1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

how to prevent retrieval of deleted files

Discussion in 'Windows XP' started by Christine, Mar 9, 2010.

  1. Christine

    Christine Flightless Bird

    I deleted some confidential files from D drives (harddisk paritioned into C
    & D drives)

    then I go to Recycle Bin to empty all.

    then I go do Disk Cleanup.

    Can the deleted files be un-deleted/retrieved?

    If not, how to fool-proof?

    Thanks
     
  2. Paul

    Paul Flightless Bird

    Christine wrote:
    > I deleted some confidential files from D drives (harddisk paritioned into C
    > & D drives)
    >
    > then I go to Recycle Bin to empty all.
    >
    > then I go do Disk Cleanup.
    >
    > Can the deleted files be un-deleted/retrieved?
    >
    > If not, how to fool-proof?
    >
    > Thanks


    This is one tool to use. It is free.

    http://eraser.heidi.ie/

    Allow the following file to download. Add a file extension to the end of the
    filename, of type PDF, to read the SANS report. The file name should be
    "secure_file_deletion_fact_or_fiction_631.pdf" in your download folder.
    This document will address some of the details about secure erasure.

    http://www.sans.org/reading_room/wh...fact_or_fiction_631?show=631.php&cat=incident

    What you've done so far, can be undeleted. The files are marked for
    deletion, but don't actually get deleted until the space is reused.
    Then the sectors would be overwritten. This is why other mechanisms or
    tools are required for more secure deletion. Information leakage
    is actually a pretty complicated subject, and requires a bit
    of study to avoid embarrassing accidents.

    Even encryption is not without its own pitfalls. When using something
    like EFS, if you aren't careful, you can still leave confidential
    information on a computer. And that means, as a mere user, you
    actually have to do a *lot* of research, to not leave your footprints
    all over the hard drive.

    My conclusion, after looking at the topic casually for a while, is
    you might as well rely on physically locking up a hard drive or USB
    flash, that has been used for confidential file usage, as it may be
    very difficult to ensure there isn't something incriminating on there.
    It all depends on what you feel the odds are, of someone attacking
    the disk with forensic tools. Temporary files can be left all
    over the place. Like, take Microsoft Word storing temporary copies
    of the thing you're editing, every five minutes. It isn't only
    the final file you've saved to the disk which is a concern. It is
    all the (multiple) copies created, stored and "deleted" temporarily
    you have to worry about as well. Those could be undeleted and
    recovered. Those sectors on the disk, still have the copy of the file,
    until a later write operation overwrites them. It means any tool
    with automated backup copy storage (which protects you against a
    computer crash), is also "leaking" your confidential file all over
    the disk.

    The best way I can think of, to avoid some of this, is to boot a Linux
    LiveCD with a copy of OpenOffice on it. A Linux LiveCD doesn't use a
    hard drive. Temporary files are stored in system memory. You only have
    to worry about the details of storing the resulting edited files, back
    on your storage device (portable hard drive or USB stick). When you
    turn off the computer power at the end of the day (via the switch
    on the back of the computer), the RAM contents will be lost. So
    any temporary files will be erased that way. But the portable hard
    drive or USB stick, is still a fertile ground for data recovery.
    And locking it up, or smashing it, are the only ways I can see of
    guaranteeing there isn't *something* on there. Formatting or erasure,
    may not clear the spare sectors.

    There is a kind of hard drive, that has full volume encryption
    implemented in hardware. If you lose the "key", the entire disk
    is so much random garbage. That would at least take care of
    some level of exposure. Even the spare sectors, if they happened
    to get used at some point, would be in encrypted form. Naturally,
    as with many encryption schemes, there is always a danger of you
    losing the key, and losing all the confidential files. More info here.

    http://en.wikipedia.org/wiki/FDE

    It's a fun topic.

    Paul
     
  3. duke

    duke Flightless Bird

    On Mar 9, 2:54 am, "Christine" <cent...@singnet.com.sg> wrote:
    > I deleted some confidential files from D drives (harddisk paritioned intoC
    > & D drives)
    >
    > then I go to Recycle Bin to empty all.
    >
    > then I go do Disk Cleanup.
    >
    > Can the deleted files be un-deleted/retrieved?
    >
    > If not, how to fool-proof?
    >
    > Thanks


    When you delete a file, followed by emptying the recycle bin, the
    actual file is not removed from the disk rather is tagged as deleted
    and the area is made available for reuse to the O/S. The problem is
    that the file will remain intact until eventually parts or all of it
    is overlayed with another file by the O/S.

    There are software tools available to identify these tagged files and
    restore them back.

    Similarly, there are tools available that will render the file useless
    by changing the entire contents of the files, before deleting them,
    even if someone does manage to restore the file.

    Googling >> strong delete files <<<< yielded several links such as
    the one below which included several shareware and freeware programs
    that will probably do the job you require.

    http://www.freedownloadmanager.org/downloads/wiping_software/

    Duke
     
  4. Doug

    Doug Flightless Bird

    I use http://www.handybits.com/shredder.htm


    Christine wrote:
    >> I deleted some confidential files from D drives (harddisk paritioned
    >> into C & D drives)
    >>
    >> then I go to Recycle Bin to empty all.
    >>
    >> then I go do Disk Cleanup.
    >>
    >> Can the deleted files be un-deleted/retrieved?
    >>
    >> If not, how to fool-proof?
    >>
    >> Thanks
     
  5. Centrol

    Centrol Flightless Bird

    I see.

