Deleted Files

[Roscoe]

I was told that deleted files are not deleted, but the first letter of the file name is replaced with a "?" denoting that it can be overwritten. Correct?

I realise then, that is it is a fairly simple process, with the right software, to recover these so called deleted files. That, I thought, was simple enough.

But I have heard of computer forensics people recovering deleted files that I thought were really deleted - that is, overwritten. I wondered how they did that.

Recently, I was advised that installing Glary's Utilities was a good move and I have done so. Looking through the programme I found File Undelete. Thought I'd have a look. There was about 200,000 files that had been deleted.

Alongside each file was the comment, "Very Good," "Medium," "Poor" and "Overwritten." So it seems that the programme may be able to recover a file that has been overwritten. The programme has detected it, or has it just detected the remnants of the file?

The programme has a File Shredder which it says will destroy sensitive data so it cannot be recovered. "This tool uses the utmost safety method American Dod 5220.22-M developed by the US Department of Defence to securely remove the data."

The programme also has a "Wipe Free Space" which says that "This option destroys such files that are already deleted by you so that they cannot be recovered."

So it does seem, from what they say, that this programme can beat the computer forensic people, but can it really? I understand that computer forensics have some very powerful software, but can they recover something that no longer exists?

So if you do have sensitive data that you do not want forensics to recover, would Glary's Utilities remove it completely from your HD?

Anyone into computer forensics out there?

[Speedy Gonzales]

Only thing with some of these programs that delete files permanently is if you select the highest option (I think it overwrites like 7 times), expect it to take a LONG time.

I tried this once with a program called OO SafeErase.

I selected the highest setting. It took like 12 hrs for it to finish lol

[wainuitech]

Have a look at This article - even using programs that erase data, overwrite, they can sometimes still be recovered.

While some are gone for good after a long time, and some programs do make a great job they are never really completely gone, experts with the right software and knowledge can still recover data.

Example of not being gone - I did a recovery with Get Data Back on a customers PC last year, and recovered the data he had lost the week before along with some data and email going back to 1996, and the drive had been formatted at least once.

The only 100% way to make sure data is gone is to totally destroy the hard drives disks. The solution is in the first line of my Sig

[wratterus]

It's amazing some of the crap you trawl up with GetDataBack.

Various images from 10 years ago...

[Roscoe]

Wainuitech: Thanks for that. I was not aware that it was deleted files that overwrote deleted files.

When a HD is formated you are warned that you will loose all your data, but it sounds as though that is not necessarily true. So why is it necessary to format a HD? Not for removing sensitive files, it seems.

[Speedy Gonzales]

Depends on why youre formatting.

You could have malware etc that you cant get rid of, it could be a driver that crashes continuously. And you cant fix it.

Or you dont like the version of Windows, you've installed.

Or in my case, if I decided to install Vista on this (it could probably handle it, well it installed server 08, which is pretty much identical to Vista no prob). But I would have to look for the drivers. As there's no drivers for Vista for this mobo on the site.

[Thebananamonkey]

Some programs scramble the documents at a binary level before wiping them, so that if you do recover them you have absolute nonsense files.

Bigger hammers don't always work either, platters can be remounted in new drive enclosures, even if broken. I think angle grinding platters into dust would be effective though

[PaulD]

Wainuitech: Thanks for that. I was not aware that it was deleted files that overwrote deleted files.

Did you mean new files? Deleted files don't overwrite or move, they just don't get listed in the phone book any longer.

Any physical damage to the platters would make them unreadable by any remotely normal means. If they weren't flat the heads would crash.

"a modern hard disk has a floating height of an amazing 0.5 microinches. A human hair has a thickness of over 2,000 microinches!"

[wainuitech]

Bigger hammers don't always work either, platters can be remounted in new drive enclosures, even if broken. I think angle grinding platters into dust would be effective though

I'm talking smashed in many tiny pieces, not just a couple of hits to distort or crack. The type of smash that you would get if you broke/shattered a window.

Just a brief explanation -

Did you mean new files? Deleted files don't overwrite or move, they just don't get listed in the phone book any longer.

When a PC writes data it puts it all over the place, when a file gets deleted its reference to that file is gone, windows under normal use cant see it any more so thinks its not there, and thinks the now vacant area is free to write more data.

In simple terms, and prob not the real correct to explain it, but when formatting its as if it puts a layer over the data, and then writes new data, good data recovery programs can see through that layer.

That's why if you ever delete something and go OH SH*T - you shut down the computer right away and get it to some one who knows how to recover data, that way there's less chance of it being over written.

You NEVER load in a data recovery program onto the drive you want to recover the data from, by doing that you may actually overwrite the exact data you are trying to get back.
The drive gets put on another PC and used as a slave, then scanned to do the recovery.

[stormdragon]

Did you mean new files? Deleted files don't overwrite or move, they just don't get listed in the phone book any longer.

Any physical damage to the platters would make them unreadable by any remotely normal means. If they weren't flat the heads would crash.

"a modern hard disk has a floating height of an amazing 0.5 microinches. A human hair has a thickness of over 2,000 microinches!"

Does an electron microscope count as normal?