imaging hard drives and eraser

General discussion about data forensics.

Moderators: Eraser DevTeam, Eraser Moderators

imaging hard drives and eraser

Postby rmits » Wed Jun 09, 2010 6:31 pm

I am a newbie so sorry if this is way off base...

So I am transferring some files from hard drive to a USB drive. Then I want to erase the files on my hard driver.

I do delete from hard drive. Then I go to recycle bin and do eraser. I also go to my c: and run eraser. I believe this will prevent anyone from
a) recovering the data...
b) from finding out that i actually transferred data to USB drive...'

I am pretty sure about (a). Not so sure about (b).

Posts: 6
Joined: Wed Jun 09, 2010 6:26 pm

Re: imaging hard drives and eraser

Postby DavidHB » Thu Jun 10, 2010 11:18 am

Because the entries in the MFT will be overwritten, the answer to both your questions is 'yes' for the files you actually erased. But parts of those files may reside in the Windows paging file, and possibly even in the files related to System Restore points. And don't forget any backups (particularly drive images) you may have made. If you wiped free space that should have taken care of things such as fragments any defrag process left behind.

It really is quite hard to make sure that a file is gone from your system, period, short of backing up the drive (after you erase the files, of course!), formatting then wiping it, and restoring the backup, and even that approach is quite difficult with a system drive.

I am not an Eraser programmer, but a long-time user; my views may not be the same as those of the Eraser programming team.
Before posting, please read the top 4 topics in the Eraser FAQ, which already provide many of the answers users need.
Eraser Wizard
Posts: 2166
Joined: Sat Jan 23, 2010 8:10 pm
Location: Isle of Wight, UK

Re: imaging hard drives and eraser

Postby Joel » Fri Jun 11, 2010 11:56 pm

To directly answer your question, b) is hard to prove even if you don't erase -- unless you moved the files, which could leave the file reference behind. If you copied the file, no one would have known any better than you made a copy.

The paranoid among the users of the forum will also note that image backups may also store cluster tips, and depending on the type of backup, free space may also be backed up. Hence, that's why the Free Space erase was suggested to begin with. Alternatively, you can always create a small partition and put sensitive files inside, and wipe it completely (by using Eraser's drive nuke feature to be implemented in future) once in a while.
Be sure to read the FAQ before posting. If you found this application useful, please contribute to Eraser's development.

I develop Eraser but I am not an employee of Heidi Computers Ltd. My views do not represent those of Heidi Computers Ltd.
Don't PM or Email me questions: they won't be answered any faster than on the forum and knowledge won't be accessible by all.
User avatar
Eraser DevTeam
Posts: 3688
Joined: Sat Aug 19, 2006 12:16 am
Location: Singapore

Return to Data Forensics

Who is online

Users browsing this forum: No registered users and 2 guests