How to permanently delete files?

Lets say I delete files with explorer and then empty the recycle bin.
Then I use a program to wipe all unused disk space on all the drives.
I verified this by watching the disk space on the drive go to zero.
Then I had the swap file wiped on reboot.  So I figure the deleted
files are long go.  Where else could they be?  Then I start an unerase
program, and presto, the files still exists somewhere because the
unerase can restore them!  Where is the unerase program getting the
files and how can I permanently get rid of them?  Does anyone have any
code to do this?  There must be some microsoft database that contains
these deleted files.  If I empty the recycle bin and then wipe all
*unused* disk space on all drives then where else could the files data
be?  I restored a text file and it contained the correct text.

Thanks for any help,
Paul

0
5/29/2005 5:16:53 PM
vc.mfc 33608 articles. 0 followers. Follow

7 Replies
694 Views

Similar Articles

[PageSpeed] 1

BTW, I used a Peter Gutmann 35 pass when wiping the unused disk space.
So there's no chance of the uneraser recovering the data.

0
5/29/2005 5:21:27 PM
It's possible the swap file is just allocating the space but not
actually touching the bits. If you're going to delete a file, you might
want to write 0s to the file's bits at the physical location before
deleting it. This corrupts (well, empties) the file and makes it
unrecoverable (even if they can pull the extension.

Darsant

0
darsant (187)
5/29/2005 6:12:26 PM
curiousjohn4@yahoo.com wrote:
> Lets say I delete files with explorer and then empty the recycle bin.
> Then I use a program to wipe all unused disk space on all the drives.
> I verified this by watching the disk space on the drive go to zero.
> Then I had the swap file wiped on reboot.  So I figure the deleted
> files are long go.  Where else could they be?  Then I start an unerase
> program, and presto, the files still exists somewhere because the
> unerase can restore them!  Where is the unerase program getting the
> files and how can I permanently get rid of them?  Does anyone have any
> code to do this?  There must be some microsoft database that contains
> these deleted files.  If I empty the recycle bin and then wipe all
> *unused* disk space on all drives then where else could the files data
> be?  I restored a text file and it contained the correct text.

If it's a tiny file it could be stored inside the MFT.
0
OlafvdSpek (88)
5/29/2005 7:33:58 PM
How did you tell the files "came back"? For example, the filenames may reappar
(particularly if you are using the obsolete FAT file system) but the contents may not be
present...did you check that the contents are also restored?

When I donate old machines to various charities, I remove the hard drives. I have too much
sensitive data, and I have no guarantee that the files will actually be deleted.

A fellow I knew spent his entire summer of ROTC/Reserve activity putting thermite charges
on hard drives. As he described it, a large truck arrived in the desert with several armed
guards. He and another guy signed out one hard drive, signed for it by serial number, took
it out, dug a hole, put a 1lb thermite charge (that's BIG!) on top of it, fired the
charge, and then both signed that the drive had been melted to slag. Then they signed out
the next one. This was back when large hard drives cost real money.
					joe

On 29 May 2005 10:16:53 -0700, curiousjohn4@yahoo.com wrote:

>Lets say I delete files with explorer and then empty the recycle bin.
>Then I use a program to wipe all unused disk space on all the drives.
>I verified this by watching the disk space on the drive go to zero.
>Then I had the swap file wiped on reboot.  So I figure the deleted
>files are long go.  Where else could they be?  Then I start an unerase
>program, and presto, the files still exists somewhere because the
>unerase can restore them!  Where is the unerase program getting the
>files and how can I permanently get rid of them?  Does anyone have any
>code to do this?  There must be some microsoft database that contains
>these deleted files.  If I empty the recycle bin and then wipe all
>*unused* disk space on all drives then where else could the files data
>be?  I restored a text file and it contained the correct text.
>
>Thanks for any help,
>Paul

