Erase cluster tips on individual files

Discuss proposed patches here.

Moderators: Eraser DevTeam, Eraser Moderators

Erase cluster tips on individual files

Postby cosmicnet » Sat May 15, 2010 1:23 am

Just like you can erase and erase on reboot, erase cluster tips for an individual file or collection of files would be really useful.
cosmicnet
 
Posts: 8
Joined: Thu May 06, 2010 11:38 pm

Re: Erase cluster tips on individual files

Postby DavidHB » Sat May 15, 2010 10:29 am

Please enlighten me ... how? If you erase the cluster tips without also erasing free space, there is a near certainty that you will still have recoverable 'deleted' material.

David
I am not an Eraser programmer, but a long-time user; my views may not be the same as those of the Eraser programming team.
Before posting, please read the top 4 topics in the Eraser FAQ, which already provide many of the answers users need.
DavidHB
Eraser Wizard
 
Posts: 2166
Joined: Sat Jan 23, 2010 8:10 pm
Location: Isle of Wight, UK

Re: Erase cluster tips on individual files

Postby cosmicnet » Sat May 15, 2010 10:59 pm

If you know from other software that particular files cluster tip has sensitive data. For instance you've already done a complete wipe of free space, cluster tip has been missed in this file because of permission, system file, whatever. You drop the system attribute/change permissions and don't want to have to do another complete free space wipe when all you need to wipe is this particular files cluster tip.

Considering the functionality for wiping cluster tips is already in Eraser, without looking at the code directly (yet) I don't see that it would be much of an issue to add this feature. And it would be useful to people who find things in cluster tips that Eraser has missed.
cosmicnet
 
Posts: 8
Joined: Thu May 06, 2010 11:38 pm

Re: Erase cluster tips on individual files

Postby DavidHB » Sun May 16, 2010 12:19 am

I see two significant problems here.

Firstly, I know of no practicable way of accessing the contents of a cluster tip separately from the parent file. Eraser, AFAIK, does not do this. It simply finds the final cluster, then presumably locates the end of file marker and erases from there to the end of the cluster. So there is, I believe, no way of knowing which, if any, cluster tips need to be erased.

Secondly, Eraser only does not erase cluster tips when it cannot access the file, usually because it is a protected system file. Any application that runs under the OS that protects the file will have this problem. I don't know if there is a way round this problem, short of running a program like Eraser from a separate OS that ignores Windows protection. I think we are rather a long way from having a version of Eraser that runs like this. Whether future versions of Eraser (particularly those that have the engine running as a service, rather than as a process) will be less hampered by Windows permissions I do not know. If they are (which would be a very good thing), more cluster tips will be erased normally as part of a free space wipe, and security issues correspondingly reduced.

All that said, I stick to my view that (1) what is in the free space is more likely to present security problems than what is in the cluster tips and (2) what is stored in places the user does not know about is much more of a problem than either.

David
I am not an Eraser programmer, but a long-time user; my views may not be the same as those of the Eraser programming team.
Before posting, please read the top 4 topics in the Eraser FAQ, which already provide many of the answers users need.
DavidHB
Eraser Wizard
 
Posts: 2166
Joined: Sat Jan 23, 2010 8:10 pm
Location: Isle of Wight, UK

Re: Erase cluster tips on individual files

Postby Joel » Sun May 16, 2010 5:21 am

DavidHB wrote:Firstly, I know of no practicable way of accessing the contents of a cluster tip separately from the parent file. Eraser, AFAIK, does not do this. It simply finds the final cluster, then presumably locates the end of file marker and erases from there to the end of the cluster. So there is, I believe, no way of knowing which, if any, cluster tips need to be erased.
Correct, Eraser then restores the file back to its old length. Hence that's why erasing unused space + cluster tips causes so much of these errors.

DavidHB wrote:Secondly, Eraser only does not erase cluster tips when it cannot access the file, usually because it is a protected system file. Any application that runs under the OS that protects the file will have this problem. I don't know if there is a way round this problem, short of running a program like Eraser from a separate OS that ignores Windows protection.
Not that I know of, either.

DavidHB wrote:I think we are rather a long way from having a version of Eraser that runs like this. Whether future versions of Eraser (particularly those that have the engine running as a service, rather than as a process) will be less hampered by Windows permissions I do not know.
Yes, but after that, the majority of files will be in use. And even when the permissions problem is fixed, most system files belong to TrustedInstaller, which has more "God" powers than the SYSTEM account.

DavidHB wrote:If they are (which would be a very good thing), more cluster tips will be erased normally as part of a free space wipe, and security issues correspondingly reduced.
I hope so!

DavidHB wrote:All that said, I stick to my view that (1) what is in the free space is more likely to present security problems than what is in the cluster tips and (2) what is stored in places the user does not know about is much more of a problem than either.
I came to the same conclusion.
Be sure to read the FAQ before posting. If you found this application useful, please contribute to Eraser's development.

I develop Eraser but I am not an employee of Heidi Computers Ltd. My views do not represent those of Heidi Computers Ltd.
Don't PM or Email me questions: they won't be answered any faster than on the forum and knowledge won't be accessible by all.
User avatar
Joel
Eraser DevTeam
 
Posts: 3688
Joined: Sat Aug 19, 2006 12:16 am
Location: Singapore


Return to Eraser Programming

Who is online

Users browsing this forum: No registered users and 2 guests