Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

How can you remove file names of 'shredded' files/folders ?


  • Please log in to reply
3 replies to this topic

#1 Saska01

Saska01

  • Members
  • 91 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Manchester UK
  • Local time:07:52 PM

Posted 26 April 2012 - 06:05 AM

I suppose that broadly speaking my question does come under 'security'. I use on-line banking & on-line billing & had a number of Excel docs. on my PC.that stored info.relating to these on-line functions. I recently re-hashed all these docs.,but copied much of the info.over to the new docs.I then shredded the old docs.using
'File Shredder'. I then ran 'Recuva' in order to see if they'd been erased,the docs.had,but the file names were still shown with the names that i'd given them.Now there's no info.that could be used directly by anyone ie.account nos.etc.,but the fact that the doc.names are given shows info.about my banking & billing.
I contacted 'Piriform' regarding this & they told me to run the 'wipe free space' function in the Gutman mode,as the info.is stored (apparently) within my PC's MFT
(Master File Table).Can the MFT be erased in that way,or am i simply going to spend 8 hours on a useless 'driver wipe' ?.Any info.(f a non-tech. nature)would be deeply appreciated,

BC AdBot (Login to Remove)

 


#2 Didier Stevens

Didier Stevens

  • BC Advisor
  • 2,720 posts
  • ONLINE
  •  
  • Gender:Male
  • Local time:08:52 PM

Posted 26 April 2012 - 03:30 PM

I think you're best to wipe your free disk space for another reason: when Excel saves a file, it does not overwritte the existing file, but it creates a new file with a random file name. Then it deletes the existing file, and renames the new file to the name of the existing file it deleted.

So this means that there are many deleted (thus "unshredded") copies of your Excel spreadsheets on your disk.

All MS Office applications (Word, PowerPoint, ...) save files like this. I know Office 2003 and older behaves like this, not sure for newer versions.

Didier Stevens
http://blog.DidierStevens.com
http://DidierStevensLabs.com

SANS ISC Senior Handler
Microsoft MVP 2011-2016 Consumer Security, Windows Insider MVP 2016-2019
MVP_Horizontal_BlueOnly.png

 

If you send me messages, per Bleeping Computer's Forum policy, I will not engage in a conversation, but try to answer your question in the relevant forum post. If you don't want this, don't send me messages.

 

Stevens' law: "As an online security discussion grows longer, the probability of a reference to BadUSB approaches 1.0"


#3 Didier Stevens

Didier Stevens

  • BC Advisor
  • 2,720 posts
  • ONLINE
  •  
  • Gender:Male
  • Local time:08:52 PM

Posted 26 April 2012 - 04:03 PM

Update: I just tested with Excel 2010 on my Windows 7 test machine.

When I saved test.xls, the following happened:

1) file 845BF200 was created
2) file test.xls was renamed to 7126B6C5.tmp
3) file 845BF200 was renamed to test.xls
4) file 7126B6C5.tmp was deleted

Didier Stevens
http://blog.DidierStevens.com
http://DidierStevensLabs.com

SANS ISC Senior Handler
Microsoft MVP 2011-2016 Consumer Security, Windows Insider MVP 2016-2019
MVP_Horizontal_BlueOnly.png

 

If you send me messages, per Bleeping Computer's Forum policy, I will not engage in a conversation, but try to answer your question in the relevant forum post. If you don't want this, don't send me messages.

 

Stevens' law: "As an online security discussion grows longer, the probability of a reference to BadUSB approaches 1.0"


#4 Saska01

Saska01
  • Topic Starter

  • Members
  • 91 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Manchester UK
  • Local time:07:52 PM

Posted 27 April 2012 - 01:49 AM

Well,just as a matter of finding out 'IF',i did run the Piriform's CCleaner 'disc wiper' function on my 'H' drive,where my old (shredded)Excel spread sheets had been. It took close to 6 hours to complete a wipe of the MFT Free space.I then ran 'Recuva' again & it still showed 2 Excel file names.It had however,wiped 4 others.Now how on earth can it wipe 4 out of 6 & keep 2 ???.It would seem that maybe the 2 files have 'migrated' in spite of the fact that the 'path'is shown as H:\........... I suppose i could wipe the free space on my 'C' drive,but if my small(ish) 'H' drive took nearly 6 hours,then my 'C' drive which is very much larger would take a day at least.
It would seem that maybe Piriform's software could use a re-hash to allow users to manually delete or overwrite the file names.Maybe i'll contact Piriform once again now that i've done as they suggested,& see whatthey say.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users