Joseph M. Newcomer [MVP]
email: newcomer@flounder.com
Web: http://www.flounder.com
MVP Tips: http://www.flounder.com/mvp_tips.htm
0
newcomer (15973)
5/30/2005 5:08:08 PM
Check out

http://www.cs.auckland.ac.nz/~pgut001/pubs/secure_del.html

where he says, in the Epilogue,

"In the time since this paper was published, some people have treated the 35-pass
overwrite technique described in it more as a kind of voodoo incantation to banish evil
spirits than the result of a technical analysis of drive encoding techniques. As a result,
they advocate applying the voodoo to PRML and EPRML drives even though it will have no
more effect than a simple scrubbing with random data. In fact performing the full 35-pass
overwrite is pointless for any drive since it targets a blend of scenarios involving all
types of (normally-used) encoding technology, which covers everything back to 30+-year-old
MFM methods (if you don't understand that statement, re-read the paper). If you're using a
drive which uses encoding technology X, you only need to perform the passes specific to X,
and you never need to perform all 35 passes. For any modern PRML/EPRML drive, a few passes
of random scrubbing is the best you can do. As the paper says, "A good scrubbing with
random data will do about as well as can be expected". This was true in 1996, and is still
true now."


On 29 May 2005 10:21:27 -0700, curiousjohn4@yahoo.com wrote:

>BTW, I used a Peter Gutmann 35 pass when wiping the unused disk space.
>So there's no chance of the uneraser recovering the data.

Joseph M. Newcomer [MVP]
email: newcomer@flounder.com
Web: http://www.flounder.com
MVP Tips: http://www.flounder.com/mvp_tips.htm
0
newcomer (15973)
5/30/2005 5:10:38 PM
Thanks for replies.  I thought for sure it was MFT, but after using
sDelete I am now wondering if there's something else.  I used sDelete
to clean free space on C drive.  According to source code, sDelete also
cleans deleted files within the MFT.  Unfortunetely it still does not
clean everything.  There are a lot of files that are still restorable
on the C drive.  I checked the text within the restorable files and
they are correct.

BTW, I'm using Win2K.  I have 1 physical drive that is partitioned into
4 NTFS drives.  The other day I cleaned all 4 partitions but not with
sDelete.  sDelete is so slow that I think it would take days to clean
all 4.  Luckily the C drive is a small partition.  Is it possible that
the OS has somehow place some of the deleted C drive files on other
drives?  Windows is installed on the C drive.

Any ideas why sDelete -z C: does not clean everything?  Here is the
source code to sDelete
http://www.sysinternals.com/ntw2k/source/sdelete.shtml

// If we're just zapping free space, and this is NTFS, we have to take
care of
// deleted files within the MFT. We do this by creating as many of the
largest sized
// files we can (if there is space in the MFT, we'll be able to create
non-zero sized
// files, where the data is resident in the MFT record).
//
if( ZapFreeSpace ) {

	mftFilesCreated = 0;
	prevSize = 4096; // max MFT record size
	while( 1 ) {

		_stprintf( tempFileName, _T("%sSDELMFT%06d"), DrivePath,
mftFilesCreated++ );
		hTempFile = CreateFile( tempFileName, GENERIC_WRITE,
						0, NULL, CREATE_NEW,
						FILE_FLAG_SEQUENTIAL_SCAN|FILE_FLAG_DELETE_ON_CLOSE|
						FILE_ATTRIBUTE_HIDDEN, NULL );
		if( hTempFile == INVALID_HANDLE_VALUE ) {

			break;
		}

		//
		// Mft record can be up to 4K in size
		//
		cleanSize = prevSize;
		createdFile = FALSE;
		while( cleanSize ) {

			if( !SecureOverwrite( hTempFile, cleanSize )) {

				cleanSize--;

			} else {

				prevSize = cleanSize;
				createdFile = TRUE;
			}
		}

		//
		// If the only file we could create is length 0, then this is FAT
		//
		if( !createdFile ) break;

		if( mftFilesCreated == 1 ) {
			_tprintf( _T("\r
      "));

		}

		_tprintf( _T("\rCleaning MFT...%c"),
			progress[ mftFilesCreated % 8 ]);

		// Don't close the file, since we want it to keep the space until
we're
		// done.
	}
}

0
5/30/2005 7:54:50 PM
After a lot of playing around with the sDelete code I am fairly
confident that it cannot clean all of the MFT area.  Has anyone seen
any code to scan the entire MFT and wipe all the files that are marked
as deleted?

