A lot of people have some files that they would rather not show to others - passwords, private files, classified documents from work, the list can be continued much longer. probably you have stored some of this information on your computer where it is conveniently at your reach, but when the time comes to remove the information from your hard driver, things get a little bit more difficult and maintaining your privacy is not as simple as it may have seemed at a first glance.



Standard file and folder removal is insecure

Your first thought may be that when you erase file or folder, the information is gone. But, when you delete a file, the Windows does not actually remove the files from the HDD; it only removes the record about the file from the file system table. The files remains on the hard driver as long as another file overwrites it, and even after that, it might be possible to recover files by exploring the magnetic fields on the disk platter surface. Before the file is overwritten, anyone can without difficulty view it with a disk maintenance or an undelete tool.

For instance, imagine that you have been surfing on the Internet from time to time and afterwards want to delete all traces revealing what sites you visited. You go to Internet Explorer settings and select to clear the cache and the history file, the information is now gone you think to yourself - well think again. The browser cache files can easily be restored with an undelete utility and your privacy is once again compromised.

To be sure that a file is gone, it must be appropriately overwritten before removing. As simple as it looks, there are several difficulties in secure information removal, mostly caused by the construction of a HDD and the use of data encoding. These troubles have been taken into consideration when special eraser utility is designed and because this special design you can safely and easily delete private information from the HDD.

You have likely already insecurely deleted large amount of files from the disk and every now and then programs create (and insecurely remove) temporary files on the hard disk containing some probably personal information that you would rather not show to anyone. This data remains on the hard disk until it gets overwritten and can be restored with simple HDD software.

This is where the erasing of unused HDD space comes in handy. The erasing of free disk space means that all space available on the HDD will be overwritten so that data earlier saved on it cannot be retrieved. Good eraser tool provides you a handy way to erase the free hard driver space regularly in order to delete the remains of temporary files and other private data you likely have had on your disk.

You must be wondering what exactly this software does to my system when erasing files. You have come to the right place, the actions gone through when erasing data are explained here.

After determining the file type (data compressed or encrypted at the file system level are supported on Windows NT and 2000, but Administrator privileges are required for low-level hard disk access), Eraser needs to calculate the file size. When determining the size, the cluster tip area is included so the data stored on it will be erased too.

Once the size is determined, the file will be overwritten with the special method (see full descriptions of the methods bellow). Eraser software takes care of flushing write buffers to make sure that the data really gets written to the hard disk and is not only saved in a buffer somewhere. If the overwriting was successful, the final step is to correctly remove the data.

Before deleting the reference of the data from the file system (normal remove), the file will be truncated to zero length to remove traces of the allocated clusters, the filename will be overwritten and then file dates (creation, access, modified) will be scrambled to complete the file removing.

Method of Gutmann

Based on Peter Gutmann's paper "Secure Deletion of Data from Magnetic and Solid-State Memory", the method provides the best security. Data will be overwritten 35 times with carefully chosen patterns, which makes it unrecoverable.

The method is used as the default for removing files, but has been proven to be very slow when erasing free space on a disk (could be several gigabytes).

A Faster Method - US DoD 5220-22.M

Two methods based on United States Department of Defense recommendation 5220-22.M from January 1995. The data will be written 7 times making this method much faster than the first one, but also less secure when it comes to hardware recovery.

Pseudorandom Data

All passes will be pseudorandom data, which is very incompressible. Therefore, this is the only method that should be used when overwriting unused space or files on a compressed drive. The number of passes is user selectable from 1 to 65535.

Being the fastest method, this one is used as recommended for overwriting unused hard driver space.