Tech: Norton Trash Bin - where does it go?

Subject: Tech: Norton Trash Bin - where does it go?
From: michaelr
Date: 26 Mar 05 - 12:25 AM

Using Norton System Works, one gets a "protected" trash bin from which deleted files can supposedly be resurrected. Does this mean that when one deletes files, they don't really go away? How can I free up disk space if Norton just puts the files away elsewhere?

Cheers,
Michael

Subject: RE: Tech: Norton Trash Bin - where does it go?
From: Joe Offer
Date: 26 Mar 05 - 12:44 AM

Well, Michael, all those files go to the Department of Homeland Security.

I thought you'd like to know that.




Well, actually, if you click on the Norton Trash Bin icon with your right mouse button, you'll find options that will allow you to fully delete the files in both the Windows Trash Bin, and in Norton Protected trash bin. That will free up a fair amount of space for you - but it will make it so you can never access those files, so be sure there's nothing there that you want to keep.

-Joe Offer-

Subject: RE: Tech: Norton Trash Bin - where does it go?
From: JohnInKansas
Date: 26 Mar 05 - 01:42 AM

When you delete a file, most of the file remains intact on the disk. It just has it's name removed from the "File Allocation Table" so it doesn't show up in a listing of files, and the first character of the file name, where it sits on the drive, is changed to a zero or nul value. A cluster that begins with a zero character is "empty" as far as disk writing is concerned, so for practical purposes the cluster where the file was is available and can be overwritten if the disk space is needed. All that has to be done to "recover" the file, if nothing else has been written on top of it, is to change that first character back to any legal char value, and the whole file "magically" reappears.

There have been a number of utilities, since the earliest days of DOS, that could poke a "dummy value" into the start of each cluster in order to list "the rest of the file name that might be there" and allow you to put your own "real character" in to "undelete" the file. Norton Utilities has been one of the better ones for this purpose, but there have been quite a number of them.

The Windows Trash Bin keeps a list of the names and locations of the starting clusters for anything that you delete, so you can right click a file there and select "Restore" and it often can put it back. The Windows Trash Bin doesn't do much though to prevent something else from being written where the file was, so if you don't do the Restore fairly soon, it may not be successful.

The Norton Protected Trash Bin appears to keep the same sort of list of deleted files and cluster locations, and in addition marks those clusters so they'll "resist" having something else written there. (It may actually make a compressed copy of the file elsewhere - details are a little fuzzy.) Since Norton Protected Trash Bin keeps a full copy of the file on the drive you don't gain usable space on the drive by "deleting to the protected bin" (allowing the possibity that the saved copy may be compressed, you might get a little space back.)

A file isn't "gone" until something else has been written in the space where it was. Even when a file is overwritten, the paranoid should know that there are methods for "unwriting" the existing file that replaced it (not the same thing as deleting) in order to "read" what used to be there. The only way to make a file "forensically unrecoverable" is to use a "disk cleaning" utility (and Norton has a good one, although I can't say whether it's in standard packages).

The US Department of Defense Standard for rendering data on a disk "unrecoverable" I believe requires writing a "1" in every empty space on the drive, then writing a "0" in each of the same spaces. Repeat six times. Then write the pattern "1 0 1 0 1 0 ..." in every empty space, followed by the pattern "0 1 0 1 0 1 ...." Repeat 6 times. There may be a couple of additional cycles - it's been a few years. The acceptable alternative is to run the drive through a mechanical shredder and then burn the chunks. Note that even reformatting a drive does not make date previously there fully unrecoverable, since all reformatting does is renumber the clusters. The data within the clusters is not necessarily changed, although it may not be recoverable by ordinary methods.

There has been some considerable attention recently to "salvaged" drives available from junk parts dealers. When you exchange a defective drive, or junk an old computer, minor repairs may make the drive operable, or it may be removed from the computer before the rest of the machine is junked. Either way, the drive may go out as "spare parts." Quite an active "hobby cult" has sprung up among junk nuts who've found they can often recover quite a lot of interesting stuff from such drives. Buy a bunch, look at what's there, trade them in for a new bunch. Just like buying rolls of pennies and looking for that "rare one."

Reputable recyclers have started paying attention to cleaning recycled drives before turning them loose, but a "disk clean" on even a tiny 30GB drive takes several hours, so there's the "how much do you trust them" factor.

Ain't nothin' safe nowhere.

John

Subject: RE: Tech: Norton Trash Bin - where does it go?
From: Jim McLean
Date: 26 Mar 05 - 04:40 AM

Do you know what the McAfee shredder does? Rather than just empty the bin I have the option to shred the contents, which I usually do.

Subject: RE: Tech: Norton Trash Bin - where does it go?
From: JohnInKansas
Date: 26 Mar 05 - 07:21 AM

I haven't looked at the McAfee shredder, but most such programs do some sort of overwrite - to where the deleted files were located on the hard drive - to make sure they can't be undeleted using simple tools.

Especially with later versions of Windows, there are also some "ghost" copies occasionally that need to be deleted/obliterated, and McAfee's shredder may look for them - or not. Latest Win versions sometimes put a copy of "frequently used files" aside for quick access, and may also have stored a "compressed" version of something that went unused for a while. These may not be cleared immediately/automatically when you delete the "main copy," so they can stay on the disk for a while, although usually not for long. Shortcuts to frequently used files can also be used to "read" the pointer to the file and the filename, which is a help for someone trying to dig out something that's been deleted; and newer Win versions splatter shortcuts all over the place. The ones that are automatically created should disappear when a file is deleted, but sometimes don't go away instantly.