0
5/31/2005 12:42:37 AM
Reply:

Similar Artilces:

Delete symbol association
Is there a way of deleting a Symbol association in MM 2006 Premium? What I mean is, MM doesn't seem to recognize that FFFFX is the symbol for Fidelity Freedom 2040 fund. In my frustration in trying to figure out why MM wouldn’t recognize the symbols fund, I think I somehow accidentally associated the Symbol to an incorrect fund, thoough I have no idea how it happened. Now, whenever adding an investment to an account and selecting the fund named 'Fidelity Freedom 2040' from the 'Investment' dropdown, MM shows the wrong 'Last Price' and 'Change' since i...

Delete mailbox with command line
Hello, Does anyone know how to use command line to delete a mailbox in 5.5, I have some that will create but cannot find any to delete. Thanks, Adam XADM: Bulk Import/Export FAQ PSS ID Number: 155414 Adam wrote: > Hello, > > Does anyone know how to use command line to delete a > mailbox in 5.5, I have some that will create but cannot > find any to delete. > > Thanks, > > Adam Thanks for that, I am alot closer to where I need to be now. I can get it to export the info fine, but it doesn't delete the mailbox and I cant see what I have to do to get it ...

Read a jpg file
I have a program that loads a bmp file. I open the file, read all it's information and data I would like to do the same for jpeg For the bmp, I have those 3 structures: BITMAPFILEHEADER bmfHeader BITMAPINFOHEADER bmiHeader BITMAPCOREHEADER bmcHeader I open first the fil CFile dibFile( lpszFileName, CFile::modeRead ) Than, read the heade dibFile.Read( ( LPSTR ) & bmfHeader, sizeof( bmfHeader ) Than, read the size of the bm dibFile.Read( ( LPSTR ) & biSize, sizeof( DWORD Than, check BOOL bWin30DIB = ( bi...

Deleting a class
I inserted a new class into my project(Header file & .CPP). Now I would like to delete that class and reuse the old class's name. But after deleting its still there somewhere haunting me. Any help appreciated! Most likely, one of your files still include the header file. You should completely delete the source files or move them to another location. Then if you get problems compiling, examine the errors for clues to where an old reference may still exist. -- Jonathan Wood SoftCircuits Programming http://www.softcircuits.com "MikeChicago" <MikeChicago@discussions.m...

?? File Size Limit for Outlook PST???
Is there a file size limit to Outlook.pst?? I tried backing up Outlook.pst and the import/export routine barfed after a while telling me that the backup.pst file size was too large. When I looked at it in windows explorer, I saw that the backup.pst file was 1,932,000 and that outlook.pst was 1,902,000. Right now I can not send or receive emails and I can not delete any emails from within Outlook. I tried uninstalling and reinstalling Outlook - though I did not delete the existing .pst files - with no success. There is depending on version, will shift delete work for you or can you...

importing files
Is there a way to import to Outlook address book, calendar, memopad etc. from the Palm OS? ...

Help deleting a page from CPropertySheet
I have a CPropertySheet derived class called CAddTenantSheet. The following code creates the sheet fine. CAddTenantSheet sheet; CAddTenantPage1 m_page1; CAddTenantPage2 m_page2; sheet.AddPage(&m_page1); sheet.AddPage(&m_page2); sheet.SetWizardMode(); sheet.DoModal(); I would like to know how to delete m_page2 during the call to m_page1. Once I get the code working, I will use it to delete sheets that aren't needed, based on yes/no responses on earlier sheets. At the moment, may OnInitDialog() function in CAddTenantPage1 is BOOL CAddTenantPage1::OnInitDialog() { CPropertyPage:...

deleting messages in the newsgroups
Is there a simple way, like OE did, that will allow you to clean out (delete) old messages besides selecting them all and deleting? How did you do it with OE? WKMail works the same. To delete all: Highlight one and Ctrl + A will highlight them all. - Delete. To delete a section: Highlight the first one you want to delete. Scroll down to the last one and click on it while holding the Shift key down. - Delete. To delete multiple messages that are interspersed: Hold down the Ctrl key while you click on each message to highlight. - Delete. -- Bruce Hagen ...

