±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 2 Overall: 36290
New Yesterday: 4 Visitors: 169

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

CCLEANER´s erasing accuracy compared to other softwares?

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page Previous  1, 2, 3, 4, 5  Next 
  

williamsonn
Senior Member
 

Re: CCLEANER´s erasing accuracy compared to other softwares

Post Posted: Feb 09, 13 02:27

- TuckerHST
To be fair, CCleaner is a very thorough and powerful end-user tool. Dave Cowen used it as an example in his anti-anti-forensics talk -- related to his $Logfile research. It's not just a joke. And, as Harlan points out, it's easy enough to test, which is what Dave did.

A couple of weeks ago, I
suggested that williamsonn should look into it.

Did you?


Yes, I did Smile

Thanks for your answer Wink

Then, I suppose they are not right in some forums when some say that piriform ccleaner is not a secure rool for secure deleting?  
 
  

TuckerHST
Senior Member
 

Re: CCLEANER´s erasing accuracy compared to other softwares

Post Posted: Feb 09, 13 10:25

It's a question of semantics. Without context, there's no way of knowing if we're talking about wiping specific files, free space, or the entire drive.

Don't underestimate CCleaner; I would be skeptical if people say they can recover files CCleaner has wiped. If configured to wipe files, it does an effective job. However, it's not intended to do a forensic wipe of an entire drive. That is probably exactly the opposite of what most CCleaner end users would want.

As for comparing it to other tools, it depends on what kinds of tools you're comparing it to. There are other wiping tools that are effective at overwriting files, too. Unless you want to compare it to something like DBAN, or, as I already suggested, DiskPart.

If you happen to download a few, try them, and post your findings, I'm sure we would all be interested to read about it.
_________________
Scott Tucker
Aptegra Consulting, LLC
www.aptegra.com 
 
  

jaclaz
Senior Member
 

Re: CCLEANER´s erasing accuracy compared to other softwares

Post Posted: Feb 09, 13 17:01

There is nothing to under or over estimate. Shocked

Once a tool, *any* tool has filled a "target" with 00's nothing will be recovered (if not some 00's) from the "target".
It is pretty much binary, a given tool either is capable of effectively writing 00's to a given "target" or it is not.
Of course all such tools are capable of writing 00's, so there is not any "estimation" possible on this, maybe there could be if *any* tool would not deliver what it promises (but then that would be a bug in the tool).

All the differences might be in:
  • which "targets" can be overwritten by the tool (disk - WHOLE disk, drive/filesystem, file,
  • free space in filesystem, including HPA/DCO, etc.)
  • how efficient is the tool (how fast it is)
  • how convenient it is (which environment it needs to run, how user friendly it is, etc.)

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 
 
  

Jonathan
Senior Member
 

Re: CCLEANER´s erasing accuracy compared to other softwares

Post Posted: Feb 09, 13 20:00

- Belkasoft
Do you mean Piriform CCleaner? It's about as "professional" as any housewife's computer tool. No offence to housewives.


It's a free tool designed to delete (or if so configured, wipe) most data not directly created by a user. It does a good job of it. Here's the current list of what it can delete/ wipe: http://winapp2.com/Winapp2.ini

If anyone on here can recover data which has been wiped by CCleaner or any other app then I'm sure the world would be very interested in hearing about it!

It would help if the OP clarified what exactly they want to securely erase.
_________________
Forensic Control
twitter.com/ForensicControl
St Bride Foundation, 14 Bride Lane, London, EC4Y 8EQ 
 
  

JackyFox
Member
 

Re: CCLEANER´s erasing accuracy compared to other softwares

Post Posted: Feb 09, 13 21:18

One thing I have noted with CCleaner is that if you have VSS switched on and the file that was "erased" existed when the last volume shadow was made then you can recover the file.

As far as I remember CCleaner has an option to remove volume shadows but it won't let you remove the most recent copy in case something goes wrong.

Also if you install CCleaner rather than running it in silent mode the action of installing an application generates a volume shadow.

This may well be the case with other erasing software too so while these points aren't comparitive I do think they are a little ironic.  
 
  

williamsonn
Senior Member
 

Re: CCLEANER´s erasing accuracy compared to other softwares

Post Posted: Feb 10, 13 00:19

Well, I took an old hard drive I had overwritten some time ago with 3 passes(before knowing a single pass was enough), and used recuva, Diskdigger, and Getdataback.

No files were found except the HDD filesystem. Recuva didn´t find anything, but mentioned(like in a similar case I mentioned here with a different disk)a number of ignored files.  
 
  

jaclaz
Senior Member
 

Re: CCLEANER´s erasing accuracy compared to other softwares

Post Posted: Feb 10, 13 00:28

- williamsonn
Well, I took an old hard drive I had overwritten some time ago with 3 passes(before knowing a single pass was enough), and used recuva, Diskdigger, and Getdataback.

Overwritten WHAT with WHICH tools and HOW exactly?

- williamsonn

No files were found except the HDD filesystem. Recuva didn´t find anything, but mentioned(like in a similar case I mentioned here with a different disk)a number of ignored files.

Good Smile , have you examined the disk (not the filesystem/volume) with a disk editor?

Have you checked it with a disk-oriented (not filesystem/volume) recovery tool?

And with a forensic carver?

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 
 

Page 2 of 5
Page Previous  1, 2, 3, 4, 5  Next