Computing.Net > Forums > Windows 95/98 > Deleted Files--Realy Gone?

Deleted Files--Realy Gone?

Reply to Message Icon

Original Message
Name: Raptor
Date: April 17, 2003 at 20:08:40 Pacific
Subject: Deleted Files--Realy Gone?
OS: Windows98 S.E.
CPU/Ram: 400mhz/128mb
Comment:

Over the years ive stored and deleted several personal things from this computer (i.e. credit card #'s, addresses, etc) and am wondering if by simply deleting them if they realy gone and nobody can ever find them?
Someone told me that they could be recovered by someoen who knows a little about computers..i DON'T want that to happen so is there a special program or something that i can use to permenantly delete files that ive deleted in the past?
Thanks.


Report Offensive Message For Removal


Response Number 1
Name: johnoh
Date: April 17, 2003 at 20:21:07 Pacific
Reply: (edit)

Once a file is gone from the recycle bin (I assume you have done that) the sectors it used to occupy are flagged as usable and the next files that need to be written will tend to overwrite the space the deleted file used to take up, making it impossible to recover after some time has passed and more files have been written. So unless you are worried about a file you deleted last night that someone may go looking for in the morning, you are probably okay.

Here is a free program that actually overwrites a files sectors once its deleted, so it can never be recovered.

http://www.wizard-industries.com/sdel.html


Report Offensive Follow Up For Removal

Response Number 2
Name: Raptor
Date: April 17, 2003 at 20:24:24 Pacific
Reply: (edit)

oh ok cool. I stopped putting important stuff on my PC a few nights ago so over time they will be deleted i guess.
Thanks alot johnoh!!! :-)


Report Offensive Follow Up For Removal

Response Number 3
Name: Allen2
Date: April 17, 2003 at 22:18:30 Pacific
Reply: (edit)

Not quite so fast: how quickly deleted files are overwritten obviously depends on how much data you've written to your hard drive since deleting the files, and where on the drive those files (or their fragments) were. Also, file slack space can contain previously "deleted" data - how much is there depends on the cluster size.

The best thing you can do is run a proven utility that will overwrite free space (some will also wipe slack space, a more intensive operation), and if in the future you do store sensitive data, either use a virtual-drive encryption program (such as DriveCrypt), or use a wipe utility to erase sensitive files instead of Win-deleting them and waiting for them to be overwritten.

Then there's the swap file (less of a concern for most people, since data is more likely to be quickly overwritten). All kinds of data can be written to this file as part of virtual memory operations, especially on low memory systems. There are Windows utilities that will include the swap file in their wipe, but these aren't as secure as ones that overwrite swap space from DOS (which require that you have a permanent swap file set).

Otherwise, for an extra measure of security before selling or disposing of a computer, get a DOS wipe utility or other low-level eraser, such as a zero-write utility included with some hard drive setup discs, and completely overwrite the drive, data and all, then set up the system from scratch if selling it. That's the only way to have some assurance that your data is safe from software recovery methods (some of which can find and retrieve old, deleted paritions, complete with many intact files, on re-formatted drives that have not been overwritten).


Report Offensive Follow Up For Removal

Response Number 4
Name: sekirt
Date: April 18, 2003 at 00:32:51 Pacific
Reply: (edit)

Raptor

Who is it that you think will get this information from your computer?

If you are talking about the FBI or similar, you probably will have to take your hard drive out and cut it up.

It is really a matter of degrees and how much time you want to spend on it. Most people (I bet you don't) don't even have programs to recover data that has been erased. Even though I encouraged everyone on this forum to get one, in case they accidently delete something. In fact, most people wouldn't know and wouldn't care to.
Even beyond that, say you left your credit card number intact and sold your computer. With so many files, most people still wouldn't find it. And it might be an
encrypted file on your hard drive anyway.

