Spyware, viruses, & security forum: Question about eraser type programs

it over writes the unused disk space with zeroes and does so 35 times per space.

I use it also on the files in the recycle bin and when I next check they are not there.

I believe it uses the same principle as the Department of Defense.

I believe your program saw the zeros and maybe the odd cluster tip but virtually all information is overwritten.

Believe it is called the Guttman method.

If you want it please email me at the address in my profile and I can send it to you.

Believe I have a couple of email addy's for you but they go back to before you renovated your place and son joined Armed Forces so may not be current.

had already shut down for the night.

Edward O' Daniel has covered what I was going to say that is no matter how many times you erase, a good electro magnetic recovery device in optimum lab conditions may be able to recover enough to hazard a very educated guess as to what the file contained in terms of information.

Personally I do not think a file written to a H/D embeds itself so deeply that it can be recovered in it's entirety, but will bow to Mr. Daniel greater insight into it.

Eraser also has a forum and one piece of software that is on both version 5.6 and 5.7 is called Darik's Nuke Boot disc or Darik's Boot Disc?.

I believe you can download it to floppy and when run it nukes the entire H/D.

I suppose the scenario could be FBI hammering your door down as you insert the floppy and start the PC up and hope it nukes the H/D but I have never seen it in action or put another way I have not nuked or had reason to nuke, my hard drive.

that (in layman's terms) because of magnetic memory a well equipt lab could still get data off your drive no matter how many times you overwrite it.

The more times it is overwritten the harder it becomes to get that data but it does remain. That is why, despite the commonly referred to as "DoD secure wipe" capabilities of various programs the Department of Defense and NSA and all other Federal agencies that handle top secret files, the hard drives are carefully wiped with such and then TOTALLY DESTROYED by mechanically hammering them into tiny unrecognizable bits.

Most civilian data is not that sensative nor do most of us have anyone willing to spend the kind of money necessary to obtain our deleted data though so a wipe usually suffices (with character overwrites just being gravy).

Now, on to the question of why the file name remains. (Think FAT and MFT while reading the following.)

You have a refrigerator and it has many glass containers of food and drink. You are very organized and have a LIST (or index) on the door of that refrigerator that names what is in which container and where the container is. You decide to have someone clean out the refrigerator and they just dump the containers then replace the empty container where it was. You look in the refrigerator and all you see is empty containers. IF YOU LOOK at the LIST (or index) on the refrigerator door though you can tell what was in which container and where it was located.

RECOVERY - the file recovery utility I mentioned to you in another thread -- will not only find deleted files it will delete them AND IF YOU OPT TO after the deletion it will RE-WRITE the file table which removes all mention of the deleted files.

and I can nearly always count on you to point me in the direction I need to be looking in for answers to things I hadn't even thought about.

I've been pretty busy the last few days and was gone the entire day today working on somebody's computer.

I'll be heading to the links you gave...and I know you mentioned the Restore or Recovery program before, but I didn't let it penetrate that it could also delete when you mentioned it the first time. I'll be looking into that program as well.

I appreciate the effort you and others went to regarding informing me about programs, and I really appreciate the link to more in-depth explanations about what I was questioning in my first post of this thread.

TONI

First of all, most IT departments aren't going to use file recovery tools to check every computer that is turned in for reuse. ON the other hand, you never know. How much you need to clean up depends on how much personal stuff is on the computer. On my personal office machines, I would have no difficulty simply deleting a few items in "My Documents" and passing it along. I leave the personal stuff to my HOME computer.

It's not clear what you mean by: "What do civilians need to do to keep an IT Department from snooping as they re-purpose a hard disk?" If a user is turning in their computer/hard disk to an IT Department, then they really aren't "civilians" but instead are "employees" of a company. I also see no instance when a laptop needs to be turned in in an "hour or two"..The company owns the computer and, at least in our case, we don't allow our employees to do ANYTHING with the computer or hard disk that would involve erasures of the formatting or operating system. The IT department or system admin does all of that.

On the other hand, if our agency is surplusing computers which we resell to the public, we do multiple overwrites/erasures with Killdisk, etc. depending on the sensitivity of the data on the disk. It takes hours to perform multiple erasures. With extremely sensitive data, the disk is actually destroyed and the computer is resold sans the disk.

I do the same for customers when donating to the local charity. If it's standard home user stuff where the data isn't critical, I make 3 or four passes with Killdisk which might take an hour for each pass then reformat and reinstall the OS. If the computer contains sensitive data such as employee social security numbers and such, I'll ask the customer which they prefer. Destruction of the HD or multiple passes..

Hope this helps.

Grif

...you don't want recovered. That's the most "practical approach" I can give you. A company computer should be used for company purposes only. If you don't want your Outlook contacts recoverable, don't put them on the computer. Then again, computer techs are too busy to randomly use recovery software to find your contacts. It's not worth the effort or the time.

