Spyware, viruses, & security : Question about eraser type programs
Actually Pam a single overwrite is easy to restore...
by Edward ODaniel - 2/7/06 7:47 PM In reply to: What is practical and good enough? by PamJonesinformation from.
And that includes a quick re-partitioning and even formatting before or after the overwrite.
You stated that "Writing over one time would be sufficient to stop this snooping. The multiple writing are only for very sophisticated hardware recovery techniques where people are looking at trace magnetism. Without a lab an IT Department would not do this."
Here is a link to one of the less expensive data recovery apps and at $69 everyone should have a copy for their own use. At this point we are not even concerned with magnetic memory effects which more sophisticated software will touch on and some of that isn't really very expensive either.
Download the above recovery software and run the trial and you will find yourself disabused of the idea that data recovery after an overwrite is "only for very sophisticated hardware recovery techniques".
Having said that, MOST CIVILIANS will not have much on a drive that is actually worth even slight effort for forensic recovery although some emails and documents as well as browser cache and swap files can be counted on to provide some interesting and potentially incriminating evidence.
Overwriting is easy to restore...
by PamJones - 2/8/06 11:11 AM In reply to: Actually Pam a single overwrite is easy to restore... by Edward ODanielEd - Guess I do not understand erasing well. Thanks for letting me know thata single overwrite is easy to resotre. I believe you left the link out which may have explained further. You seem to be saying that software recovery or relatively straight forward recovery is possible after one write. It makes sense or you would not see discussion of 35 writes etc. Would like to understand this better though. Please send me a link.
How would you recommend avoiding disclosure of emails and documents as well as browser cache and swap files to a strong IT Help Desk/hardware group ie 200 person. Not a forensic recovery group.
I will make another posting with other questions.
Thanks for the help.
Sorry, I did forget the link so...
by Edward ODaniel - 2/8/06 9:15 PM In reply to: Overwriting is easy to restore... by PamJoneshere it is - http://www.recovermyfiles.com/
Here is another one - http://www.r-tt.com/ (or rather a set)
and here you go with yet another set of tools and ALLthese different tools can be used in conjunction with each other - http://www.ontrack.com/software/
What I would recommend is to NEVER use a company computer for anything you would have to worry about someone running across your data that you would rather not be seen and that of course would include personal banking etc.
If you need to keep it on your computer...
by dgc49 - 2/27/06 12:52 PM In reply to: Overwriting is easy to restore... by PamJonesYou may want to look into file encryption software. PGP and Stegonos are two that come to mind. PGP stands for Pretty Good Privacy by the way. I would look for a program that allows you to create an encrytped section on your hard disk that can be accessed like a hard disk. This section would require a password to access the data stored there. With good encryption and a good password being used, you don't need to worry about anyone getting access to your private data. Even if you turn in your hard disk. The encrypted data is garbage to anyone with out the proper program and password.
the BEST program that I have found
by Slasher - 2/13/06 2:23 AM In reply to: Question about eraser type programs by TONI HIs eveidence Eliminater:
http://www.evidence-eliminator.com/
It ~say~ that it is as good as a profesional program that may cost hundreds of $ and that the FBI won't be able to recover anything after you use it. I actually did the trial (i think trial period is a month or something) and it worked VERY well.
I can't remember EXACTLY all that it does as I used it about 6 months ago. But if you go to this page: http://www.evidence-eliminator.com/features.d2w (which is the list of its features) you can check it out. I do remember that as well as destroying normal detleted stuff it also takes out all histories of recent documant and loads of other stuff (which you can change in the settings).
Anyway you can check it out for free for a while so take a look! Oh and BTW the trial has all the features so you can look at it all.
Depends on you.
by hawk318 - 2/13/06 6:30 AM In reply to: Question about eraser type programs by TONI HMost shreaders are ok and work only as well as you want them to. I use a shreader called Wipe Drive from White Canyon Software.
It allows you to select several settings. 5 overwrites is what the Fed Gov. recommends. This means the program over writes the selected areas 5 times with random 1's & 0's. This many times is good enough where even the FBI would have a tough time recovering files.
If you're getting rid of your PC, think about doing this twice. Don't know about your software, but mine ruins from the CD/DVD so I can overwrite the entire hard drive(s)
As far as the "?" if your still using the hard drive you over wrote the empty spaces on, it just means the MBR (master boot record) is showing there should be a file there, but can't find it (because it's been over written) or because your program just changed part of it instead of completely over written the area.