I agree with Johnoh. And when you go to sell your computer, use that freeware to wipe the drive and reformat at that time.
sekirt


Report Offensive Follow Up For Removal

Response Number 5
Name: michael2
Date: April 18, 2003 at 01:33:01 Pacific
Reply: (edit)

v6.2 (v6.0 was a major upgrade)
(Only 0.6 Mb)
http://www.theabsolute.net/sware/clndisk.html
- Comprehensive disk cleaning for the very tightest security (for Win95, Win98, WinME, WinNT, Win2000, WinXP) -
What is Clean Disk Security? - This program gives you secure file deletion, making sure that deleted files cannot be undeleted again. Deleting a file normally just removes the file's directory entry, but the data itself remains on the disk. This program completely eliminates the contents of deleted files. The highly acclaimed Gutmann disk cleaning method is now available as an option. This program can also clean the Window's swap file, and can optionally clean unneeded temporary files from your hard disk, such as your Internet browser cache, files in your system's Recycle Bin, and can clear the "recent files" list. Comes with a direct disk viewer for discovering exactly what is on your hard disk.
- Don't sell your hard drive before cleaning it with Clean Disk Security

Then check the files are realy gone....

http://www.pcinspector.de/file_recovery/uk/welcome.htm
95/98/ME/NT/2000/XP
In order to display the HTML help files on WINDOWS 95, you need to download and install the "HTML HELP SUPPORT" from the MICROSOFT Web-site. This is already included in WINDOWS 98/ME/NT/2000/XP
Under Windows XP you will have to have Administrator rights, so that all logical drives will be displayed to you.

PC INSPECTOR™ File Recovery 3.x is freeware. By freeware is meant programs that can be obtained, used and distributed free of charge.
PC INSPECTOR™ File Recovery 3.x is a data recovery software tool that is made available free of charge. Please note that you may only use the software if you agree to the following license conditions. CONVAR does not provide any support for PC INSPECTOR™ File Recovery 3.x.
PC INSPECTOR™ File Recovery is a data recovery program that supports the FAT 12/16/32 and NTFS file systems. The current version 3.x replaces the previous version 2.x, which is now over 6 years old.
Here are some of the new features in PC INSPECTOR™ File Recovery 3.x
Finds partitions automatically, even if the boot sector or FAT has been erased or damaged (does not work with the NTFS file system)
Recovers files with the original time and date stamp
Supports the saving of recovered files on network drives
Recovers files, even when a header entry is no longer available. Competition products cannot recover such files. The "Special Recovery Function" supports the following disk formats:
ARJ AVI BMP CDR DOC DXF DBF XLS EXE GIF HLP HTML HTM JPG LZH MID MOV MP3 PDF PNG RTF TAR TIF WAV ZIP
HOW TO USE
After starting the program, you should first select the desired language. A menu will then appear in which you can select from three different reconstruction methods.
On the next page you can chose one of three reconstruction possibilities. The program includes an extensive html help
Please note that PC INSPECTOR™ File Recovery 3.x cannot reconstruct files from data carriers that are mechanically or electronically damaged. You should only use data recovery software if you are very confident in the use of your PC.
If your hard disk or other data carrier has a mechanical or electronic defect or you do not feel confident in the use of data recovery software, we suggest that you contact a data recovery company such as "CONVAR - The Recovery Team".
http://www.convar.com/


Report Offensive Follow Up For Removal


Response Number 6
Name: Allen2
Date: April 18, 2003 at 01:33:24 Pacific
Reply: (edit)

Actually, there is the Gutmann method for deleting data beyond all but possibly the most sophisticated hardware-based recovery methods (very expensive ones that agencies like the NSA have). But of course, that's overkill in the vast majority of cases, even for corporate offices dealing with sensitive files.

As for finding the data and who might do so, these days it's easier than ever to find and recover files that haven't been properly erased, and yes, there are those who would love to get hold of account numbers, social security numbers (such as from tax files), etc. from an old PC - for one thing, identity theft is an increasingly "popular" crime (and snooping is more popular than ever too). Even unscrupulous PC technicians have been known to scan the hard drives of unsuspecting clients after fixing a disabled computer.

