Simple guide to deleting internet content with Eraser!!

[Kythe]

Hello Again.

I've been over asking some more questions at another forum, anyway, I've come back feeling even more worried- I've no idea whether what they were saying was true or not - but thought I'd come to ask here just to confirm.

I was saying about how I try to run an unused disc space as regularly as possible, and then someone on the forum said that there's no way simply running an unused disc space wipe would get rid of deleted files- they said a basic user would be able to get the data back in instant using free recovery software. It was a proper computer forum, but I highly doubted what they were saying was true because of everything everyone has said on here. :? Will someone just confirm that what they were saying is untrue, so I don't have to worry. :shock:

The same person told me running spybot s&s won't delete data in the registry- is this true or not as well??

Finally, as I said a while ago my temp files won't delete. I've tried safemode and pocket killbox, neither work- is there anything more I can do to try to delete them. Would switching from administrator or user account maybe work??!

Thanks!

Well, I would suggest you not take his--or my--word for it. You can verify these things yourself using free recovery software and Regedit before and after a Spybot scan and clean.

For myself, I've verified, using before and after examinations of raw disk data and looking at the registry, that what the gentleman (lady?) told you was simply wrong. Spybot deletes information from the registry such as User Assist entries and MRU ("Most Recently Used") entries. If this weren't the case, then running Spybot, telling it to eliminate the problems it finds, then running it again would find the same problems. Many of these things are found in the registry.

For example:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU

is the key location for Windows' "Open/Save file" history. You can look at this location yourself by running "regedit" and navigating to that location.

Now run Spybot, and tell it to fix the "Common Dialogs" entry it finds.

Navigate to the location again, and you'll find that it's been cleared.

As I noted above, I've done extensive testing for myself and found that Eraser does indeed fill empty (unused) disk space with random bytes. In doing so, it overwrites the existing deleted file data. How is a recovery program to get such data back? By magic?

The evidence simply doesn't support the claims you quoted.

 

[Techno phobia]

Sorry if you think I'm being ungrateful for all the information people on here have given me, I'm honestly not. It's just difficult when you are being given two completely different pieces of information. I thought what they said was very unlikely, but I just wanted to confirm.

Anyway I'm back again because I've been having some problems with spybot and eraser. I ran an unused disc space wipe last night, however when the report came back everything had failed to be erased, and there was no mention of recycle bin content either. As the wipe reached the end it did say "removing temporary files," does this actually mean they were removed, or does the fact that the report said everything on the list was failed mean they were not removed?

Also I checked for problems with spybot but no problems were found i.e I wasn't given the option to delete usage tracks. Is there any way I can make spybot give me the option to delete usage tracks?

And finally, I go on one forum where you actually have to log in to view it, if I log out of the forum before logging off my PC, would that stop someone being able to view it through a temp files, cookie, history file, reg key etc.??

Thanks for your help, I really do appreciate it.

 

[Robbie]

wouldn't it be easier to just not use the internet! I think you're worrying too much - the advice in this thread is more than sufficient to put any worries to rest.

Use Mozilla Firefox, not Internet Explorer then you can set up Eraser to delete cookies etc without any worries. Or even set up Firefox to not store sensitive and tracking data at all. There's enough data in this forum , and in this thread to answer all you need to know. Seriously, if you wipe all the useage tracks and files/folders that have been suggested, the only people that will ever be able to recover anything (if that is even possible) are law enforcement and if there's nothing dodgy going on then you've no worries on that score.

I really think you are worrying far too much, so long as you follow the suggestions here I can't see any problems.

 

[Robbie]

By the way, the answer to your question: about logging out of a site before closing down the computer - if you use IE then it will leave details of the site you have visited and logged into in various places - temp internet files, the matching index.dat file, cookies, cookies index.dat, history, history.dat file, registry entries.

Use CC (Crap cleaner!) to delete all these files if you want OR set up an on demand schedule with Eraser to wipe these files and folders, log out of your profile, log in to Admin in Safe Mode, run Eraser to wipe these files (this will delete the index.dat files which are otherwise locked). Then run CC anyway to delete the registry entries.

