"Failures": Which files are normal not to Erase?

[spaulding]

After running Eraser 5.7 on my system (Windows XP Professional) there is a window listing erase "Failures". This is a long list of files. Can you tell me if it's OK for Eraser to leave these files, or whether certain ones should be erased? Here is the list of the types of files it failed to erase:

- many Symantec and Norton files.

- many System32 files. Most with .dll and .exe file extensions.

- several WinSxS\policies files.

- several WinSxs\x86 files

- several WinSxs\manifests files

- several PCHealth files

- several MSAgent files

- some LocalSettings\History files ending with index.dat

- some files with \ApplicationData\....\data or dat.log

- some files with \LocalService\ ending with .dat or .log

- many of these say (Protected) after the file name

Can you tell me whether any of these should be erased? - or whether it's safe for them to have been left behind?

-Spaulding

 

[spy1]

http://www.tolvanen.com/eraser/faq.shtml

"Q: "When I erase unused disk space I get an error with a long list of files that could not be processed. What am I doing wrong?"

A: Nothing, the meaning of this error is to warn you that not all unused space on the drive could be overwritten. This is because the files on the list were loaded in memory and therefore, locked by the operating system and their cluster tips could not be erased. You can reduce the amount of locked files by closing as many applications as possible before erasing unused disk space. You can find more information about the cluster tips from the help file."

As far as your questions go about the files not being over-written goes, I'll say it again - if you do not either specifically enter the path of the file into Eraser's list of tasks to erase - or use third-party "cleaning" utilities to delete/over-write that same info prior to running an Eraser free-space wipe, then Eraser's not going to touch it!

And if you do set the path's correctly, Eraser may still be un-able to erase the information if the file is "in use" at the time.

You also need to be damned sure you know what you're fixing to erase before you erase it.


If you want a list of third-party programs that'll nail a lot of that stuff, check out my first post in this thread:
http://bbs.heidi.ie/viewtopic.php?t=225 ... f20d8d2af5

And try to find the time to read the FAQ's page and use the Eraser "Help" files, okay? Pete

 

[Robbie]

as these files are necessarily (or otherwise!) locked by Windows, one option is to start XP in Safe Mode then do a Cluster Tip wipe. This will ensure that the cluster tips (the free space unused but locked - this is because file sizes don't exactly match the cluster sizes to which they are allocated) of many files which are ordinarily locked in normal XP mode can be wiped as the files aren't loaded into memory. You'll still get locked files but not as many.

I always find it hard to explain what Cluster Tips are, but in basic terms a file can vary in size but the clusters on the disk to which it is written are fixed in size. The end result is that there will usually be some unused space at the end of the last cluster - and of course this could contain sensitive data if the file was created by overwriting the space occupied by a previous file which is now "deleted" but residing in free space.

I would advise just running the Cluster Tip Area wipe alone and not a Free Space Wipe too as in safe Mode the process can take quite sometime just to do a Cluster Tip Wipe. I would also suggest just doing one (pseudorandom) pass to again speed up the process. I do this once in a while, perhaps once a month. As the free space in locked files can't be overwritten, it's highly unlikely to impossible that new data can get written to the free space at the end of the last cluster.