I don't advocate that people bend over backwards, but it's not like it's hard to take a few extra steps to enhance security. And you can't always foresee all the circumstances under which you might need that extra security.


Report Offensive Follow Up For Removal

Response Number 7
Name: Bryco
Date: April 18, 2003 at 03:35:28 Pacific
Reply: (edit)

I agree that the degree of measures to take would be dictated by your personal circumstance and the nature of the information you want to mask.

If the FBI or Homeland Security wants your info then good luck but anything short of that it is really quite simple.

Let's say we are talking about the C: drive and it's partition is 10gb or 20gb in size and the situation is that you wrote a love letter to a girl that is not your current girlfriend. You realized the error of your ways and deleted it without ever printing it out. Now, your current girlfriend has asked for some time on your PC to try out a program she heard about that recovers deleted files.
1. Defrag the partition.
2. Determine the amount of free space.
(Let's use 4gb for our example and your MP3 folder contains 2.5gb of files)
3. Create 2 new folders named Love1 and Love2.
4. Copy the MP3 folder to each of the new folders filling up all of the free space.
5. Delete the two Love folders and defrag again.

Doing the above will leave no space that has not been overwritten. Recovery software will only find what was last written to the cluster.

The mentioned Slack space will contain info of the file that is underutilizing that specific cluster and nothing more.

Your first love will find many MP3 files and not the info about the girl you would love to...Hmmm, maybe you shouldn't use folder names as Love1 and Love2

Repeat the process as many times as you like but once will do the trick.

Bryan


Report Offensive Follow Up For Removal

Response Number 8
Name: Dan Penny
Date: April 18, 2003 at 06:02:40 Pacific
Reply: (edit)

I agree with Bryco. Usually a defrag, then a massive write (copying a CD or two), then delete and defrag again, maybe a couple of times, will usually get the sectors sufficiently overwritten. You would need some pretty sophisticated software to recover things. All the other responses have merit mind you, but I usually just keep copying/deleting/defraging to the drives capacity a couple of times, then do a killhdd.bat/format once or twice for good measure. If the FBI wanted my drives, then I'd bake them in the oven, take them apart, and destroy the platters with tin snips, hammers, and a big vise. ;>)


Report Offensive Follow Up For Removal

Response Number 9
Name: Allen2
Date: April 18, 2003 at 13:16:17 Pacific
Reply: (edit)

No data in the slack space?? It would seem that actual data can exist in slack from files that previously occupied those clusters and were not properly deleted. When new files are written to the clusters, the resulting slack space (possibly containing the "deleted" data from previous files) is generally off-limits to being overwritten. Correct me if I'm wrong, but this is why slack space can be a concern, especially on large volumes with lots of it. And this is why the good wiping utilities include a separate slack space wipe function - for those people who up till now haven't been overwriting sensitive, unencrypted files.


Report Offensive Follow Up For Removal

Response Number 10
Name: Bryco
Date: April 18, 2003 at 16:10:12 Pacific
Reply: (edit)

Allen2, You make a good point. On a 32kb cluster the possibility does exist that data remains because there is a lot of room there. But, one would have to go pretty deep to extract the unused portion of a particular cluster.

I personally do not know the cluster construct so I can not confirm nor deny the possibility.

Correctly or incorrectly I perceive it similar to a glass of water, in order to put something in it then it has to be empty first. So, I assumme that the individual cluster would be zero'd out when any data is written to it or else it would be corrupt.

Bryan


Report Offensive Follow Up For Removal






Use following form to reply to current message:

   Name: From My Computing.Net Settings
 E-Mail: From My Computing.Net Settings

Subject: Deleted Files--Realy Gone?

Comments:

 


  Homepage URL (*): 
Homepage Title (*): 
         Image URL: 
 
Data Recovery Software




Have you ever used OpenOffice?

Yes, as my main suite.
Yes, occationally.
Yes, but only once.
No, never.


View Results

Poll Finishes In 6 Days.
Discuss in The Lounge