That's why it's good to use a program you can trust 
eraser type programs
by DurangoJazz - 2/22/06 12:01 PM In reply to: Question about eraser type programs by TONI HI use a simple method of permanently erasing what I don't want others to see. Usually it is pages that you are erasing and not whole programs, at least that is usually what I want permanently erased. While you must be very careful about is what you name these files which you can always change just before you erase, what works best for me is to pull up the file or page you are concerned about, highlight everything on it, delete the entire file and save the "blank" file. Now delete the file and you can un-delete all day long only to retrieve nothing. Just a blank file.
Dee Jae
DurangoJazz@hotmail.com
That won't work reliably
by Grey Bird - 2/27/06 6:19 AM In reply to: eraser type programs by DurangoJazzInformation can still be recovered if you just delete the information and save the blank file. The file will only be zero to a few bytes, so the information isn't overwritten even once and can still be revovered with forensic recovery tools. If you think that this method is safe, you could be in for a rude awakening if there is ever any reason for someone to investigate your computer. As a matter of fact, if you use some programs, such as MS Word, with revision tracking on, your file won't even be smaller, it will actually be larger with the original information still contained within that file.
There is a small problem with this idea....
by dgc49 - 2/27/06 1:24 PM In reply to: eraser type programs by DurangoJazzIt's apparent that most respondants to this posting are not aware of how Operating Systems work.
When a file is saved, it gets saved at one physical location (assuming theres enough space on the HD so the file is not fragmented). The next time the file is saved, it will be written to a different location on the HD. The next time to a different location. And all the while, the original file will still exist on the HD. It's just been marked as deleted and the File Allocation Tables marked to indicate that this space if free to be written to again. Until the OS decides to actually write something to that space, the data still exists and usually intact. File erasers/shreaders will phyically write data to the location where that file exist to over write it and effectively erase it. However as I stated in one of my other posts, that data may still be recoverable with the right hardware/software combination.
Hard drive security is an illusion
by dgc49 - 2/27/06 10:50 AM In reply to: Question about eraser type programs by TONI HToni,
I have found that most computer users don't know about or understand the way information is store or deleted on hard drives and floppy drives. Back in the ealier days of computing when hard drives and floppy drives arrived on the scen, computers were too slow to do an effective erasure of the storage media, so a trick was used to tell the operating system, OS, that the area on the media that once contained valid data is now free to be used again. The data never got erased until some thing new was written to that area by the OS. And then it was not a complete job. I remember many times I could find old data showing up in new files past the end of file markers. Then two products showed up on the market, Mace and Norton Utilities, that did actually erase this old data by going out and writting ones and zeros in specified patterns over the area of the hard disk or floppy disk marked as unused and free by the OS. Problem was that even this didn't completely erase the data. Companies like Krull/Ontrack specialize in data recovery and can recover data from hard disks that have been compleatly erased many times. The reason for this is because we live in an analog world. We can simulate that world digitally, but we still live in an anolog world. What that means as far as the hard disk is concerned is that the data that is written to the hard disk platters is actually magnetic patterns stored on a layer of iron oxide much the same way that music and voice are recorded to recording tape and these magnetic patterns are very hard to completely erase. That's why the DOD came up with the multipattern over write scheme use in Norton Utilities and some others. What this does is to write the entire disk, or areas you choose, with one pattern of ones and zeros. Then go back and rewrite that same area with a different pattern of ones and zeros and do this over and over many times. The result is that the information once stored on the hard disk is very difficult to recover if at all. Unfortunately this methode is very time consuming and to be effect, will take all day. In the DOD and any contractors working with them, the hard disks are simply removed and totally destroyed. This makes it extremely difficult to recover any data, but just on the off chance that someone could, the remains of these harddrive are stored in a secure area just to be sure no one can recover the data. Of course this is an extreme case and doesn't apply to most of us, but it just goes to show how hard it is to completely remove data from a hard disk once it's been written. If you just want to make sure that the hard disk is clean for the most part, you should use Norton Utilities or simular application to erase the disk with ones and zeros. If you want to make sure the disk is completely clean before selling it, I would write the disk using the DOD methode then do a low level format then a high level format. This will prevent 99% of the people from ever reading what was on your disk. Otherwise if you are really paranoid, do what the DOD does and disassemble and destroy every part of the platters. Fire works well I understand. Of course you have the EPA rules to deal with on that one, don't want to pollute the environment you know. Hope this answers your question.
| Forum legend: | |
 |
Locked thread |
 |
Moderator |
 |
CNET staff |
 |
Samsung staff |
 |
Norton Authorized Support team |
 |
AVG staff |
 |
Windows Outreach team |
 |
Dell staff |
 |
Intel staff |
