4

Several tools like CCleaner and Eraser allow you to wipe unallocated space on your hard-drive. To wipe data that has yet to be deleted, as well as to wipe the partition table itself, a tool like DBAN or anything equivalent that zero-wipes the drive would be needed, but for data that has already been emptied from the Recycle Bin or "permanently" deleted from within Windows in some other way, is it sufficient to wipe unallocated space to make that data irrecoverable?

If it isn't sufficient, then what exactly is the purpose of these tools, and are they as much of a gimmick as being able to use CCleaner to run 35 zero-write passes on a drive?

  • 1
    I'm confused as to why this has been downvoted. Why is this a bad question? – Hashim Oct 21 '17 at 23:35
  • 1
    It's a good question, actually. – Jan Doggen Oct 23 '17 at 8:47
  • Who are trying to be protected against? Random average Joe, doesn't have the tools or expert knowledge. A world government, who won't blink spending 100,000 to get your data if it is valuable enough? – cybernard Nov 29 '17 at 22:13
  • @cybernard For the sake of the bounty, a good answer would account for both scenarios. – Hashim Nov 29 '17 at 22:20
2
+50

... for data that has already been emptied from the Recycle Bin or "permanently" deleted from within Windows in some other way, is it sufficient to wipe unallocated space to make that data irrecoverable?

It depends on how "irrecoverable" you need to make that data.

Since the file system allocates pieces of the hard drive in multi-byte clusters, you might find parts of deleted and wiped files in clusters that are shared with files that have been created after the deleted files were deleted.

Since that was confusing to read, here's an example:

Windows 10 uses the NTFS file system, which by default allocates space on the hard drive for files in 4KB clusters for HDDs smaller than 16TB. Let's say you download a file - foo.txt - that is 4KB in size. The file system allocates the 4KB cluster B to hold foo.txt. Now you delete foo.txt, and then download bar.txt, which is 6KB in size. The file system allocates two 4KB clusters to hold bar.txt: A and B. It write the first 4KB of bar.txt into A, and the remaining 2KB into B. The rest of B holds the last 2KB of foo.txt still. Now you run your free space wiping tool, which, since it operates at the file system level, bypasses cluster B because it is occupied by bar.txt, so at the end of that wiping, the last half of foo.txt remains on the hard drive:

Download foo.txt:

     A       B
|********|ffffffff|

Download bar.txt:

     A       B
|bbbbbbbb|bbbbffff|

What does this mean? Well, if you want to pass your old computer on to a friend, you can remove all of your data, wipe the free space, and pass it on with the OS and programs intact, secure in the knowledge that you will not be embarrassed by anyone finding your old bank statements or love letters. If your computer holds secrets valuable enough for someone to spend lots of time doing a bit-by-bit examination of the hard drive to recover, you'll want to do a complete wipe, such as what DBAN does.

  • Yeah, @harrymc, I probably could have been more clear, but I think the information is correct. Thanks for the upvote; perhaps the person who downvoted could leave a comment explaining what's wrong. the downvote did prompt me to do more research, and I found that NTFS might zero-out partially-used clusters, but it seems to be implementation-dependent. Some free-space cleaners do claim to wipe the cluster tips, again, depending on the file system implementation (e.g., wipefreespace.sourceforge.net, eraser.heidi.ie). – Peter Dec 2 '17 at 23:13
1

Multi-wipe tools are a gimmick. There is no need to write over a file more than once. This is a myth that has persisted for far to long. You dont even need 3rd party tools, as Windows has a tool to wipe deleted data built in: cipher. This all pertains to hard disk drives, not solid state disks.

  • I'm aware of most of this, although I did find this answer useful for the cipher mention. I wasn't aware that command existed, and I'd recommend making a question of your own about a Windows command-line equivalent to free-space wiping tools and answering it, as that was about to be the next question I posted, but that said, this answer doesn't answer the question I asked. – Hashim Oct 22 '17 at 2:24
1

The problem is you have consider who your protecting your data from.

  1. Average Joe

    There are a few $100-$300 tools that might help in recovering a few bytes here and there. However, in most cases all hope is lost.

  2. A government agency FBI, NSA, or etc They have a budget and the ability to pay basically unlimited money if the need is justified. Machines exists that cost $100,000 or more that will use a laser to read the surface of the disk at much greater sensitives than the heads of the hard drives can manage. So they might be able to do it.

I have had real world experience sending in my own hard drive for data recovery and its a very costly business. The starting price was $900 so I said yes. After they final got to my drive they said no it was a head crash. However, for a $3000 retainer (the final cost TBD) they could try an intensive recovery, but they couldn't guarantee results. I came to my senses and said "No thanks". They did refund most of the $900 since they couldn't do anything. They even added it their pile of 100's of drives going back to seagate free so I could get a new drive.

0

Such a tool would make files in unallocated space irrecoverable in software. It's theoretically possible that with some really expensive equipment the surface of the HDD could be inspected to recover deleted data.

  • This is true for zero-wiping, but I'm specifically asking about the difference between zero-wiping an entire drive and only wiping the drive's unallocated data. – Hashim Oct 21 '17 at 23:33
  • Pretty much the tools will set all bits 1 and all bits 0 in each unallocated sector several times. – jdwolf Oct 21 '17 at 23:34
  • But in practice, what does that do? Am I correct in my guess that it would sufficiently make any data that has already been emptied from the Recycle Bin in Windows - or otherwise permanently deleted, like deleted backups from Backup Management - irrecoverable? – Hashim Oct 21 '17 at 23:37
  • Normally file systems simply unlink to inodes. So the file data in the sectors are recoverable. This goes threw and not only zeros but does a few rounds of setting zero and ones to insure the data is gone. – jdwolf Oct 21 '17 at 23:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.