Article Image

IPFS News Link • Technology: Software

Ask a Geek: How Can I Permanently Delete My Computer Files?

• http://www.popsci.com, By Jake Ludington
 Before you sell, donate, or recycle your old computer, beware: You may be handing personal information to strangers. Simply restoring the operating system to factory settings does not delete all data and neither does formatting the hard drive before reinstalling the OS.

To really wipe a drive clean, users will need to run secure-erase software. For Windows, the best bet is the command-line utility SDelete (free), which writes over the space on the drive. SDelete runs from any bootable disk or from the hard drive of another computer connected with a device such as the Universal Drive Adapter ($39.99). Linux users can try the Shred command, which overwrites files in a similar fashion.

On a Mac, the Erase command included with the Disk Utility application securely erases drive contents. As with SDelete, first delete files from the drive, then use the erase free space feature. It offers three options, from fastest, which writes zeros over unused disk space, to most secure, which overwrites the drive at least seven times. The middle setting is probably secure enough for most home users.

6 Comments in Response to

Comment by PureTrust
Entered on:

Thanks, Powell. I think that there are many of us who appreciate your info. It seems that http://csrc.nist.gov/publications/nistpubs/800-88/NISTSP800-88_rev1.pdf and http://www.vlug.org/pipermail/discuss/2009-June/026936.html aren't there any more. But there is a large amount of info in the other links, as well as further links, that corroborate what you say. So, thanks again.

Comment by Powell Gammill
Entered on:

I used to advocate using the secure erase feature built into ATA drives.  But have since gone to  recommending bootable software disk like DBAN, doing a single pass of zeros.  The built in secure erase was faster if properly implemented---but things have gotten so fast the time difference is negligible.  There is the possibility that some small amounts of any  non-volatile cached data on a hard drive will be erased using secure erase while a bootable software app will leave it.  But I am more afraid of badly implemented secure erase failing.  So I recommend the software. 

While hard drive based apps can securely delete files (I like "eraser"), it cannot delete itself while on that hard drive so pretty much is limited to free space (deleted files) and targeted files.  Ccleaner ver. 3.x you noted does a very good job, but first you should delete all temp files before running their wipe function.  Even then the pagefile remains untouched.

Apps like Eraser that wipe files out do not wipe free space (unless requested) so older deleted, replaced or temp versions of any file you wiped will remain until such a deletion of any shadow copies in any form are marked deleted and then a freespace wipe is performed.

http://eraser.heidi.ie/

http://www.dban.org/ [usually found on useful recovery boot disks]

Lastly, if you are really paranoid, encrypt the drive with Truecrypt using some wild string password that you have no record of and then wipe the drive with zeros.  If they recover any of it they then have to break the encryption.   Encryption is a good idea anyway if you have things you wish to remain private as long as you don't forget the password.  Government may be able to break encryption but based upon recent trials where defendants were ordered to provide passwords it looks pretty safe.

Comment by Powell Gammill
Entered on:

That was based upon a theoretical recovery of FLOPPY disks and hypothesized as pertinent to MFM/RLL hard drives as well.  I answered this on a computer forum this way: 

You are stating as fact what is simply not applicable to ATA drives.  It is erroneous information that I too spread around at one time: The idea that forensic recovery was possible on HDDs unless (or even if) multiple erasure (overwrite) wipes were performed. This misconception comes from the Gutmann paper which was applicable (and largely theoretical) at the time.  But came from research on recovering overlapped magnetic tracts from old floppy and MFM style drives due to the nature of the head positioning in writing down tracks ("tracking alignment error"). 

On ATA drives the tracks are pre-laid down at the factory and the head does not deviate on writing.  There is no adjacent stray tracking of data left behind on an overwrite to recover.  [Although there is the unlikely possibility of a sector(s) with data being marked as bad and not getting wiped, that could later be recovered off of ATA drives.]  Gutmann himself has conceded this ... things have changed since he wrote the 1996 paper.

All ATA drives over 20Gb have built in single pass zero wiping capability -- unfortunately its implementation even though a standard of the ATA spec is inconsistantly handled by various HDD mfgs. (Maxtor drives fail at implementing for instance)  This single pass is considered sufficient to keep anyone from recovering data (see authoritative NSA PDF paper link below).  A single pass of zeros can also be done with software.

http://www.cs.auckland.ac.nz/~pgut001/pubs/secure_del.html [read in particular Gutmann's epilogues] [Also note the unfortunate dual use of the acronym MFM, which means "Modified Frequency Modulation" for an older hard drive AND "Magnetic Force Microscopy" for an electron microscope used to detect magnetically aligned bits in the same paper.]

http://cmrr.ucsd.edu/people/Hughes/SecureErase.shtml

http://www.h-online.com/security/news/item/Secure-deletion-a-single-overwrite-will-do-it-739699.html

http://www.nber.org/sys-admin/overwritten-data-guttman.html

http://csrc.nist.gov/publications/nistpubs/800-88/NISTSP800-88_rev1.pdf

http://www.vlug.org/pipermail/discuss/2009-June/026936.html

http://hostjury.com/blog/view/195/the-great-zero-challenge-remains-unaccepted

http://www.anti-forensics.com/disk-wiping-one-pass-is-enough

http://www.heliosdf.com/blog/?p=47

Comment by PureTrust
Entered on:

Just a question, Powell. There has been some talk in the past that there is residual magnetism that is hidden below the sensitivity level in which an average drive reads. This magnetism, supposedly, remains to some extent, even after being overwritten. If one obtains special equipment that is sensitive enough to read this residual magnetism, he can read both the new, and part of the old. Is this true? Or is it just a story to create fear in the minds of people so that they buy software that they don't need. Or is it something that was true in the past, but doesn't work like this any more because of how sophisticated modern HDs are?

Comment by Powell Gammill
Entered on:

1.  The article is in error---I know hard to beleive for PopSci.  If you long format in Vista or Windows 7 or 8 the data is unrecoverable.  XP's long format however does not do a write check to each sector just a read and so is easily recoverable with recovery software.  I've done it.

2.  You do not need to do multiple sweeps (passes) of data deletion.  A single pass of zeros is enough to keep even the NSA from recovering data on the drive.  There is some discussion about the potential for data retention on bad sectors that have been pulled and non-volitile caches on the hard drive.  

3.  Drilling holes in a drive's platter in no way keeps data from being recovered in the vast majority of areas NOT drilled through.

Comment by PureTrust
Entered on:

Ccleaner and File Shredder have the option to overwrite drives 35 times. And they are free.



thelibertyadvisor.com/declare