Hi,
I always delete all my confidential files in the PCs at my office by click delete and after that, I go to recycle bin folder and click empty. So, I assume all information has been cleared. Last month, my boss gives me a new PCs because the old one is getting slows and my boss already sold those PCs to others. However, it was a big surprise when I had found that deleting files can be recovered by using selected software or tools. I feel so worried.
Is it my confidential files that have been deleted can be recovered by someone? (
Then, a little bit confuses between deleting files and erasing files. As a precaution, is it safe for me to delete or erase?
Files that are "deleted" are just mapped as "free space" by the operating system on the storage media. Even the filename can still "exist" the first letter is just changed to 0xE5 (229) and it's not listed anymore by the filesystem.
Maby you can contact the customer and ask if you can buy the harddrives back? Maby they have already wiped them and reinstalled them?
A lesson for the future what your organisation need to do before selling hardware is to run a tool like DBan (or similar tool) that wipes the drives reasonably good, it's simple to use boot it up, press enter, go home, sleep, come back, done. Physical destruction of the the harddrive also works.
Files that are "deleted" are just mapped as "free space" by the operating system on the storage media. Even the filename can still "exist" the first letter is just changed to 0xE5 (229) and it's not listed anymore by the filesystem.
Maby you can contact the customer and ask if you can buy the harddrives back? Maby they have already wiped them and reinstalled them?
A lesson for the future what your organisation need to do before selling hardware is to run a tool like DBan (or similar tool) that wipes the drives reasonably good, it's simple to use boot it up, press enter, go home, sleep, come back, done. Physical destruction of the the harddrive also works.
A great response by MDCR. I would recommend that you get eraser or ccleaner to securely wipe free space.
Ensure to read the documentation before using these tools.
Files that are "deleted" are just mapped as "free space" by the operating system on the storage media. Even the filename can still "exist" the first letter is just changed to 0xE5 (229) and it's not listed anymore by the filesystem.
Maby you can contact the customer and ask if you can buy the harddrives back? Maby they have already wiped them and reinstalled them?
A lesson for the future what your organisation need to do before selling hardware is to run a tool like DBan (or similar tool) that wipes the drives reasonably good, it's simple to use boot it up, press enter, go home, sleep, come back, done. Physical destruction of the the harddrive also works.
A great response by MDCR. I would recommend that you get eraser or ccleaner to securely wipe free space.
Ensure to read the documentation before using these tools.
Does ccleaner helping erase all deleted document or just free the space in the pc?
CCleaner marks the file for deletion, then overwrites the marked file with zeros from the beginning to the end. For some reason the MFT isn't modified accordingly to remove the wiped file entry, so you can find traces of the deleted file, but not it's content.
Hi,
I always delete all my confidential files in the PCs at my office by click delete and after that, I go to recycle bin folder and click empty. So, I assume all information has been cleared. Last month, my boss gives me a new PCs because the old one is getting slows and my boss already sold those PCs to others. However, it was a big surprise when I had found that deleting files can be recovered by using selected software or tools. I feel so worried.
Is it my confidential files that have been deleted can be recovered by someone? (
Then, a little bit confuses between deleting files and erasing files. As a precaution, is it safe for me to delete or erase?
Any opinions from others?
Any opinions from others?
You want some more same opinions or are you looking for diverging ones? roll
Try using this easy list (roughly in order of effectiveness)
1 - non-safe (i.e. recoverable, at least partially)
1a - delete=file goes to recycle.bin
1b - delete (keeping shift pressed)=delete (and later empty recycle bin)=file is de-indexed
2 - safe (i.e. NOT recoverable, by ANY means)
2a - delete and use CCleaner or sdelete=really delete the file(s)
2b - fill the file with 00's and then delete it = really delete the file(s)
2c - delete files as per 1b above, fully defrag filesystem, create an empty (filled with 00's) file as big as available space, then delete it=really delete ALL files BUT the ones you need/use
2d - before giving away the PC, boot a PE 2.x+ and format (FULL, i.e. NOT "quick", NOT "/q") the volume = really delete all filesystem
2e - before giving away the PC, run DBAN or any other similar software and make ONE SINGLE PASS of 00's on the WHOLE disk=really delete the whole disk contents
2f - before giving away the PC, initiate a SafeErase ATA command via hdparm or similar= really delete the whole disk contents, only in a much faster way
2g - destroy the mass-storage device by means of a crusher = really delete the whole disk contents, in the fastest possibe way BUT with very little remaining reselling value
Pick the method you find more appropriate.
jaclaz
Any opinions from others?
You want some more same opinions or are you looking for diverging ones? roll
Try using this easy list (roughly in order of effectiveness)
1 - non-safe (i.e. recoverable, at least partially)
1a - delete=file goes to recycle.bin
1b - delete (keeping shift pressed)=delete (and later empty recycle bin)=file is de-indexed2 - safe (i.e. NOT recoverable, by ANY means)
2a - delete and use CCleaner or sdelete=really delete the file(s)
2b - fill the file with 00's and then delete it = really delete the file(s)
2c - delete files as per 1b above, fully defrag filesystem, create an empty (filled with 00's) file as big as available space, then delete it=really delete ALL files BUT the ones you need/use
2d - before giving away the PC, boot a PE 2.x+ and format (FULL, i.e. NOT "quick", NOT "/q") the volume = really delete all filesystem
2e - before giving away the PC, run DBAN or any other similar software and make ONE SINGLE PASS of 00's on the WHOLE disk=really delete the whole disk contents
2f - before giving away the PC, initiate a SafeErase ATA command via hdparm or similar= really delete the whole disk contents, only in a much faster way
2g - destroy the mass-storage device by means of a crusher = really delete the whole disk contents, in the fastest possibe way BUT with very little remaining reselling valuePick the method you find more appropriate.
jaclaz
Nice sharing. Very meaningful to me. Thanks. How about the diverging ones? )
Is it true recovering deleting files is part of computer forensic investigation?
Nice sharing. Very meaningful to me. Thanks. How about the diverging ones? )
There are NO diverging opinions, that's the point, we all concur that the methods listed in #2 (each with its own level of convenience/inconvenience and of completeness/incompleteness) represent the possible ways and that anything else is either not effective ( all listed in #1) or overkill (as an example using DBAN or similar software for anything more than a single 00's pass, that would take nx the time and senselessly stress the device).
Is it true recovering deleting files is part of computer forensic investigation?
Sure it is, though it is only a single (and often minor) part of it, in most cases what is relevant is making a timeline of all the activities that the computer was involved in, for which the actual contents of recovered file may be not particularly relevant, or only the contents of a few files may be relevant to the specific investigation.
jaclaz