Or like I said use Firefox and set up a simple On Demand Schedule to wipe FF's equivalent of Temp Internet Files (Cache and cache.trash) plus sign-ons, cookies and history. That is a far easier option plus it leaves no urls in the registry. But still run CC anyway, to remove other useage tracks (or like some said, use Spybot). Then run a free space wipe on Eraser on a regular basis. I do a 1 pass (PRNG) wipe almost everyday and a 7-pass wipe once a week, but that's because I use my computer for banking and other financial stuff and things can get deleted but still be recoverable on ocassions (especially, again, when using IE - temp internet files can just be dumped into free space).

But if you follow the suggestions in this thread, I really think you have nothing to worry about. Eraser does work. It's a pity it can't delete registry entries too (it's only drawback) but there's enough programs out there that you can use for that - CC for me, and I use MRU Blaster too. then there's BC Wipe which has a 6 week free trial that wipes recently used files lists too - it lets you know where the registry keys are, so you can make a note of these if you need to double check.

 

[Kythe]

Sorry if you think I'm being ungrateful for all the information people on here have given me, I'm honestly not. It's just difficult when you are being given two completely different pieces of information. I thought what they said was very unlikely, but I just wanted to confirm.

I didn't think that at all. I think you are pretty new to computers and the information they hold, and want to be sure. Nothing wrong with that.

I've been playing with/programming/configuring computers in one form or another for nearly three decades. So I have a measure of confidence in this sort of thing, even though computers still surprise me.

Anyway I'm back again because I've been having some problems with spybot and eraser. I ran an unused disc space wipe last night, however when the report came back everything had failed to be erased, and there was no mention of recycle bin content either. As the wipe reached the end it did say "removing temporary files," does this actually mean they were removed, or does the fact that the report said everything on the list was failed mean they were not removed?

When Eraser does a freespace wipe, it's actually doing a couple of things:

1) Cleaning extra space after the end of each file stored in your system.
2) Creating lots of small files consisting of random filenames and random data to clear the rest.

One thing about hard drives you need to know is that the space on them is allocated in chunks of data called "clusters". Typical sizes of clusters might be 1024 to 4096 bytes. This is the smallest amount of space a small file can take up on your hard drive. So, for instance, if you create a text file consisting of one byte, it will still take up the minimum allocated cluster size of 1024 to 4096 bytes (depending upon your hard drive).

What this means is that a cluster that used to hold a large amount of data, and now holds a small amount of data, is still considered "fully occupied". It also means the old data is still sitting there, unused, after the end of the current file, since the current file takes up less space in the allocated cluster than the old data. So normal writing of files to the disk won't overwrite this old, unused data in an otherwise occupied disk cluster; the file system considers the entire cluster "taken".

Hard drives do this, by the way, because the size of modern disks is much too large to keep track of each and every byte, and trying to do so would slow things down lots, too. So it allocates data a bunch at a time.

In order to eliminate this data, Eraser wipes "Cluster Tips". My understanding is that it does this by adding random data to the end of whatever file currently occupies a given cluster, until the file fills up the cluster in question, thus overwriting the old data. It then reverts the file back to its original size.

A problem comes in when a file is locked, however. This might be the case with files you don't have permission to access, or system files. And it's these locked files that Eraser is reporting errors on.

The good news is that the locked status of these files means it's unlikely the cluster data at the end of the files contains old data in the first place. But if you're concerned, you can maximize wiping by running Eraser's free space wipe on shutdowns, under a couple of different user names and before and after disk defragmenting.

To answer your second question: When Eraser wipes the rest of the unused space on the drive, all it does is create tons of small files consisting of random data. At a guess, it makes these files equal to the cluster size, to make sure all disk clusters not otherwise occupied are completely overwritten.

After doing this until the disk is full, it then deletes these "temporary files". So in doing a freespace wipe, Eraser isn't deleting your other "temporary files". It's just deleting the temporary files it creates to overwrite data.

A normal freespace wipe also shouldn't wipe the contents of the Recycle Bin.

Also I checked for problems with spybot but no problems were found i.e I wasn't given the option to delete usage tracks. Is there any way I can make spybot give me the option to delete usage tracks?

It's possible, though unlikely, that there really weren't any usage tracks to erase. To make sure Spybot is set to eliminate such tracks, when you run the program click on the "Search & Destroy" Icon in the upper left, then click on the "File Sets" pull-down menu to the right. You'll be able to select several things to search for, including "All Available Checks" and "Usage Tracks Check Only".

And finally, I go on one forum where you actually have to log in to view it, if I log out of the forum before logging off my PC, would that stop someone being able to view it through a temp files, cookie, history file, reg key etc.??

Thanks for your help, I really do appreciate it.

The answer to your last question is "most likely", since the act of logging out probably wiped a login cookie and the pages were probably not cached by default. But that's not always the case; it depends upon how the web site is designed.

 

[Techno phobia]

It's possible, though unlikely, that there really weren't any usage tracks to erase. To make sure Spybot is set to eliminate such tracks, when you run the program click on the "Search & Destroy" Icon in the upper left, then click on the "File Sets" pull-down menu to the right. You'll be able to select several things to search for, including "All Available Checks" and "Usage Tracks Check Only".



I don't seem to be able find this, the only options are tools in there, there is secure shredder etc. Maybe I'm just being stupid.

About the recycle bin, I thought you said erasing unused disc space got rid of deleted recycle bin data, but in your last post you said it doesn't! :?

Thanks for the info on clusters, if I go into safemode and run unused will it then erase the files instead of failing to?

Also is there anything more I can do to get rid of the temps, they still won't delete. If I click on them they appear to be locked. If I use a program to unlock them then will they delete?? If so can anyone tell me of such a program??

Another question- Does prefetch contain personal data??

I know I've asked this before but I just wanted to re-confirm. The original plan was I was going to sell my PC, however we've now decided it's too old to sell, instead a member of my family is taking it down to their work place. People that work there are very good with computers, so I just wanted to see if people thought the following is enough to stop a PC wizard who works there from finding data.

Run unused disc space (7 passes)
Erase all index.dat files (7 passes)
Erase swap file
Erase temp files
Run spybot s&s (usage tracks)
Use a registry cleaner/eraser
Delete/erase log files

And finally I have aol spyware protection and norton anti-virus- I'm aware that these leave logs.Where are the logs most likely to be so I can delete them?? Will CC be able to do this?

Thanks

 

[Glenn]

Personally, if I was disposing of a computer, I'd use DBAN.

 

[nodrick]

I agree! So why not give them a machine with a totally sanitized HD,and let them install whatever OS and applications they want? You`ll be reassured,and they can tailor the operation of the machine to their own requirements.

 

[Robbie]

Yeah, I agree too. If you're gonna give away the computer, use DBAN. It will save you worrying about useage tracks and just about everything else!

 

[Kythe]

It's possible, though unlikely, that there really weren't any usage tracks to erase. To make sure Spybot is set to eliminate such tracks, when you run the program click on the "Search & Destroy" Icon in the upper left, then click on the "File Sets" pull-down menu to the right. You'll be able to select several things to search for, including "All Available Checks" and "Usage Tracks Check Only".

I don't seem to be able find this, the only options are tools in there, there is secure shredder etc. Maybe I'm just being stupid.

That's fine. It sounds like you're running Spybot in "advanced mode" and have the "Tools" submenu open on the left hand side.

In the upper left hand corner of the window, you should have buttons that say "Spybot S&D" and "Settings". Click on the "Spybot S&D" button, and once you do, the icon I mentioned before should be available to you.

About the recycle bin, I thought you said erasing unused disc space got rid of deleted recycle bin data, but in your last post you said it doesn't! :?

I apologize for the confusion. When a file is deleted in Windows XP, one of two things happens to it: it's either moved to the Recycle Bin, or it's deleted outright. If it's deleted outright, a freespace wipe will get rid of the remains. If it's moved to the recycle bin, a freespace wipe won't get it. You'll have to empty the recycle bin first.

Once the recycle bin has been emptied, unused space wiping will get rid of the files that were in the recycle bin.

