Recent content by Kythe

It depends entirely upon the threat. If you're talking about an Encase/Winhex/other forensics data gathering used on the drive, then one pass with all zeros will be sufficient. If you're talking about physical examination of the original drive using the most advanced imaging techniques...

The bottom line is: there are several ways to get rid of Index.dat files; some are automatic (my preference, used on every shutdown) and some are manual (running Index.dat Suite, which I've also run and find informative). So you have options. Try them and see what works best for you.

Eraser basically wipes free space by creating lots of small files filled with pseudorandom data. However, there's more to it than that. If the hard drive has been filled, you probably wiped most of what there is to find, at least as far as the ability of file recovery programs to find old...

I like Index.Dat Suite, but I generally prefer to do all my tracks cleaning during shutdown, so I use shutdown scripts to (among other things) Erase my Index.dat files. Pretty much amounts to the same thing.

Absolutely. I've been running an Eraser freespace wipe as the last step in logoff/shutdown scripts for over a year, now. Since that's generally done at night, I don't mind the fact that it takes a while to do the wipe -- which is probably why I've never tried the "quick erase" option in new...

Yes it does, which makes a search of the drive using a tool like Winhex, looking for known text strings (for example) worthwhile. You might find another copy that can be recovered in whole or in part. Actually, it's not a bad idea to occasionally use such a tool anyway, to make sure your...

The free-space wiping will do the trick with MFT. It will also clear out the NTFS journaling file, which will otherwise store around 4 MB of your most recent disk activity for anyone to find.

If you've erased files, they're gone. As a poster above this noted, it might be possible to find backups or unerased temporary versions of the files on your drive. But barring that, the files are unrecoverable. That's what eraser is designed to do :)

index.dat files are a tad tricky. Depending upon which version of Windows you use, some are operating-system protected, and some aren't. Just your luck, some of those that are protected contain sensitive information about your activities. There are really two options when it comes to...

Overwriting the page file, even with all zeros, will make it unrecoverable unless someone takes a magnetic force microscope to the drive. If it still worries you, a better option (if you don't have enough system memory to eliminate the page file) is to encrypt the file. There are a couple...

There will be a cumulative effect of the passes in terms of recoverability of very old data that's been overwritten multiple times, so yes, running eraser three times with one pass each is essentially equivalent to running once with three passes. Of course, someone would have to use hundreds of...

That's fine. It sounds like you're running Spybot in "advanced mode" and have the "Tools" submenu open on the left hand side. In the upper left hand corner of the window, you should have buttons that say "Spybot S&D" and "Settings". Click on the "Spybot S&D" button, and once you do, the icon...

I didn't think that at all. I think you are pretty new to computers and the information they hold, and want to be sure. Nothing wrong with that. I've been playing with/programming/configuring computers in one form or another for nearly three decades. So I have a measure of confidence in this...

Well (again, to the best of my knowledge), Eraser sees a drive to fill up and creates files of random characters until it's full. It stands to reason that the function is carried out in the same way on anything that appears to be a drive. I would think you could test this function with file...

Well, I would suggest you not take his--or my--word for it. You can verify these things yourself using free recovery software and Regedit before and after a Spybot scan and clean. For myself, I've verified, using before and after examinations of raw disk data and looking at the registry...