The Mudcat Café TM
Thread #79633   Message #1444052
Posted By: JohnInKansas
26-Mar-05 - 01:42 AM
Thread Name: Tech: Norton Trash Bin - where does it go?
Subject: RE: Tech: Norton Trash Bin - where does it go?
When you delete a file, most of the file remains intact on the disk. It just has it's name removed from the "File Allocation Table" so it doesn't show up in a listing of files, and the first character of the file name, where it sits on the drive, is changed to a zero or nul value. A cluster that begins with a zero character is "empty" as far as disk writing is concerned, so for practical purposes the cluster where the file was is available and can be overwritten if the disk space is needed. All that has to be done to "recover" the file, if nothing else has been written on top of it, is to change that first character back to any legal char value, and the whole file "magically" reappears.

There have been a number of utilities, since the earliest days of DOS, that could poke a "dummy value" into the start of each cluster in order to list "the rest of the file name that might be there" and allow you to put your own "real character" in to "undelete" the file. Norton Utilities has been one of the better ones for this purpose, but there have been quite a number of them.

The Windows Trash Bin keeps a list of the names and locations of the starting clusters for anything that you delete, so you can right click a file there and select "Restore" and it often can put it back. The Windows Trash Bin doesn't do much though to prevent something else from being written where the file was, so if you don't do the Restore fairly soon, it may not be successful.

The Norton Protected Trash Bin appears to keep the same sort of list of deleted files and cluster locations, and in addition marks those clusters so they'll "resist" having something else written there. (It may actually make a compressed copy of the file elsewhere - details are a little fuzzy.) Since Norton Protected Trash Bin keeps a full copy of the file on the drive you don't gain usable space on the drive by "deleting to the protected bin" (allowing the possibity that the saved copy may be compressed, you might get a little space back.)

A file isn't "gone" until something else has been written in the space where it was. Even when a file is overwritten, the paranoid should know that there are methods for "unwriting" the existing file that replaced it (not the same thing as deleting) in order to "read" what used to be there. The only way to make a file "forensically unrecoverable" is to use a "disk cleaning" utility (and Norton has a good one, although I can't say whether it's in standard packages).

The US Department of Defense Standard for rendering data on a disk "unrecoverable" I believe requires writing a "1" in every empty space on the drive, then writing a "0" in each of the same spaces. Repeat six times. Then write the pattern "1 0 1 0 1 0 ..." in every empty space, followed by the pattern "0 1 0 1 0 1 ...." Repeat 6 times. There may be a couple of additional cycles - it's been a few years. The acceptable alternative is to run the drive through a mechanical shredder and then burn the chunks. Note that even reformatting a drive does not make date previously there fully unrecoverable, since all reformatting does is renumber the clusters. The data within the clusters is not necessarily changed, although it may not be recoverable by ordinary methods.

There has been some considerable attention recently to "salvaged" drives available from junk parts dealers. When you exchange a defective drive, or junk an old computer, minor repairs may make the drive operable, or it may be removed from the computer before the rest of the machine is junked. Either way, the drive may go out as "spare parts." Quite an active "hobby cult" has sprung up among junk nuts who've found they can often recover quite a lot of interesting stuff from such drives. Buy a bunch, look at what's there, trade them in for a new bunch. Just like buying rolls of pennies and looking for that "rare one."

Reputable recyclers have started paying attention to cleaning recycled drives before turning them loose, but a "disk clean" on even a tiny 30GB drive takes several hours, so there's the "how much do you trust them" factor.

Ain't nothin' safe nowhere.

John