Still unallocated data after overwriting a file?

General discussion about data forensics.

Moderators: Eraser DevTeam, Eraser Moderators

Still unallocated data after overwriting a file?

Postby WellWhoKnows » Fri May 25, 2012 11:21 am

Windows XP or Windows 7 and file system NTFS ---> Is it possible - or maybe even very likely - that there's still unallocated data of a single file left on my PC after overwriting it at least three times? And if yes, is this unallocated data enough data for a professional person to recover more or less the entire file? Someone told me overwriting free space is the only 100% safe method to destroy unallocated data? Is this true? Thanks in advance for your answer(s).
WellWhoKnows
 
Posts: 1
Joined: Fri May 25, 2012 11:06 am

Re: Still unallocated data after overwriting a file?

Postby Joel » Sun May 27, 2012 11:09 pm

Possible - yes; likely - no. More often than not the problem with unused space erasure is not that it doesn't work, but that it gives users a false sense of security.

Let me explain. While the process works very well (to date, I've not had a single confirmed report of Eraser's unused space erase leaving traces of files behind), Windows like to make copies of files and hide them in inaccessible areas. These copies get scattered all over and do not count as deleted files, thus Eraser cannot reach them. Programs also like moving files around, which makes extra copies. These all add to the amount of residue on your disk, which you have to check once in a while.

I think other people may have suggestions on how they deal with this, so I'd wait for responses and also look around the forums.
Be sure to read the FAQ before posting. If you found this application useful, please contribute to Eraser's development.

I develop Eraser but I am not an employee of Heidi Computers Ltd. My views do not represent those of Heidi Computers Ltd.
Don't PM or Email me questions: they won't be answered any faster than on the forum and knowledge won't be accessible by all.
User avatar
Joel
Eraser DevTeam
 
Posts: 3688
Joined: Sat Aug 19, 2006 12:16 am
Location: Singapore

Re: Still unallocated data after overwriting a file?

Postby DavidHB » Fri Jun 08, 2012 5:11 pm

I think that there are two by now well documented approaches to the problem which Joel has described rather well.

If the intention is to completely clear a drive, the best thing to do, with Eraser 6.0.x, is to format the drive and then run a free space erase. This cannot be done, obviously, with a system (C:) drive.

If what is required is to clear all unwanted residues from a drive that has data on it that needs to be preserved, the best thing is to delete sensitive data explicitly, disable shadow copying, delete all unused restore points, and then do the free space erase. Then use a file recovery program (e.g. Recuva) to check the drive; Recuva has a useful facility to overwrite the deleted files it finds. Running the free space erase a second time can also reduce the number of files Recuva finds.

David
I am not an Eraser programmer, but a long-time user; my views may not be the same as those of the Eraser programming team.
Before posting, please read the top 4 topics in the Eraser FAQ, which already provide many of the answers users need.
DavidHB
Eraser Wizard
 
Posts: 2166
Joined: Sat Jan 23, 2010 8:10 pm
Location: Isle of Wight, UK


Return to Data Forensics

Who is online

Users browsing this forum: Google [Bot] and 1 guest