query to delete negative numbers in HQ
Hello all, I have some negative items trapped in my HQ that are not in any of my stores inventories. I believe this happened when the supplier was changed. Is there a simple query to drop these negative numbers out of HQ?. This is a multi-part message in MIME format. ------=_NextPart_000_008C_01CA5950.12193CA0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Patrick, How about running a 501 worksheet and then a 190 task. --=20 Jeff=20 Check Point Software Search this newsgroup -- http://tinyurl.com/2lmk4w (Stolen from DRS) =3D=3D=3...

delete from combo box
Why deletion from a combo box is not working ? I have a control in my form called productid. In the onClick event of this control i have : Dim StrSQL As String StrSQL = "DELETE * FROM [order details1] WHERE ProductID = " & Me!productid & ";" CurrentDb.Execute StrSQL When i change the control from a text box into a combo box nothing happens and no deletion occurs.However when i change again from como box into a text box the deletion is OK. How can i make the onclick event work also with the combo box ? -- Message posted via AccessMonster.com http://www.accessmons...

Why is an exe-file include defined strings ?
Hi. Hooooooooo~ Listen... I have a next source: #define COMM_DATA ":300:%s" And next, I compiled the source. And as result, I got 'comm.exe' I opened the comm.exe. And I saw next result. ------------------------------------------------ ...... ..... abnormal program termination R6009 - not enough space for environment Microsoft Visual C++ Runtime Library :300:%s ...... ..... ------------------------------------------------ Why is comm.exe include defined string(COMM_DATA)? In case I use 'const char', I can hide the COMM_DATA. But another strings...

User files+KB Articles
- On the entity users it should be allowed attach files or notes - On the KB it should be allowed to attach files to the KB articles ---------------- This post is a suggestion for Microsoft, and Microsoft responds to the suggestions with the most votes. To vote for this suggestion, click the "I Agree" button in the message pane. If you do not see the button, follow this link to open the suggestion in the Microsoft Web-based Newsreader and then click "I Agree" in the message pane. http://www.microsoft.com/Businesssolutions/Community/NewsGroups/dgbrowser/en-us/default.m...

pst file might be corrupted
Hi all. I am not able to view my pst file at all via my outlook 2000. I tried to recover it via scanpst but scanpst stopped halfway through the process and said that an error occured without specifying which error. Is there any other way to recover this pst file? Thks in advance. How big is the PST file? "inenewbl" <inenewbl@discussions.microsoft.com> wrote in message news:6FB884E0-7C9F-4064-936F-5065E257BB5B@microsoft.com... > Hi all. I am not able to view my pst file at all via my outlook 2000. I > tried > to recover it via scanpst but scanpst stopped halfway ...

How to permanently delete files?
Lets say I delete files with explorer and then empty the recycle bin. Then I use a program to wipe all unused disk space on all the drives. I verified this by watching the disk space on the drive go to zero. Then I had the swap file wiped on reboot. So I figure the deleted files are long go. Where else could they be? Then I start an unerase program, and presto, the files still exists somewhere because the unerase can restore them! Where is the unerase program getting the files and how can I permanently get rid of them? Does anyone have any code to do this? There must be some microsoft da...

delete every other column...
Need a macro that'll delete every other column in a worksheet. Try something like the following: Dim ColNdx As Integer For ColNdx = Columns.Count To 1 Step -2 Cells(1, ColNdx).EntireColumn.Delete Next ColNdx -- Cordially, Chip Pearson Microsoft MVP - Excel Pearson Software Consulting, LLC www.cpearson.com <anonymous@discussions.microsoft.com> wrote in message news:4fc701c3ac3e$eccfb150$a601280a@phx.gbl... > Need a macro that'll delete every other column in a > worksheet. I'm so proud of myself. Created the macro and it works however want it to just run ...

98 .my file cannot be open.
I changed my computer for a new one with XP. Sinece then, I cannot not open the back-up .my files 98 version. I was getting the message that the file is encrypted, it cannnot be open with the current .my 98 version. So, I installed the .my 2004 updated version. I am still getting the same message. What should I do to restaure the .my files? ...

How do I set up a cell which should be suggested as file name to s
How do I set up a cell whitch should be suggested as the file name to save when "SAVE AS" is clicked? For example on a worksheet B2 is a date,(AUG-1-05) A1="SCHEDULE FOR "&YEAR(B2)&MONTH(B2)&DAY(B2) A1 will be "SCHEDULE FOR 200581" On the window that opens after clicking on "SAVE AS", how I can do, to bring "SCHEDULE FOR 200581" to the box of the suggested file name to save. Thanks. You need code Activeworkbook.SaveAs FileName = Range("A1").Value -- HTH RP (remove nothere from the email address if mailing direct) ...