If you've got something to be really paranoid about a "diskwipe" and/or "shredder" would likely be a good idea. (You also need to be conceited enough to think anyone really cares what used to be on your drive?)

Back in "olden times" when drives were comparatively small, you could do a pretty secure "wipe" by doing a defrag to move all the good files to one end of the disk, and then copy a large file (or few large files) of nonsense to write over most of the "empty space." Then just delete the nonsense. (You actually get better "coverage" with lots of little files, but that gets really tedious.)

I can recall keeping a dozen or so floppies, one file each, just for that purpose - many eons ago. The "A" floppy had a file "A.txt" that just consisted of a meg or so of "AaAaAaAaAa..." "B" floppy was B.txt, similarly. When you got the drive nearly full, a DOS "Del ?.txt" would remove them all. (But check first to make sure you don't have a "real" file with a single-character name.) The old DOS wouldn't let you delete a folder unless it was empty, but with newer Windows you can, so you could make a folder named "nonsense" and fill it up, then delete the folder. If you overwrote enough clusters to break up the larger files it would be pretty difficult to reassemble them, even if someone recovered all (or most of) the pieces.

It probably isn't a good idea to completely fill up a drive, since you need some free space for the normal bookkeeping, but filling a third or so of the empty space, and then removing the junk is fairly likely to have messed up most of the leftovers. With 200GB+ drives pretty common now, it takes a lot of nonsense to do much of an overwrite, so it's a lot less practical than it once was. The utilities can do a better job of it.

As a general rule, if you empty the trash bin(s) and then do a defrag, only a determined sleuth, with access to your computer with some pretty sophisticated software and equipment (and likely with a court order) is going to get a lot from the "deleted" parts of the drive. A key here is that the defrag will pretty much "rewrite" the FAT, so there are no pointers left there to tell where the deleted file used to start. The new "root folders" that replace the FAT on FAT32 and NTFS drives makes it a little harder to get into the disk, but contains a lot more information once you get there, so the net result is that it's easier to recover deleteds once you've got the utilities to do it.

To be safe, you should assume that anything that's ever been saved to a hard drive can be recovered if someone is really interested.

A "Tempest diskwipe" (the DoD spec above) is enough to make recovery very expensive, and Norton and/or a dozen other utilities can do that.

If you're concerned, you should have a utility or two to give you reasonable confidence that your "deletes" are safely removed, and after they're safely removed you should act like they're not.

John

Subject: RE: Tech: Norton Trash Bin - where does it go?
From: Jim McLean
Date: 26 Mar 05 - 07:24 AM

Thanks, John.

Subject: RE: Tech: Norton Trash Bin - where does it go?
From: NH Dave
Date: 26 Mar 05 - 01:25 PM

I believe the DoD standards can also be met by running the disk through an electonic degauser. We used to do this with data VCR tapes when is was working in a data gathering outfit. The thing was about the size of a home pizza oven, and sounded as if it were trying to crunch up a pail of nuts and bolts, but the tapes came out clean.

Dave

Subject: RE: Tech: Norton Trash Bin - where does it go?
From: JohnInKansas
Date: 26 Mar 05 - 06:19 PM

Dave -

There are separate standards for tape cleaning, but they're difficult to verify so most people who've used tape for truly sensitive info simply burn them. No recycling permitted. Most of us - especially with little tape cartridges - can just lay them on top of the color TV for a few on/off cyles and expect them to be pretty clean; but more sophisticated methods would be better if you're really worried.

A simple degauss affects the whole tape pretty much the same, and it's the differences between nearby spots that matter. These differences can be pulled up after some pretty strenuous application of bulk degaussing. The last time I looked, DoD Tempest required you to actually write bit patterns repeatedly to meet "secure clean" requirements - but that was 20 years ago or so.

John

Subject: RE: Tech: Norton Trash Bin - where does it go?
From: michaelr
Date: 27 Mar 05 - 08:54 PM

Thanks for the info, guys.

Cheers,
Michael

Subject: RE: Tech: Norton Trash Bin - where does it go?
From: Stilly River Sage
Date: 27 Mar 05 - 10:38 PM

Makes me feel so much worse about my missing hard drives! Ugg! What are the odds that the cretins who stole them simply reformatted them? Pretty low.

Subject: RE: Tech: Norton Trash Bin - where does it go?
From: DrWord
Date: 27 Mar 05 - 11:10 PM

Thank you John.

Dennis

Subject: RE: Tech: Norton Trash Bin - where does it go?
From: GUEST
Date: 27 Mar 05 - 11:16 PM

It is fun to pickup old HDs (backsides of allys, Goodwill Stores) and play with them.

I don't know them - they will never know be.

HD's are a toy - antiquated architecture to me mess with and explored - a lot like Martrix and Labrynth but in a real time some

Yeah, their is a bit a perserve voyaraism - but with four friends and two HDs each..... you can create a "real-life" but "Make-Believe" SimCity.

We have alternate personalities on boards like YAHOO - then we use the photos and meassage clips and e-mails to pretend to be the someone elese......The really fun thing is the other people think you ARE SO REAL.

Its nothing dishonest - we don't tap their back accounts, or rat-out their spounce, or even purchase things under their name.

Its KEWL- For only one you get TWO......
Our once only fear was when we thought we were talking to the sample person - turns out they were cousins - and the other never figured it out.

BOTTOM LINE - Old HDs can give a lot of pleasure for 10 dollara (particularly if it is you neighbors.