I want to know this about securely wiping files.
a. If there is a word or txt file in a HDD or a pendrive USB device, with text and screen images copied in it, and you modify the contents of that file(i.e. deleting the image, modify text and save changes), Will the previous contents be safely wiped, or will they remain?
b. If you move files from a HDD, or from a USB pendrive to other device will any trace of files remain in the first devices or it is similar to wiping?
a. It depends on the method used for wiping the data. If you right click and press delete then it could easily be recovered. If you use such software like CCleaner or Eraser and write over the data with several overwrites it is "much harder" to retrieve the data.
b. Again traces will remain on the source device, using the above method could count. BUT that is not to say that the computer buffered some of the transfer in its pagefile.sys while transferring and evidence could be found there. Checking the registries MRU list it could be seen that JPG images or whatever text writing software you use were used recently (though not show the contents of the images), that coupled with checking the registry for devices connected to the computer it can be reasonably asserted that during the time of the images being copied some sort of external storage media was connected.
Am still learning myself so do not take my word for gold. Hope others post so i can see how well i did.
Regarding first point I am not sure if I described clearly what I meant. I was referring to a .doc file containing screenshots and text. I know that simply deleting a file(for example the entire mentioned .doc file) is not enough and that file can be recovered, but, what if I access the file, delete the screenshot (click and Supr), modify text and save. The entire document has been modified. How could be the old parts recovered?
Also please, bear in mind that the recovery of older versions of the document I am mentioning should be in a external HDD.
I can assure you that you completely failed initially to describe the question you are asking an answer to.
This has NOTHING to do with wiping a file.
It is about TWO completely different things.
First is "what remains" of edits in a word file?
And it has NO answer, it depends on the actual application used (MS Word, and depends on which exact version of it vs. other Word processor AND on the exact .doc format used AND on the exact settings in the app).
The second is "what remains" on the source filesystem when you "move" a file to another filesystem or device.
Now let's see how an OS might possibly behave
1) copy the data from one filesystem to another and remove the pointers to the data in the source filesystem, which equates to "copy the file to another filesystem and then plainly delete the file in the source filesystem".
2) copy the data from one filesystem to another and completely wipe (with 35 passes) the area on the source filesystem where the file was
Which of the two would you guess being more probable?
jaclaz
I think you say that your second option is better, However, please allow me to ask these questions
a) Regarding my first question, the applications I am speaking of are Microsoft word 2000 , 2010, and Microsoft office 2010.
I do not understand how and where any previous word version could be stored in order to be retrieved in an external HDD. If it were in a computer using windows, then I understand what the backups are, but an external HDD I think is not run by any O.S.
b)in order to see if after editing and saving a file, there are previous versions which can be restored or it is really deleted(wiped) is a valid test, me doing right mouse click on file, properties, older versions, or the previous versions can be retrieved any other way?
c) So, moving a file from a USB pendrive to any other device is the SAME as copying it? that is the original file is not really deleted from the source?
d) Regarding passes really are 35 passes needed? So, a simple right mouse click on file and "delete with wiping, one pass" option of one of the shredder software available is not enough?
thank you very much
a) Regarding my first question, the applications I am speaking of are Microsoft word 2000 , 2010, and Microsoft office 2010.
I do not understand how and where any previous word version could be stored in order to be retrieved in an external HDD. If it were in a computer using windows, then I understand what the backups are, but an external HDD I think is not run by any O.S.
As always, you should do some experiments with different settings, study the specific file format, examine samples with a carver, etc., etc.
b)in order to see if after editing and saving a file, there are previous versions which can be restored or it is really deleted(wiped) is a valid test, me doing right mouse click on file, properties, older versions, or the previous versions can be retrieved any other way?
See above.
c) So, moving a file from a USB pendrive to any other device is the SAME as copying it? that is the original file is not really deleted from the source?
Let's see if this helps
this commandmove D\myfile.ext E\has the same effect of these twocopy D\myfile.ext E\
del D\myfile.ext
d) Regarding passes really are 35 passes needed? So, a simple right mouse click on file and "delete with wiping, one pass" option of one of the shredder software available is not enough?
Are you for real? 😯
We talked about this like 35 times already.
The dead horse is dead, really dead ( , you can safely stop beating it.
http//
jaclaz
Sorry, I mentioned about te 35 passes, as you mentioned it, and said about performing these amount of passes, what really sounded very strange.
Sorry, I mentioned about te 35 passes, as you mentioned it, and said about performing these amount of passes, what really sounded very strange.
It was a simple hint (you may look for it's meaning here)
http//
about which of the two proposed possibilities was patently absurd.
jaclaz