Custom file erasing method: how to check result?

[Testoronius]

I want to see and save the contents of an erased file, to validate and compare different custom erasing methods. I figured I could use the XP command 'fsutil hardlink create', but seeing the contents after erasing, it looked like Eraser would always inject some pseudorandom .DLL code (to mask the erasing) and never will fill the file with, for example, only zero's.

Why isn't the erased testfile filled with 0's if my custom method consists of one pass of zero's?
How can I be sure that my custom method for files (not disk) is being used, if fsutil resistance is futile against The Erasing?

To explain a bit more:
Hardlinks act like pointers or hyperlinks to one and the same physical file on disk. Meaning the file would STILL be on disk if not ALL instances of the hardlinks were deleted. Altering the contents of by erasing (overwriting) one instance would automatically 'parse' the new data to the physical file. This way I can open files in my Hex editor after erasing them.

Reproducing the problem:

• 1. In Command prompt window:

  • echo>c:\testfile_a.txt
    fsutil hardlink create c:\testfile_b.txt c:\testfile_a.txt
    fsutil hardlink create c:\testfile_c.txt c:\testfile_a.txt

• 2. In Eraser GUI:
  • Erase c:\testfile_b.txt with custom method of one pass of zero's.

• 3. In HxD editor:
  • open file c:\testfile_a.txt as readonly
    open file c:\testfile_c.txt, select all and fill with zerobytes
    compare both files and see the difference.

Thanks for replying and thank you Joel for this great and indispensable privacy tool .

-----
PS: I know I can easily zeroing a file out in Hex Editor, but that's not my point.
PPS: I'm using Eraser version 8.5.5 and can not be convinced to upgrade to any higher version that requires the awkward .NET framework.

 

[garrett01]

mmm Eraser 8.5.5?? You must be using a time machine

If I recall the old versions would carry on erasing on top of whatever the plugin did.

Generally to test we use Truecrypt to create and mount a file drive then wipe this with zeros and install our test files for erasure. This way there is no chance of destroying valuable data while testing.
You can use the trial version of WinHEX to look at the drive.

We are looking to implement your feature in the 6.x version would you like to share your code?

 

[Joel]

Eraser 5 will replace all erased files with DLLs, if memory serves. Eraser 6 allows you to turn this feature off.

But if it's Eraser 5, unfortunately I don't think we've got the resources to maintain that any longer.