Thanks for the info on clusters, if I go into safemode and run unused will it then erase the files instead of failing to?

That will probably help, since safe mode tends to load fewer drivers on startup. Still, the system will probably lock certain files, like the registry.

In general, it can be very difficult to fully wipe all file cluster tips without booting from a boot CDROM or some similar means. But again, I wouldn't worry about that too much -- since the system has the files in question locked, chances are no sensitive information could have been written to the ends of the clusters they occupy, too.

If you do an occasional defragment on your drive, you'll move even many of the locked files around, and subsequent freespace wipes will get what might have been missed before.

Also is there anything more I can do to get rid of the temps, they still won't delete. If I click on them they appear to be locked. If I use a program to unlock them then will they delete?? If so can anyone tell me of such a program??

Remind me again -- which temp files are you referring to? Some of the temp files in your "temp" directory may very well be in use when you try to delete them (e.g. if you are running a Microsoft Office program), in which case the system won't let you delete them.

Another question- Does prefetch contain personal data??

To the best of my knowledge, prefetch simply contains some information about which programs have been run on your system. It can therefore be used to determine which programs you've run, but I don't believe it normally contains personal data beyond that.

I know I've asked this before but I just wanted to re-confirm. The original plan was I was going to sell my PC, however we've now decided it's too old to sell, instead a member of my family is taking it down to their work place. People that work there are very good with computers, so I just wanted to see if people thought the following is enough to stop a PC wizard who works there from finding data.

I completely agree with the prior posters: if you're not going to use the computer any more, do a DBAN wipe, rather than concern yourself with freespace wiping and Spybot useage tracks clearing. DBAN will overwrite everything on the drive, leaving it blank. You'll need to re-install Windows after that (and anything else you want on there). Of course, if you just want to hand over a blank computer, that's fine too -- they can then install Windows or whatever they want.

It's always a smart idea to overwrite old computer hard drives before selling them, by the way.

DBAN can be found here:

http://dban.sourceforge.net/

Here's the instructions for how to use it:

http://dban.sourceforge.net/faq/index.html

You'll need either a floppy disk or a CDRom with a CDRom burner, and you'll need to set your target computer to boot from either floppy or CDRom (whichever option you choose).

Be absolutely sure you've gotten everything off the drive you want. Once you run DBAN, there's no going back

 

[Techno phobia]

That's the thing though, I was initally planning on selling it. But have decided not to, it's so slow now, it just wouldn't be fair to sell it to someone.

As I said before a member of family (my brother actually) is planning on taking the PC down to his work place. So all I need to be sure of is that no-one down there will be able to find the data or use recovery software (they are good with PC's).

And somthing else I want to know is, I have norton antivirus, plus aol antispyware. I'm aware these leave logs, where are the logs most likely to be, will s&s be able to get them??

Just editing to say, I've managed to get it to erase usage tracks now, thank for your help. It found a few things such as cache, common dialogues etc. But it didn't erase my history- not sure whether that's normal or not. I have history set to 1 day anyway, so even if I don't erase/delete them will it be cleared after the 1 day anyway?? And be unrecoverable?

About the temps... I don't really no to be honest. I clicked properties and some said Internet Explorer, I'm not sure whether that could mean they have internet content or not. One which is very stubborn is a temp file in the directory ZC.tmp.dir.

 

[funplace]

I feel after reading all this my brain has been erased

thank you for your consideration in this matter

:shock:

 

[Techno phobia]

I feel after reading all this my brain has been erased

thank you for your consideration in this matter

:shock:

:shock:

Sorry, it was me who started the thread! :wink: I'm just not very good with computers so I wanted to be sure. If anyone can answer my final question I'll leave you all alone I promise!!

By the way thank you to everyone that's contributed to this thread, it really has helped a lot. I know I may still seem quite anxious about it but I feel much better now I know what I need to do!!

Thanks again.

 

[funplace]

Techno phobia

no actually I found the thread very helpful but overwhelming as I would be asking the same questions you have been.

and I thank you for all the things that have been said here.

I just did not realize though that it was this involved to erase what is on your hard drive.

:shock: