and fragmenting the flash by subsequently writing rubbish to it.And of course it does nothing for files already deleted.

author: 0db
author_rank: Frequent Contributor
timestamp: April 12, 2020, 09:30:50 am
content: At Google, they physically destroy hard-drives when they need to upgrade.

author: magic
author_rank: Super Contributor
timestamp: April 12, 2020, 09:33:43 am
content: Source?Same Google that virtue signals about progress and ecology?

author: bostonman
author_rank: Super Contributor
timestamp: April 12, 2020, 01:58:21 pm
content: BTW, these drives are not Windows drives. They were backup drives I copied files to. At some point I decided many files were not worth saving, deleted them, added new ones, and assumed the new ones overwrote any deleted ones that could be recovered.

author: rdl
author_rank: Super Contributor
timestamp: April 12, 2020, 04:44:12 pm
content: Quote from: bostonman on April 12, 2020, 01:58:21 pm"Windows" does not necessarily mean the OS is stored on them. If they use NTFS or FAT32 then they are generally considered "Windows" drives. Maybe you should consider some kind of disk encryption in the future.Quote from: magic on April 12, 2020, 06:33:52 amSSD have to be treated differently, however for HDD Eraser can be used to securely overwrite all free space on a drive.

author: SiliconWizard
author_rank: Super Contributor
timestamp: April 12, 2020, 05:54:27 pm
content: Quote from: bostonman on April 12, 2020, 01:58:21 pmWhereas with conventional HDDs, the odds are pretty high that physical sectors containing deleted files will relatively soon be overwritten by new files, this is a lot less the case with SSDs wtih heavy wear-levelling algorithms. I think the odds of still being able to get ahold of the data in SSDs is much higher, at least if you can access the Flash chips at a low level.I don't know if there are any tools that are *really* effective for permanently "erasing" all data on SSDs. If you know of one...

author: Jr460
author_rank: Regular Contributor
timestamp: April 12, 2020, 06:23:36 pm
content: Several "real" file systems have mount options to wipe file when deallocated. It really slows down must system so you don't see it used very often. Other filesystems will write zeros on allocate.One thing you can do complete defrag your disk. That will consolidate all he free space. Then write a file of all zeros using all he free space. hat should get things cleaned. However as someone else side, if he OS has bits and parts in things lichee Registry, then you need to find something to clean that up.Confidential or not, some places run a drive wipe program before disks are taken out of service. They write a radon pattern over the whole disk, then all ones, then all zeros, then a different pattern. In all about 7 passes. It takes a bit to run. If that is not done, then drive gets put in a degaussing machine. In many cases after either of these, the drive is then crushed.

author: Messtechniker
author_rank: Frequent Contributor
timestamp: April 12, 2020, 06:43:13 pm
content: By the way: when destroying HDDs it may be worthwhile to salve the very strong magnets within.

author: magic
author_rank: Super Contributor
timestamp: April 12, 2020, 06:43:26 pm
content: Quote from: SiliconWizard on April 12, 2020, 05:54:27 pmThe closest standardized solution is the secure erase command. But in many (all?) instances it only involves generation of a new encryption key (all bits written to the flash chips are encrypted by the controller whether you want it or not) rather than actual erasure of data. You need to trust the hardware that it really forgets the old key for good and that it hasn't already leaked it somehow. That being said, it will work against a family member or similar attackerQuote from: Jr460 on April 12, 2020, 06:23:36 pmNo need to defrag. Your dummy file would fill fragmented free blocks just as well.

author: Ian.M
author_rank: Super Contributor
timestamp: April 12, 2020, 06:47:08 pm
content: Quote from: SiliconWizard on April 12, 2020, 05:54:27 pmOtherwise the only hand tools*that guarantees SSD data destruction are a Widlarizer and a medium mesh sieve. Apply Widlerizer enthusiastically until the flash chip residue can pass through the sieve!* A flowerpot full of Thermite cant really be regarded as a tool.

author: bw2341
author_rank: Regular Contributor
timestamp: April 12, 2020, 07:07:04 pm
content: Quote from: bostonman on April 12, 2020, 03:24:15 amI searched around a bit on the topic and even figured out a way using only Windows internal commands. Ultimately, I decided not to recommend them due to risk of data loss.Instead, I suggest manually copying a large file repeatedly to the target drive to fill up the free space. In File Explorer, if you paste the same file more that once, the extra copies will be renamed automatically.Choose a file that is 1 or 2 GB smaller than your system memory. That way, you can paste it over and over without having to reread it from the source disk.If you are referring to CCleaner, it looks like it has a Wipe Free Space function. If you fully trust this program, you can give it a try. I have not tried this program myself.

author: 0db
author_rank: Frequent Contributor
timestamp: April 13, 2020, 09:06:41 am
content: Quote from: magic on April 12, 2020, 09:33:43 amGoogle crushes, shreds old hard drives to prevent data leakage Google offers new glimpse into data center security practiceshttps://www.networkworld.com/article/2202487/google-crushes--shreds-old-hard-drives-to-prevent-data-leakage.html

author: 0db
author_rank: Frequent Contributor
timestamp: April 13, 2020, 09:07:58 am
content: QuoteSources:https://www.schneier.com/blog/archives/2005/03/sensitive_infor.htmlhttp://www.cnet.com/news/the-right-way-to-destroy-an-old-hard-drive/https://groups.google.com/forum/#!topic/digital-curation/n_f_bGQoNEc

author: mrflibble
author_rank: Super Contributor
timestamp: April 13, 2020, 04:16:19 pm
content: https://linux.die.net/man/1/shred

author: bostonman
author_rank: Super Contributor
timestamp: April 13, 2020, 04:20:00 pm
content: QuoteThis will shred deleted files only and not current ones I want to keep?

author: mrflibble
author_rank: Super Contributor
timestamp: April 13, 2020, 04:25:10 pm
content: Quote from: bostonman on April 13, 2020, 04:20:00 pmRTFM?From TFM:shred - overwrite a file to hide its contents, and optionally delete it

author: bw2341
author_rank: Regular Contributor
timestamp: April 14, 2020, 03:32:36 am
content: https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-fileAfter some testing, I worked out a procedure to manually zero out the free space on a drive using the Windows internal commandfsutil file. You should be comfortable with windows command line usage before attempting this. I used the traditional Command Prompt to do this. Powershell should work, but I don't have experience with it and have not tested it.First, make a new directory and change to that directory to have a safe place to work. Then do aDIR.Code:D:\D_workingDIR\fsutilTESTINGdir>dirVolume in drive D is D_DRIVEVolume Serial Number is FFFF-FFFFDirectory of D:\D_workingDIR\fsutilTESTINGdir04/13/2020 10:23 PM <DIR> .04/13/2020 10:23 PM <DIR> ..0 File(s) 0 bytes2 Dir(s) 1,234,567,168 bytes freeCopy the number of bytes free into the Windows Calculator. This is good place to store it and the commas will be removed when you copy out of Calculator and paste it back.Code:D:\D_workingDIR\fsutilTESTINGdir>fsutil file createNew foobarFREESPACE.raw 1234567168File D:\D_workingDIR\fsutilTESTINGdir\foobarFREESPACE.raw is createdThis creates a file that uses up all of the free disk space. On a FAT or FAT32 drive, this will take a long time as the entire file needs to be written. If so, the task is complete and you can delete the file. I haven't tested on a FAT or FAT32 drive myself. On NTFS, sparse file support means that there are additional steps.The next command has to be run in an Administrator Command Prompt:Code:D:\D_workingDIR\fsutilTESTINGdir>fsutil file setValidData foobarFREESPACE.raw 1234567168Valid data length is changedThe next command can be run as a regular user:Code:D:\D_workingDIR\fsutilTESTINGdir>fsutil file setZeroData offset=0 length=1234567168 foobarFREESPACE.rawZero data is changedsetZeroDatawill take a long time as it will write zeros to the file. Once it is done, you can delete the file and your free space should be zeroed.The commands are relatively safe to execute. The main risk is if you use the tab key for file name autocomplete, you might pick up the wrong filename and permanently delete one of your files.createNewis safe as it can only create a new file.setValidDatacan corrupt the file by changing the file length.setZeroDatawill irrevocably erase the data in a file.IfcreateNewfails because of lack of free space, try reducing the file size by a couple kilobytes. Windows may be using some space for housekeeping, preventing you from allocating all the space. I've only tried this on a data only drive as I suspect Windows will complain if you use up all the space on the system drive.You might have to wait for the disk activity to stop before deleting the file as write caching may return you to the command prompt beforesetZeroDatais finished.On NTFS, there still may be some unerased personal information in the free space after this procedure. On very short files, NTFS stores the file data in the MFT record itself and this procedure will not affect the free space in the MFT record.

author: bostonman
author_rank: Super Contributor
timestamp: April 16, 2020, 04:06:57 pm
content: I planned to try the procedure listed, however, thought to give the program CC Cleaner another try - this time on seven runs.From what I can tell, it wipes out files completely because the HEX code shows 0s. What I'm seeing though: the file names are still present.The way I understand it: when Windows deletes a file, it basically deletes the pointer to the file (or in simple terms, it deletes the entry in the Table of Contents to use a book analogy). If the file is blank, why doesn't the file name get deleted as well?How can I delete the file name(s) from existence too?

author: tszaboo
author_rank: Super Contributor
timestamp: April 16, 2020, 07:37:17 pm
content: You copy the files to a new drive.You smash the old drive with a hammer.HDD and SSD is a commodity, and the information on it is worth more than the drive.

author: bostonman
author_rank: Super Contributor
timestamp: April 16, 2020, 11:12:19 pm
content: So you enjoy contributing to a throw away world?One reason EEVBlog exists is to share information and learn. Anyone can copy files and smash - although I'd choose to use a sledgehammer.

author: rdl
author_rank: Super Contributor
timestamp: April 17, 2020, 01:43:17 am
content: Well, if the drive is being replaced or taken out of service for whatever reason, nuking from orbit is the only way to be sure. Doesn't work so good for a drive that's in active use. I'm beginning to think encrypting and sequestering sensitive data is the better way. Doesn't help much with existing data though and adds its own set of problems.

author: bostonman
author_rank: Super Contributor
timestamp: April 17, 2020, 02:06:49 am
content: QuoteEncrypting is the best way. Most of the data that I want wiped away forever is general stuff. Nothing that would have needed encrypting had I considered such a method from the start.The drive will be kept with backup data on it, however, certain data (including file names) I'd like wiped away for good.My last question was regarding how and why do the file names still exist even if they data is all showing HEX 0s?

author: rdl
author_rank: Super Contributor
timestamp: April 17, 2020, 02:19:56 am
content: What file system is it and where do the file names still exist?

author: rsjsouza
author_rank: Super Contributor
timestamp: April 17, 2020, 02:49:04 am
content: In Windows I usually use Puran Utilitieshttp://www.puransoftware.com/Puran-Utilities.html

author: bw2341
author_rank: Regular Contributor
timestamp: April 17, 2020, 02:01:44 pm
content: Can you clarify the program you're using?CCleaner (two C's) is a utility program that's been around for more than a decade.CC Cleaner (three C's) is apparently a scam program according to antimalware companies.Quote from: bostonman on April 17, 2020, 02:06:49 amI'm not in IT or CS. I'm just a Windows user, so do not take my advice as authoritative.NTFS stores file information in the Master File Table (MFT). Each file has an MFT record associated with it. If the filename of a deleted file is still visible in scanning software, the MFT record may be simply marked as empty instead of being overwritten when a file is deleted.I've read somewhere that Windows looks for the first free MFT record when it needs one for a new file. If so, all you have to do is create enough new files to exceed the highest number of files you have ever had on the disk. This will create 100 junk files.Code:D:\D_workingDIR\MakeDummyFilesDirectory>FOR /L %x IN (1,1,100) DO echo ABC123 > DummyFileNameBoyItsKindaLong1234567890ABCDEFGHIJ_%x.junkI used long filenames in the example as they may be needed to fully overwrite the old filenames of the deleted files. Scan the disk again to see if your old filenames are still visible. Check closely for partial filenames.

author: Doctorandus_P
author_rank: Super Contributor
timestamp: May 11, 2020, 09:58:40 pm
content: Linux with dd works great.If you want to keep it simple, then first delete all files, empty the recycle bin, and then write some random files to the HDD untill it complains it's full.Then write some smaller files untill the last bit is also filled.You won't get everything this way as some room is allocated for file names and such.You also have to watch out for different partitions on that drive.If the security of your data is more worth than a EUR60 second hand old HDD, then just take a hammer and hit it untill the platters are bent.Good exercise too.

author: Messtechniker
author_rank: Frequent Contributor
timestamp: May 12, 2020, 06:22:42 am
content: Quote from: Doctorandus_P on May 11, 2020, 09:58:40 pmBefore doing so, salvage the strong magnets first. These can be quite useful to collect small screws and other magnetic items from the floor. Make magnetic dishes. Attach printouts to steel panels (refrigerator, steel doors). Some of these magnets even have mounting holes. Useful to attach to wood panels.