CCLEANER´s erasing ...
 
Notifications
Clear all

CCLEANER´s erasing accuracy compared to other softwares?  

Page 1 / 3
  RSS
williamsonn
(@williamsonn)
Member

hello. I would like to know if for secure erasing purposes, Ccleaner (1 pass overwritting) could be considered "profesionally" safe, compared with other erasing available software?

Quote
Posted : 08/02/2013 6:26 pm
williamsonn
(@williamsonn)
Member

I am speaking of recent versions like v3.23.1823.

ReplyQuote
Posted : 08/02/2013 6:28 pm
Belkasoft
(@belkasoft)
Active Member

Do you mean Piriform CCleaner? It's about as "professional" as any housewife's computer tool. No offence to housewives.

ReplyQuote
Posted : 08/02/2013 7:12 pm
keydet89
(@keydet89)
Community Legend

hello. I would like to know if for secure erasing purposes, Ccleaner (1 pass overwritting) could be considered "profesionally" safe, compared with other erasing available software?

I'd think that this would be easy to test…

ReplyQuote
Posted : 08/02/2013 7:36 pm
jaclaz
(@jaclaz)
Community Legend

I'd think that this would be easy to test…

Sure, just run CCleaner and then see what you can get back with Recuva wink
http//www.forensicfocus.com/Forums/viewtopic/t=10194
http//www.forensicfocus.com/Forums/viewtopic/t=9821/

jaclaz

ReplyQuote
Posted : 08/02/2013 8:29 pm
TuckerHST
(@tuckerhst)
Active Member

To be fair, CCleaner is a very thorough and powerful end-user tool. Dave Cowen used it as an example in his anti-anti-forensics talk – related to his $Logfile research. It's not just a joke. And, as Harlan points out, it's easy enough to test, which is what Dave did.

A couple of weeks ago, I
suggested that williamsonn should look into it.

Did you?

ReplyQuote
Posted : 08/02/2013 9:29 pm
jaclaz
(@jaclaz)
Community Legend

To be fair, CCleaner is a very thorough and powerful end-user tool.

Sure it is ) , still it is not aimed at secure erasing a device, it is aimed to erase a filesystem or, more correctly parts of the filesystem (files or free space or even unused/old $MFT entries), just like Recuva is aimed to recover deleted files on a filesystem
http//www.piriform.com/docs/ccleaner/ccleaner-settings/changing-ccleaner-settings

In my perverted mind, if all I can find, with *whatever* methods, on *any* sector of the device is 00's then that is "secure erase", and most if not all "secure erase" programs are aimed to the device and not at the filesystem, so I wouldn't know with what to compare, possibly sdelete
http//technet.microsoft.com/en-us/sysinternals/bb897443.aspx

jaclaz

ReplyQuote
Posted : 08/02/2013 11:21 pm
williamsonn
(@williamsonn)
Member

To be fair, CCleaner is a very thorough and powerful end-user tool. Dave Cowen used it as an example in his anti-anti-forensics talk – related to his $Logfile research. It's not just a joke. And, as Harlan points out, it's easy enough to test, which is what Dave did.

A couple of weeks ago, I
suggested that williamsonn should look into it.

Did you?

Yes, I did )

Thanks for your answer 😉

Then, I suppose they are not right in some forums when some say that piriform ccleaner is not a secure rool for secure deleting?

ReplyQuote
Posted : 09/02/2013 2:27 am
TuckerHST
(@tuckerhst)
Active Member

It's a question of semantics. Without context, there's no way of knowing if we're talking about wiping specific files, free space, or the entire drive.

Don't underestimate CCleaner; I would be skeptical if people say they can recover files CCleaner has wiped. If configured to wipe files, it does an effective job. However, it's not intended to do a forensic wipe of an entire drive. That is probably exactly the opposite of what most CCleaner end users would want.

As for comparing it to other tools, it depends on what kinds of tools you're comparing it to. There are other wiping tools that are effective at overwriting files, too. Unless you want to compare it to something like DBAN, or, as I already suggested, DiskPart.

If you happen to download a few, try them, and post your findings, I'm sure we would all be interested to read about it.

ReplyQuote
Posted : 09/02/2013 10:25 am
jaclaz
(@jaclaz)
Community Legend

There is nothing to under or over estimate. 😯

Once a tool, *any* tool has filled a "target" with 00's nothing will be recovered (if not some 00's) from the "target".
It is pretty much binary, a given tool either is capable of effectively writing 00's to a given "target" or it is not.
Of course all such tools are capable of writing 00's, so there is not any "estimation" possible on this, maybe there could be if *any* tool would not deliver what it promises (but then that would be a bug in the tool).

All the differences might be in

  • which "targets" can be overwritten by the tool (disk - WHOLE disk, drive/filesystem, file,
  • free space in filesystem, including HPA/DCO, etc.)
  • how efficient is the tool (how fast it is)
  • how convenient it is (which environment it needs to run, how user friendly it is, etc.)

jaclaz

ReplyQuote
Posted : 09/02/2013 5:01 pm
Jonathan
(@jonathan)
Senior Member

Do you mean Piriform CCleaner? It's about as "professional" as any housewife's computer tool. No offence to housewives.

It's a free tool designed to delete (or if so configured, wipe) most data not directly created by a user. It does a good job of it. Here's the current list of what it can delete/ wipe http//winapp2.com/Winapp2.ini

If anyone on here can recover data which has been wiped by CCleaner or any other app then I'm sure the world would be very interested in hearing about it!

It would help if the OP clarified what exactly they want to securely erase.

ReplyQuote
Posted : 09/02/2013 8:00 pm
JackyFox
(@jackyfox)
New Member

One thing I have noted with CCleaner is that if you have VSS switched on and the file that was "erased" existed when the last volume shadow was made then you can recover the file.

As far as I remember CCleaner has an option to remove volume shadows but it won't let you remove the most recent copy in case something goes wrong.

Also if you install CCleaner rather than running it in silent mode the action of installing an application generates a volume shadow.

This may well be the case with other erasing software too so while these points aren't comparitive I do think they are a little ironic.

ReplyQuote
Posted : 09/02/2013 9:18 pm
williamsonn
(@williamsonn)
Member

Well, I took an old hard drive I had overwritten some time ago with 3 passes(before knowing a single pass was enough), and used recuva, Diskdigger, and Getdataback.

No files were found except the HDD filesystem. Recuva didn´t find anything, but mentioned(like in a similar case I mentioned here with a different disk)a number of ignored files.

ReplyQuote
Posted : 10/02/2013 12:19 am
jaclaz
(@jaclaz)
Community Legend

Well, I took an old hard drive I had overwritten some time ago with 3 passes(before knowing a single pass was enough), and used recuva, Diskdigger, and Getdataback.

Overwritten WHAT with WHICH tools and HOW exactly?

No files were found except the HDD filesystem. Recuva didn´t find anything, but mentioned(like in a similar case I mentioned here with a different disk)a number of ignored files.

Good ) , have you examined the disk (not the filesystem/volume) with a disk editor?

Have you checked it with a disk-oriented (not filesystem/volume) recovery tool?

And with a forensic carver?

jaclaz

ReplyQuote
Posted : 10/02/2013 12:28 am
williamsonn
(@williamsonn)
Member

obviously not jaclaz, you know I am not expert.

On the other hand, if after full format and overwriting a disk, files still can be recovered with other known techniques, this, then is not what I believed yo have understand from your and other´s answers here(perhaps a misunderstanding of me), as I thought that a single pass overwritting would make all data not retrievavle.

ReplyQuote
Posted : 10/02/2013 12:39 am
Page 1 / 3
Share: