6

I'm curious to know how to completely erase all possible traces of files in Windows 7.

For example, let's say I have a subfolder containing five different files at work deemed sensitive (A document, a video file, a RAR, an image, and text file).

What are the steps I have to take if I want to completely erase all traces of these files without reformatting or doing something similar?

I can think of only a few things:

  • Erase Temp files stored by WinRAR
  • Delete the thumbnail icon database stored in AppData (.DS file)
  • Disable Data storage by the Windows 'hibernate' feature
  • RAM

Am I correct in assuming that simply "shredding" a folder won't completely erase all traces of the files in said subfolder?

Is it safe to assume that using software such as CCleaner would sufficiently remove all traces of said subfolder (if using the 'secure delete' option)?

How can I reach a state of confidence where I can remove all traces of these files, and bring my work laptop home knowing that the files and all traces of those files are completely wiped out? (Or can I ever be completely confident?)

Improve this question
4
  • "completely confident" is a high hurdle. If your computer was connected to the net, then, IMO, you should never be completely confident. Commented Jan 8, 2016 at 19:53
  • What do you mean "shredding" that's different than what CCleaner does? Commented Jan 8, 2016 at 19:54
  • 1
    @Arlix Actually, burning a HDD would have little to no impact at all. HDD platters are fairly resistant to Termite. Zoz did a presentation at this past DEFCON where he used several different methods of attempting drive destruction, the VOD of the talk (with all the awesome destruction pr0n): youtube.com/watch?v=-bpX8YvNg6Y Amusingly enough, they found that using a nail gun on a spinning HDD was far more effective than even some explosives. Commented Jan 13, 2016 at 16:57
  • I'm super certain this belongs on security, but would be more at home on super user. There is however a security sub question about the "reach a state of confidence where I can bring my work laptop home." Sadly the answer to that is: You shouldn't. There's other information on your work laptop you don't people getting access to, so if you do you need to keep it completely isolated. Commented Jan 13, 2016 at 19:59

7 Answers 7

Reset to default
3
+50

There are so many incorrect tinfoil hat solutions here. Allow me to present a correct tinfoil hat solution that fits into your "without formatting" requirements.

Even magnetic force microscopy isn't going to get the files back if they've been deleted properly. Burning the drive is an extreme tinfoil hat option that is completely unnecessary.

Taking Your Tinfoil Hattery to the Next Level

What are the steps I have to take if I want to completely erase all traces of these files without reformatting or doing something similar?

  1. Disable Windows Hibernate, Pagefile, and System Restore.
  2. Disable Shadow Copies
  3. Delete the information in the AppData icon db
  4. Move the temporary files to another folder, FolderA, along with recent items and shortcuts.
  5. Move the files in question to FolderA.
  6. Rename all the files in question to something random. Private Health Information.csv? Secret Chinese Dissident List.pdf? You shredded them, right? Yeah, the file names are still searchable, even if nothing can be recovered, even after shredding them, in a large majority of cases. In many countries, the mere possession of banned materials will get you arrested and/or executed. Religious documents, anti-government propaganda, etc. Just finding a file name is all they need to compel you to donate your organs. Use a tool like Recuva to verify this. Even if it's securely deleted, having the file name listed would make people realize you've been in possession of those documents. Make it something like "derp.exe."
  7. Securely overwrite every single renamed file.
  8. Delete these securely overwritten files.
  9. Reboot in safe mode with a command prompt, or use a separate drive to boot off of. I recommend a separate drive.
  10. cipher /w:drive letter 2 times for good measure.
  11. Unplug the power for 20 minutes. Start the computer, and use normally.

Keep in mind that if your drive/files have already been copied by someone else before the deletion begins, you're boned (network transfer of hard drive data / physical copying) if they find your Chinese Dissident List.pdf. A simple diff of the contents of the drive will reveal it, and you'll end up generously donating organs to the local cadres.

Alternatives

Would your life be in danger because of this? Alternatively, encrypt the drives with a super-long password, then format, and dban boot and nuke, then reformat.

Otherwise, shred the drive.

Improve this answer
3
  • This was the kind of answer I was looking for! Thanks! May I ask what the purpose of #11 is? I'm guessing that has to do with cooling down the HDD after using the cipher utility? Commented Jan 13, 2016 at 20:08
  • 1
    No, so nothing is found in your RAM. It's usually gone after 10 minutes, if I recall correctly. I put 20 because my tinfoil hat senses were tingling. Commented Jan 13, 2016 at 20:12
  • Oops, I forgot the pagefile and system restore. Might want to take those off as well. Commented Jan 13, 2016 at 20:20
4

The Honest Truth Answer:

Unless you physically destroy the drive by putting it through a metal shredder, there is no way to completely prevent that information from having a chance to be recovered by a skillful individual. If government level actors factor into your threat model, then you need to physically destroy the drive.

The Good Enough Answer:

If the NSA, FBI, Chinese Intelligence, etc. do not factor into your threat model, then you can get by with applications such as CCleaner. For all but the most extremely sophisticated threat actors, a 25+ pass rewrite will suffice on a HDD.

SSD are a different matter all together due to wear leveling (as Rory already stated) and about 30%+ of the SSD industry are not following the established standard practice for how to handle rewriting those "Bad" memory blocks. Which brings me back to the honest truth answer, shred the drive.