Unable to Delete Picture Insert Square
At one time in Windows Live Mail, after inserting a picture then deleting it, I was left with a blank space, as it should be. Now if I insert a picture then delete it, I am left with a "double click here to insert a picture" square which I cannot delete. I must then either insert another picture or start a new email. Is there any way to delete this square? Thank you. -- What you describe as happening now is what happens when using Insert, Image, Photo E-mail. What used to happen for you is for Insert, Image, Inline. If you hit the backspace key, the...

Deleting duplicate contacts
Version: 2008 Operating System: Mac OS X 10.5 (Leopard) Processor: Intel Email Client: pop In attempting to export a single contact from Address Book to Entourage, it exported a whole category of 1,000 names. How can I identify and delete duplicates other than one by one?? <degas1900@officeformac.com> wrote: > In attempting to export a single contact from Address Book to Entourage, > it exported a whole category of 1,000 names. How can I identify and > delete duplicates other than one by one?? Google for scripts for Entourage. There are several out there that sh...

Please help... cannot open file
Hello! I just spent the last 3 days updating and balancing all my accounts from the last 8 months. I spent hours doing it and I normally never get behind like that, but I just had a new baby, so I don't have a lot of extra time to spare. Anyways... I'm getting the following error message: "Money cannot locate 'C:\Program Files\Microsoft Money 2006\tamra2006' or cannot open it, possibly because it is a read-only file or you do not have permission to change it or your disk drive is write protected. If you have chosen the correct file and it cannot be accessed, you w...

Permanently delete header
I have a merge document that is bringing in data from another program, Xactimate. When I open the document, it has a blank header. No matter how often I delete it and save my template document, it is always there when I open in again. This results in lost time deleting it manually for each use. Can anyone help? Once a document has had a header, it'll always be there (even if it has no content). If it's interfering with your body text area, you can make its margin 0 and give its paragraph a style with mminimal "Exactly" line spacing (1 pt, I think) and minimal fo...

Error when Opening Excel File
I'm getting this error message when opening a pretty basic excel worksheet. Does anyone know how I can find out how it is attached to the file... I've tried everything and can not get rid of it. I desperately need this file to be clean, any suggestions would be greatly appreciated. Cannot find 'c:\program files\IQSC\Q+E\[qe32.xla]qe32'$A1, which has been assigned to run each time [File.xls]Sheet1 is opened. Continuing could cause errors. Continu [yes] [no] There are no macros that I can see attached to the file.. ??????????????????????? ...

How do I retrieve deleted messages
Accidentally deleted e-mails permanently. Help! Check your Deleted Items folder. If not there... If you have an Exchange server you can recover deleted items by going to your Deleted Items folder and choosing Tools | Recover Deleted Items. If you don't have an Exchange server then you can restore your PST from backup. If you don’t have a backup... ....well, it's a nice day out. That’s something. -- -Ben- Ben M. Schorr, MVP Roland Schorr & Tower http://www.rolandschorr.com http://www.officeforlawyers.com/outlook.htm Author: The Lawyer's Guide to Mi...

file has grown
i have an excel 97 file which has suddenly grown from about 800K to nearly 4MB, i don't know why. it is a faily simple file, no formulas, just a big sortable, filterable list really. this is making it cumbersome to use across our WAN. i wonder if it has something to do with recently including a lot of comments? any help to reduce it's size would be appreciated. You may need to look at your files "Used Range." This is the area of each sheet that you have been into, and therefore Excel has to remember the whole sheet, rather than the section you use. I had a file that w...

Trouble with Outlook 2003 and PST File
Hi, We have a user who is using Outlook 2003 and moves most emails to a PST file which is considered archived email data. They have reached the Max limited on this PST file of 1.99GBs and its not letting them open the PST file. It is trying to repair it when they try to open the PST file. Here is the message they receive: "Can't move the items. The file <path>\<filename>.pst has reached its maximum size. To reduce the amount of data in this file, select some items that you no longer need, and then permanently delete them." I can't even get it open to delete...