The Mudcat Café TM
Thread #79633   Message #1444130
Posted By: JohnInKansas
26-Mar-05 - 07:21 AM
Thread Name: Tech: Norton Trash Bin - where does it go?
Subject: RE: Tech: Norton Trash Bin - where does it go?
I haven't looked at the McAfee shredder, but most such programs do some sort of overwrite - to where the deleted files were located on the hard drive - to make sure they can't be undeleted using simple tools.

Especially with later versions of Windows, there are also some "ghost" copies occasionally that need to be deleted/obliterated, and McAfee's shredder may look for them - or not. Latest Win versions sometimes put a copy of "frequently used files" aside for quick access, and may also have stored a "compressed" version of something that went unused for a while. These may not be cleared immediately/automatically when you delete the "main copy," so they can stay on the disk for a while, although usually not for long. Shortcuts to frequently used files can also be used to "read" the pointer to the file and the filename, which is a help for someone trying to dig out something that's been deleted; and newer Win versions splatter shortcuts all over the place. The ones that are automatically created should disappear when a file is deleted, but sometimes don't go away instantly.

If you've got something to be really paranoid about a "diskwipe" and/or "shredder" would likely be a good idea. (You also need to be conceited enough to think anyone really cares what used to be on your drive?)

Back in "olden times" when drives were comparatively small, you could do a pretty secure "wipe" by doing a defrag to move all the good files to one end of the disk, and then copy a large file (or few large files) of nonsense to write over most of the "empty space." Then just delete the nonsense. (You actually get better "coverage" with lots of little files, but that gets really tedious.)

I can recall keeping a dozen or so floppies, one file each, just for that purpose - many eons ago. The "A" floppy had a file "A.txt" that just consisted of a meg or so of "AaAaAaAaAa..." "B" floppy was B.txt, similarly. When you got the drive nearly full, a DOS "Del ?.txt" would remove them all. (But check first to make sure you don't have a "real" file with a single-character name.) The old DOS wouldn't let you delete a folder unless it was empty, but with newer Windows you can, so you could make a folder named "nonsense" and fill it up, then delete the folder. If you overwrote enough clusters to break up the larger files it would be pretty difficult to reassemble them, even if someone recovered all (or most of) the pieces.

It probably isn't a good idea to completely fill up a drive, since you need some free space for the normal bookkeeping, but filling a third or so of the empty space, and then removing the junk is fairly likely to have messed up most of the leftovers. With 200GB+ drives pretty common now, it takes a lot of nonsense to do much of an overwrite, so it's a lot less practical than it once was. The utilities can do a better job of it.

As a general rule, if you empty the trash bin(s) and then do a defrag, only a determined sleuth, with access to your computer with some pretty sophisticated software and equipment (and likely with a court order) is going to get a lot from the "deleted" parts of the drive. A key here is that the defrag will pretty much "rewrite" the FAT, so there are no pointers left there to tell where the deleted file used to start. The new "root folders" that replace the FAT on FAT32 and NTFS drives makes it a little harder to get into the disk, but contains a lot more information once you get there, so the net result is that it's easier to recover deleteds once you've got the utilities to do it.

To be safe, you should assume that anything that's ever been saved to a hard drive can be recovered if someone is really interested.

A "Tempest diskwipe" (the DoD spec above) is enough to make recovery very expensive, and Norton and/or a dozen other utilities can do that.

If you're concerned, you should have a utility or two to give you reasonable confidence that your "deletes" are safely removed, and after they're safely removed you should act like they're not.

John