Deleted Files

Last week I had two people ask basically the same question. The question was: "is it possible to completely remove data from a hard drive?" The simple answer is yes and no. When you send a file or folder to the recycle bin or the trash can (for you Mac users) the file is actually still there. Until you empty the recycle bin, the file is still there. But even if you empty the recycle bin or trash can the files are still there on the hard drive. Basically, when you delete a file the only thing that is deleted is the file name or the reference to the file in the file allocation table. With the right software, it is relatively easy to recover deleted files from your hard drive. Some file recovery software can even work over a network connection. What this means is that if you have confidential information or documents on your computer, simply deleting them does not get rid of them and an enterprising person could, if he or she wanted to, get at those files on your hard drive and see your confidential information.

If you have financial information or any other sensitive or confidential information on your hard drive you should always keep this in mind that once deleted, your files are not really gone. Often times, in a corporate environment, computers get moved around. The CFO gets a new computer so his assistant gets his old one. Steps are taken to remove all of the files on the computer's hard drive so that sensitive company information such as salaries and bank account numbers are no longer there. The assistant, disgruntled and low paid who just happens to know how to recover deleted files, runs a little software utility on the "cleaned" hard drive and by the next day he has enough information in his hands that he can now clean the company's bank account and by the next day is pleasantly retired at the age of 37 on a beach somewhere in the South Pacific.

There are some very good file recovery utilities on the market today. Programs such as Undelete for Windows works very well at recovering files locally or over the network. Other utilities such as Lost and Found or EasyRecovery can recover files from what most people would consider to be a dead unbootable hard drive. Recovery can even be done on a hard drive that has been formatted. I have used software such a this on a hard drive that had a damaged FAT to recover two years worth of genealogical research that my wife had done. It worked beautifully. These software solutions claim that if the drive can spin, the data can be recovered.

If these software methods do not work, there are services such as Datarec that are dedicated to file recovery, from hard drives that do not even spin. The cost of this service can run from several hundred dollars to several thousand dollars for the recovery of the lost files. What I am trying to point out here is that unless you take special measures the files on your hard drive can be gotten back out again, even from a hard drive that has been trashed as so much junk metal.

With proper care your files can be permanently removed from your hard drive. In order to completely delete or wipe your hard drive the data must be removed first and then overwritten with other data. The overwriting is not just more data, but overwriting with 1's and 0's. To be completely sure the overwriting should be done several times. If you were to look at a hard drive that has been wiped this way with a hex editor you would see 0x24 0x92 0x49 0x92 0x49 0x24 in a never ending pattern. Most of your good software file wipers will overwrite at least three times, and some of the more sophisticated utilities will overwrite twelve or more times. After the overwriting with 1's and 0's, some file shredders or wipers will then re-write once more with random data.

OnTrack a company that also offers data recovery sells two versions of it's data wiping software DataEraser, one for professional users and one for home users. The professional version let's you choose from one overwrite, three overwrites, or as many overwrites as you wish. It also lets you choose the overwrite pattern that best suits your needs or level of paranoia.

Another good Windows file eraser is called Shred-X. In it's simplest and easiest form, Shred-X uses a drag and drop interface. Just drag and drop the files or folders that you want to completely delete onto the Shred-X interface and they are gone, overwritten up to 35 times to ensure complete deletion. Shred-X also destroys the file allocation table number and size information of the files that are deleted so that no record of the file exists. You can also set Shred-X up to run at a scheduled time in the background. In this mode it runs Scandisk to account for all lost clusters and overwrites them and then runs defrag to remove the file allocation table record of any deleted files.
Wipe is a secure file deletion tool for Linux users. If you use Wipe be sure that you get version 0.16 or above. Earlier versions were bug ridden.

For you Mac users there is also a utility called The Eraser that securely deletes files, overwrites them a user specified number of times and also destroys the resource and data forks of the files so that no trace of the file is left.

Well congrats, now you know! Good luck!