    How about emails deleted from MS Office Outlook.
    Can I ensure the deleted emails are gone permanently?

    Plse advise.


    "Christine" <centrol@singnet.com.sg> wrote in message
    news:hn51dr$qqh$1@mawar.singnet.com.sg...
    >I deleted some confidential files from D drives (harddisk paritioned into C
    >& D drives)
    >
    > then I go to Recycle Bin to empty all.
    >
    > then I go do Disk Cleanup.
    >
    > Can the deleted files be un-deleted/retrieved?
    >
    > If not, how to fool-proof?
    >
    > Thanks
    >
     
  6. Bernd

    Bernd Flightless Bird

    -------- Original-Nachricht --------

    > I see.
    >
    > How about emails deleted from MS Office Outlook.
    > Can I ensure the deleted emails are gone permanently?
    >
    > Plse advise.
    >
    >

    Look here:

    http://support.microsoft.com/kb/291645

    Bernd
     
  7. Paul

    Paul Flightless Bird

    Centrol wrote:
    > I see.
    >
    > How about emails deleted from MS Office Outlook.
    > Can I ensure the deleted emails are gone permanently?
    >
    > Plse advise.
    >
    >
    > "Christine" <centrol@singnet.com.sg> wrote in message
    > news:hn51dr$qqh$1@mawar.singnet.com.sg...
    >> I deleted some confidential files from D drives (harddisk paritioned into C
    >> & D drives)
    >>
    >> then I go to Recycle Bin to empty all.
    >>
    >> then I go do Disk Cleanup.
    >>
    >> Can the deleted files be un-deleted/retrieved?
    >>
    >> If not, how to fool-proof?
    >>
    >> Thanks
    >>

    >
    >


    "Compacting" is supposed to remove things that are deleted. The deleting
    step doesn't really delete anything.

    http://ask-leo.com/how_do_i_shred_individual_emails_in_microsoft_outlook.html

    "Compact the PST. This really does delete the messages because it removes
    all the unused space from the PST. The unused space in the PST is returned
    to the operating system as actual free disk space."

    HTH,
    Paul
     
  8. Ken Blake, MVP

    Ken Blake, MVP Flightless Bird

    On Tue, 9 Mar 2010 17:54:31 +0800, "Christine"
    <centrol@singnet.com.sg> wrote:

    > I deleted some confidential files from D drives (harddisk paritioned into C
    > & D drives)
    >
    > then I go to Recycle Bin to empty all.
    >
    > then I go do Disk Cleanup.
    >
    > Can the deleted files be un-deleted/retrieved?
    >
    > If not, how to fool-proof?



    "Deleting" a file doesn't actually delete it; it just marks the space
    as available to be used. There are third-party programs that can
    sometimes recover deleted files. However the space used by the file is
    likely to become overwritten very quickly, and this makes the file
    unrecoverable.

    So the chances of successfully recovering this file are decent if you
    try recovering it immediately after deleting it, and rapidly go
    downhill from there. If you've been using the computer since then (for
    example to write this question and read this answer), the chances of
    undeleting may be very poor by now.

    There are third-party programs that overwrite the space the files used
    to take, bur needing to use one is rare. If you simply wait a few
    days, the space will be overwritten anyway.


    --
    Ken Blake, Microsoft MVP (Windows Desktop Experience) since 2003
    Please Reply to the Newsgroup
     
  9. Jim

    Jim Flightless Bird

    On Tue, 9 Mar 2010 08:06:31 -0500, "Doug" <datapod@yahoo.com> wrote:

    >I use http://www.handybits.com/shredder.htm
    >
    >
    >Christine wrote:
    >>> I deleted some confidential files from D drives (harddisk paritioned
    >>> into C & D drives)
    >>>
    >>> then I go to Recycle Bin to empty all.
    >>>
    >>> then I go do Disk Cleanup.




    >>>
    >>> Can the deleted files be un-deleted/retrieved?

    ( retrieved )







    >>>
    >>> If not, how to fool-proof?
    >>>
    >>> Thanks

    >
     
  10. Jim

    Jim Flightless Bird

    On Tue, 9 Mar 2010 08:06:31 -0500, "Doug" <datapod@yahoo.com> wrote:

    >I use http://www.handybits.com/shredder.htm
    >
    >
    >Christine wrote:
    >>> I deleted some confidential files from D drives (harddisk paritioned
    >>> into C & D drives)
    >>>
    >>> then I go to Recycle Bin to empty all.
    >>>
    >>> then I go do Disk Cleanup.
    >>>
    >>> Can the deleted files be un-deleted/retrieved?
    >>>
    >>> If not, how to fool-proof?
    >>>
    >>> Thanks

    >


    Adendum : misread original post .
     
  11. HeyBub

    HeyBub Flightless Bird

    Christine wrote:
    > I deleted some confidential files from D drives (harddisk paritioned
    > into C & D drives)
    >
    > then I go to Recycle Bin to empty all.
    >
    > then I go do Disk Cleanup.
    >
    > Can the deleted files be un-deleted/retrieved?
    >
    > If not, how to fool-proof?
    >


    It may depend on several factors. Can you give us a, say, three-paragraph
    content summary of each file you want deleted?
     

Share This Page