Improve this answer
2
  • 2
    This is also incorrect. Shredding the drive is an incredibly naive and extreme option that is totally unnecessary, and the OP wants to remove the data without reformatting or anything like that. Finally, a 25+ pass rewrite isn't even needed. Not even magnetic-force microscopy can reliably pick up a 7-pass rewrite Commented Jan 13, 2016 at 19:29
  • 1
    Is it extreme, really? A couple hundred dollars for a control that stops state level actors sounds like a bargain to me! Commented Jan 14, 2016 at 12:05
1

For an HDD, Shred utilities will completely remove all traces of the file in that subfolder, yes.

You do not require multiple passes or "secure delete"

For an SSD this is not the case, due to the wear-levelling SSD's use.

You may well have traces of those files elsewhere though, such as swap space, hibernation file etc.

We have many questions on this already here, so have a good look round.

Improve this answer
1

I'm just spitting in the wind; but to be certain I would use two hard drives. First, run command prompt as administrator.

Then, type: cipher /w:drive letter and run. This will over write all free space on the drive, and all files marked for deletion. I believe it makes three passes.

Use a utility to clone the data over to another hard drive verbatim after deleting/overwriting the files in question (clonezilla, Acronis, etc.). Then clone the drive back over and drill/destroy the second hard drive.

There are also programs that delete entries from the Master File Table. This is just a database of locations for these files; but some files (.txt, etc.) are stored in the MFT directly. Undelete programs lookup entires on the master file table. I am sure this can be done recursively, and if so, use a program that will first overwrite the entry in the Master File Table. The Page file is a different beast; but in today's world, hard drives are rarely called upon for this. Delete the pagefile (pagefile.sys) before cloning the drive just to be safe.

Again, though, the only way to be sure is to destroy it. Most deleted files are recovered because they are simply marked for deletion rather than deleted, and even though they may be corrupted, a large part has not been overwritten though normal use, and the entry still remains in the MFT, making it easy pickings.

Just my $0.02.

Improve this answer
1
  • You are correct in what cipher /w:drive letter can do. And the suggestion to use two hard drives and boot one is also a good idea. However, destroying the drive isn't really necessary. Commented Jan 13, 2016 at 19:32
1

to add to the other answers, I also admit that the only true way of completely removing all treaces for even the most sphiscated attackers is to physcally burn/shred/etc. (destroy) the drive

many people also go around the "standard" file shredding, working with the MFT etc. but this doesnt remove all traces that this thing even existed.

  1. for starters, dont use an SSD for overly confidential stuff, hard to really remove because wear leveling.

  2. then I would shred the files by randomly overwriting it some times ("standard" shredding software)

  3. then remove pagefile, hibernation file etc from your drive using system settings

  4. then check the registry for the file paths, there can easily be MRUs (most recently used files) left by software.

    4.1. (optional because risky) remove the backup registry hives in c:\windows\system32\config This is REALLY risky, because the backup is used in case of problems and if you really want to delete them rename them first and reboot so your system runs and new backup files (with the clean registry) can be generated.

  5. check the config files of all software which was involved in the files, maybe those left stuff behind.

  6. delete (or wipe) all tempfiles

  7. wipe free space of drive (files that we edited like the registry files might be saved to a different location leaving the original behind)

  8. wipe ram using memory tester tools or other stuff that seriously works on your ram.

when you got back you can restore hibernation and page file but that should really erase most of the OS traces of a file.

Improve this answer
0

There are many methods and tools:

Low Level Formatting

Darik’s Boot And Nuke

CCleaner

SDelete

Eraser

Eraser is a freeware and open source security tool to completely remove data from your hard drive. It can overwrite data several times using randomized patterns of binary code. It essentially is a file shredder.

Eraser is more convenient than CCleaner’s Drive Wiper because it can delete and shred single files, rather than just wiping all free space on a drive, and it is integrated with Windows Explorer (right-click menu). Moreover, Eraser provides you with a host of advanced settings, for example different file and space erasure methods, the option to replace erased files with other files to allow plausible ‘deniability’, and schedule erasure of files, folders, recycle bin, or unused disk space.

Reference Excellent article

Improve this answer
0

How it works

NTFS, like other file system, goal is to maintain a logical map of file to the disk. The disk act as a large array. The file system allocate space using an efficient algorithm (Btree+ for NTFS).

The logical representation : [file1, empty, file2, empty, file3, file4,...]

actual disk : [file1, empty, file2, empty, file3, file4,...]

When you delete a file (using ccleaner or any) you only remove the reference of the logical reprensentation. So the file remains on the disk, but the file system does not keep a reference to it anymore. The file system can then reuse them. There is several software to recover deleted file. They actualy look for unmapped file on the disk.

The logical representation : [empty, empty, file2, empty, file3, empty,...]

actual disk : [file1, empty, file2, empty, file3, file4,...]

HowTo theoretically

To delete them completely without formating would be to rewrite several times (somes say 7, somes say 20..) the disk at those sector. I personnaly don't know any software that can do that. Maybe the Jesse Pardue's method work (using "cipher /w:drive letter" several times)

Improve this answer

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.