using a software app like Eraser
is it possible to safely delete data while running from within windows
By Safely i mean is there any possible way a file is overwritten 30 times to be recovered
and is it stored anywhere else on the disk
And would it be best practice to overwrite the free disk space afterwards?
also as a side note
Ive been curious about forensics for a while now and i wrote a program to delete data but im not sure if my methods are good enough.. so if someone here knows how to program please pm me or know of a good app to test the file recovery of a file it deletes.. i havent seen too many freeware apps
You may want to read this forum post regarding wiped data…
http//www.forensicfocus.com/index.php?name=Forums&file=viewtopic&t=2279
And you may also want to check out this blog post for information regarding free/low cost utils…
http//
I think he means software tools like "erase beyond recovery" and how effective they are in a live environment within the OS. This would be different than wiping a drive using hardware or software means.
I've been curious about this also. If you use a tool like that, how well do they really delete the file & overwrite its logical space on the drive? If someone wants to cover their tracks and use software like this to delete certain files, are they recoverable with forensic tools easily or at all?
yea i know most people do a secure wipe from a slave drive or boot disk so the disk is not 'live' persay so i was just wondering how effective a wipe is while an os is booted due to locked files etc
Personally, I'd not rely on a wipe done on specific files on a live OS. I'd be wary of even doing it from some sort of bootdisk.
Windows has too many variables on what it does with data at any one time to know you will wipe all evidence of it. Forget any of that "30 passes" stuff, as more than 1 doesn't do anything extra. The bigger issues are questions like
1. Did the OS swap that file out of RAM and into the pagefile?
2. Did someone move that file at some stage and now it also resides in unallocated space on a different partition?
I'm not sure how you could guarantee you've killed any data squirreled away under those conditions. Whenever the court has asked me to wipe data, I've always fought strenuously that the entire disk be wiped for these exact reasons. Hasn't failed on me yet.