As to turning in a hard drive to get a new one, we don't do that..If and when a computer hard drive dies, we'll replace it. On the other hand, if you're replacing your old drive with a new one and really don't want data recovered, then a ball-pean hammer does a great job at destroying the hard disk AFTER the disk is removed from it's enclosure.

As I suggested earlier, it's a personal decision on how important that data is. More wipes and overwrites means more security and in most cases, 3 to 4 passes with Killdisk will do a good job except for the most ardent recovery artists.

Hope this helps.

Grif

Ed - Guess I do not understand erasing well. Thanks for letting me know thata single overwrite is easy to resotre. I believe you left the link out which may have explained further. You seem to be saying that software recovery or relatively straight forward recovery is possible after one write. It makes sense or you would not see discussion of 35 writes etc. Would like to understand this better though. Please send me a link.

How would you recommend avoiding disclosure of emails and documents as well as browser cache and swap files to a strong IT Help Desk/hardware group ie 200 person. Not a forensic recovery group.

I will make another posting with other questions.

Thanks for the help.

You may want to look into file encryption software. PGP and Stegonos are two that come to mind. PGP stands for Pretty Good Privacy by the way. I would look for a program that allows you to create an encrytped section on your hard disk that can be accessed like a hard disk. This section would require a password to access the data stored there. With good encryption and a good password being used, you don't need to worry about anyone getting access to your private data. Even if you turn in your hard disk. The encrypted data is garbage to anyone with out the proper program and password.

Most shreaders are ok and work only as well as you want them to. I use a shreader called Wipe Drive from White Canyon Software.
It allows you to select several settings. 5 overwrites is what the Fed Gov. recommends. This means the program over writes the selected areas 5 times with random 1's & 0's. This many times is good enough where even the FBI would have a tough time recovering files.

If you're getting rid of your PC, think about doing this twice. Don't know about your software, but mine ruins from the CD/DVD so I can overwrite the entire hard drive(s)
As far as the "?" if your still using the hard drive you over wrote the empty spaces on, it just means the MBR (master boot record) is showing there should be a file there, but can't find it (because it's been over written) or because your program just changed part of it instead of completely over written the area.
That's why it's good to use a program you can trust

Information can still be recovered if you just delete the information and save the blank file. The file will only be zero to a few bytes, so the information isn't overwritten even once and can still be revovered with forensic recovery tools. If you think that this method is safe, you could be in for a rude awakening if there is ever any reason for someone to investigate your computer. As a matter of fact, if you use some programs, such as MS Word, with revision tracking on, your file won't even be smaller, it will actually be larger with the original information still contained within that file.

Toni,
I have found that most computer users don't know about or understand the way information is store or deleted on hard drives and floppy drives. Back in the ealier days of computing when hard drives and floppy drives arrived on the scen, computers were too slow to do an effective erasure of the storage media, so a trick was used to tell the operating system, OS, that the area on the media that once contained valid data is now free to be used again. The data never got erased until some thing new was written to that area by the OS. And then it was not a complete job. I remember many times I could find old data showing up in new files past the end of file markers. Then two products showed up on the market, Mace and Norton Utilities, that did actually erase this old data by going out and writting ones and zeros in specified patterns over the area of the hard disk or floppy disk marked as unused and free by the OS. Problem was that even this didn't completely erase the data. Companies like Krull/Ontrack specialize in data recovery and can recover data from hard disks that have been compleatly erased many times. The reason for this is because we live in an analog world. We can simulate that world digitally, but we still live in an anolog world. What that means as far as the hard disk is concerned is that the data that is written to the hard disk platters is actually magnetic patterns stored on a layer of iron oxide much the same way that music and voice are recorded to recording tape and these magnetic patterns are very hard to completely erase. That's why the DOD came up with the multipattern over write scheme use in Norton Utilities and some others. What this does is to write the entire disk, or areas you choose, with one pattern of ones and zeros. Then go back and rewrite that same area with a different pattern of ones and zeros and do this over and over many times. The result is that the information once stored on the hard disk is very difficult to recover if at all. Unfortunately this methode is very time consuming and to be effect, will take all day. In the DOD and any contractors working with them, the hard disks are simply removed and totally destroyed. This makes it extremely difficult to recover any data, but just on the off chance that someone could, the remains of these harddrive are stored in a secure area just to be sure no one can recover the data. Of course this is an extreme case and doesn't apply to most of us, but it just goes to show how hard it is to completely remove data from a hard disk once it's been written. If you just want to make sure that the hard disk is clean for the most part, you should use Norton Utilities or simular application to erase the disk with ones and zeros. If you want to make sure the disk is completely clean before selling it, I would write the disk using the DOD methode then do a low level format then a high level format. This will prevent 99% of the people from ever reading what was on your disk. Otherwise if you are really paranoid, do what the DOD does and disassemble and destroy every part of the platters. Fire works well I understand. Of course you have the EPA rules to deal with on that one, don't want to pollute the environment you know. Hope this answers your question.