"Normal" vs. "Secure" file deletion?

[Foxxy]

If you were to simply overrite data with zeros it becomes irrecoverable (see 'The Great Zero Challenge').

 

CCleaner offers two methods of data deletion: "Normal" and "Secure".

 

It is to my understanding that "Normal" simply performs the afortementioned: overrites data with zeros.

 

However, what this "secure" method does is overrite said data with more randomly generated data afterward, making it extra irrecoverable. It even goes as far as to offer several different amounts of passes, making it extra super irrecoverable.

 

This is where I become confused: if overriting data with zeros (e.g. "Normal" file deletion) makes it irecoverable to begin with, why waste time and harddrive space passing over the deleted data several times over again with randomly generated data (e.g. "Secure" file deletion)?

[Augeas]

Normal file deletion is just the same as a shift/del. No data is changed or overwritten and the file name remains untouched. Secure deletion renames the file and overwrites it with whatever option is chosen. One pass is all you need. Why offer more passes? Public demand I guess, and there's no accounting for that.

[loveranger]

Normal file deletion is just the same as a shift/del. No data is changed or overwritten and the file name remains untouched. Secure deletion renames the file and overwrites it with whatever option is chosen. One pass is all you need. Why offer more passes? Public demand I guess, and there's no accounting for that.

Well if your doing some serious illegal {THINGS}, then it's just a peace of mind to use more than 1-pass.

Edited January 2, 2012 by Nergal
{MODERATOR EDIT} Please watch your language

[Augeas]

If I were, and I'm not, it isn't.

[Super Fast]

This is where I become confused: if overriting data with zeros (e.g. "Normal" file deletion) makes it irecoverable to begin with, why waste time and harddrive space passing over the deleted data several times over again with randomly generated data (e.g. "Secure" file deletion)?

 

Some people do have data recovery programs, & I know from testing them out, that there is a WIDE variance in what can & cannot be recovered. I have tested a utility that can recover deleted/corrupt partitions on a drive, as well as data from drives listed in RAW format, etc.

 

Although, it seems at present, that properly overwritten data is hard or almost impossible to recover. But I am a standard user.

_____

 

The Government has sophisticated machinery to use, such as Electron Microscopy drive imaging.

In addition, they also have machines to make an HDD read to the left or right side of a track just slightly, to pick up parts of an image that may have been slightly to the left or the right of the track that a drive is writing to. Think of it like a highway. A 3 lane one, where you are normally driving center, but every now & then, you like to pass someone in the left or the right lane. Same concept, just the data may be in the center of the track being written, or it may reside slightly to the left or the right of it.

 

And, I have also heard they have Magnetic Underscan tech, to try to make an image of the "Ghost" image that may be left on the underside of a track.

Then, you combine this with the fact that it has been said that certain goverment agencies do have the capability to read the drive with a specialized utility in order that they can determine, hey, if this is a 0 at this electron v level, then it must have been changed, & by using the volts level of the 0 & 1 beside that, determine what this track must have used to have been.

 

Some say they are able to go multiple levels deep with an advanced scanning algorithm. Hence, by overwriting a drive multiple times, you at least make them have to work that much harder to recover the data with such a utility. Frustrate them to the point they may decide it just isn't worth it, or even realize it is nearly impossible to recover, even WITH such utilities.

 

This isn't to mention that Windows marks sectors as bad when it is no longer able to read from them & if a guy can write a program like Spin Rite, then imagine what the government can do with specialized machines to mount your harddisk onto in order to read the data back, particularly in damaged/bad sector areas, as they would hold a treasure trove of data if successful.

_____

 

Given that the Government has much higher capabilities (& also $$$) than the normal user, it cannot be over-estimated what they are capable of. Would a standard user know about training a dog to search for a missing person? No! Nor would they know about finger printing techniques or how to do a number of other forensics related tasks involving capturing data from a machine via a specialize machine that images a drive via a hardware write blocker to prevent changes to the data they are recovering live.

_____

 

P.S. Why all the paranoia? Well, given that areas like China are prevented from accessing a lot of things considered by the Government as illegal, it helps people in China to rest more or lest at ease of mind, knowing they are able (hopefully) to overwrite the data on the drive enough times to prevent the recovery, even by the government, should they be after someone for whatever reason.

 

Oh, it isn't just users in China anymore. Look at the Homeland Security act.

 

You do the math,

[loveranger]

Or they could simply encrypt their whole hard drive with Truecrypt before doing anything illegal. Hidden or not.

[Augeas]

Before we go too far off-topic, any discussion relating to illegal activity will be securely wiped.

[login123]

Before we go too far off-topic, any discussion relating to illegal activity will be securely wiped.

 

Good idea. Don't do the crime, save yourself the time. A little rhyme. MMUUaaahaaahaaa.

[loveranger]

Good idea. Don't do the crime, save yourself the time. A little rhyme. MMUUaaahaaahaaa.

Or do the crime and save yourself A LOT of time by encrypting. LOL.

[login123]

Before Augeas locks this topic up tighter'n a pit bull on a pot roast (which he should, imho), I'll say this.

 

What's out there that we've not heard of? When I think of the progress in hardware and software in the last ten years, I don't fool myself that I can hide anything if the big boys really want to see it.

 

edit:

@ Foxxy. Back on the main topic, as Augeas said, secure file deletion, 1 pass, will thwart any normal effort to recover a file. Most here (not me, but most) hold that anything beyond 1 pass is just unnecessary wear & tear on the HD.

[DennisD]

I'm sure Augeas will forgive me for calling time on this one in his absence.

 

Topic closed. No explanation needed.