I know there are a number of secure deletion programs for windows.

But If someone wanted to do a simple deletion of a private document, could they do so by opening it up in Notepad/Wordpad, erasing the contents or replacing the garbled text with false data and then "saving" it?

How secure would this method be? How would you go about data recovery?


In the best of cases, the process you describe would work if you replaced the exact size of the existing file in gibberish and saved it.

That said, this is a very poor mechanism for secure deletion, as it can be interfered with by the operating system or other applications, and because it uses the top level filesystem API, which doesn't always mesh with the underlying physical storage operation the way we think it would. the exact implementation of your specific filesystem may have an impact as well (eg MS NTFS v5 and ntfs-3g may not work the exact same way).

first, consider, that the reason we need secure deletion, is because when windows (or linux) deletes a file, it removes the indexes pointing to the location of the file data, but it does not delete the data itself.

This means that someone could read off the disk, completely ignoring the indexes, and see the file right there. the windows Filesystem API doesn't show it, but if you can find its address, and it hasn't been overwritten by a new file, it can be recovered. This is how scavenger/carver utilities like photorec work (well, part of it anyway). Data recovery tools operate below the windows filesystem implementation, so they don't play by the same rules.

so, lets say you open a document, delete all the text, and save it. assuming it saves over the same spot, your filesystem index will point to the same spot on the disk, but its length will be shortened. since the new file takes up a lot less room than the original, most of the data from the original file is still on the disk. a bit of the file may have been overwritten by the altered file's storage structure (end of file delimiter of some kind), but you could recover much of the rest of the data. this is sophisticated so most adversaries would not resort to such an operation, but it is still possible.

the bigger concern though, is your OS and application specific recovery mechanisms. features like ShadowCopy or user persistance can stash copies of the file in unexpected locations. In terms of apps, if you were working with a word document, word is saving a temp copy of your file to disk every 10 minutes by default. upon save and close these files are deleted, but a simple undelete utility like Recovua can recover them, with all their data.

So, to sum up, use Eraser or wipe or shred, and keep an eye on your profiles temp file storage.

| improve this answer | |

Of course, ostensibly this is what programs like Eraser do: just write gibberish over the file, a couple dozen times, and it's unreadable. You should be as safe as if you had used Eraser to write over the file exactly once with the same data you used. If you used data that is predictable in any way, that weakens the security of the erasure, because the erasure can be forensically reversed.

And if you're using a solid state drive, all bets are off. You have no guarantee that the sectors you're overwriting are the sectors with your original sensitive data.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.