Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Wipe free space or take image and wipe entire disk?


  • Please log in to reply
9 replies to this topic

#1 exus69

exus69

  • Members
  • 21 posts
  • OFFLINE
  •  
  • Local time:06:41 AM

Posted 21 April 2014 - 12:11 AM

Hello,

 

Read some of the stuff regarding wiping disks and securely deleting files. From what I've understood, after deleting (not securely) files they become part of the unallocated(free) space of the HDD. So if I want to securely delete the deleted files should I wipe the free space only or by keeping this link in mind https://security.stackexchange.com/questions/31390/whats-a-good-secure-file-deleter?rq=1

take image of the C drive and then wipe the entire drive and finally restore the image??

 

Disk: 500GB magnetic platter drive.

OS: Windows XP

Filesystem: NTFS

 

Please help

 

P.S. : I am doing normal backup(only used space) using Acronis True Image and not sector-by-sector backup(used + unallocated space). Can I still go ahead with the backup image, full disk wipe, restore image route??


Edited by exus69, 21 April 2014 - 12:15 AM.


BC AdBot (Login to Remove)

 


m

#2 JohnC_21

JohnC_21

  • Members
  • 21,682 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:11 PM

Posted 21 April 2014 - 07:34 AM

If I understand correctly, you deleted a file normally but are now worried it can be recovered so you want to wipe the drive and then put an image back on the drive, correct? I think your best option would be to wipe the free space leaving your data intact but preventing the deleted file from being recovered. You can do it with CCleaner. Use a three pass overwrite. It will probably take overnight to do the job. It would't be a bad idea to create a system image just in case something does go wrong. But do not backup sector by sector. If everything goes okay you can use CCleaner to securely delete the image file.

 

http://www.piriform.com/docs/ccleaner/using-ccleaner/wiping-free-disk-space

 

Note: Wiping free space can take a substantial amount of time.

 

 

Make sure in the Setting Menus you also check Wipe Alternate Data Streams,Cluster tips, and the MFT free space. If you do not data can still be recovered

 

ccleaner-cluster-tips.jpg



#3 exus69

exus69
  • Topic Starter

  • Members
  • 21 posts
  • OFFLINE
  •  
  • Local time:06:41 AM

Posted 21 April 2014 - 07:59 AM


 

Sorry for the mistake I couldn't quote him properly. Please read the below post.


Edited by exus69, 21 April 2014 - 08:07 AM.


#4 exus69

exus69
  • Topic Starter

  • Members
  • 21 posts
  • OFFLINE
  •  
  • Local time:06:41 AM

Posted 21 April 2014 - 08:06 AM


Make sure in the Setting Menus you also check Wipe Alternate Data Streams,Cluster tips, and the MFT free space. If you do not data can still be recovered


Does this also take care of the places mentioned in that link in my first post ??

 

Yes I want to securely delete some normally deleted files.

 

 

 

 



#5 JohnC_21

JohnC_21

  • Members
  • 21,682 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:11 PM

Posted 21 April 2014 - 08:20 AM

I can't tell you if that would take care of everything in that link. But the problem is when you create the image, you are actually saving those artifacts also. So, you could wipe the disk but it would not do any good because the image would still have the alternate data streams and cluster tips included. What you would not want to do is image the disk sector by sector. That would be worse as you would be putting back everything exactly as it was. In order to do what you want, you would have to do a disk wipe and then do a clean install.



#6 exus69

exus69
  • Topic Starter

  • Members
  • 21 posts
  • OFFLINE
  •  
  • Local time:06:41 AM

Posted 24 April 2014 - 06:16 AM

Ok lets assume a scenario. Suppose I normally delete some important files on 20th March 2014. Today I realise that some remnants of those files might be anywhere on the disk. So I set cCleaner to Advanced Overwrite with Wipe ADS, cluster tips and MFT free space on all partitions. Once that is done I take image of C drive using Acronis and manually(copy paste) take backup of D drive to my external drive. Then wipe the entire drive with DBAN and finally restore the image to C drive.

 

Will this work ?



#7 JohnC_21

JohnC_21

  • Members
  • 21,682 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:11 PM

Posted 24 April 2014 - 09:41 AM

It seems to me that if you wipe the free space, MFT, and alternate data streams, you would not need to do a DBAN on the hard drive as the info you are worried about is already gone. Using DBAN would be redundant because if CCleaner did not remover every little bit of data, it would still be on the image you create with Acronis and would be put back on the drive. It's possible that when Acronis does the image, it will not pick up the free space so when you restore the image, the free space would be zeroed out but that has already been done with CCleaner to begin with. As I said, the only true way to know for sure is to wipe the drive and then do a fresh install of the OS. From then on you could use the CCleaner and set the options to securely delete. Eraser is another utility that has a context menu to securely delete files. Right Click, select Erase instead of delete.



#8 housefinds

housefinds

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:09:11 PM

Posted 25 April 2014 - 08:15 AM

I like using File Shredder. It has different levels you can chose for secure file deletion of free space.



#9 exus69

exus69
  • Topic Starter

  • Members
  • 21 posts
  • OFFLINE
  •  
  • Local time:06:41 AM

Posted 25 April 2014 - 08:19 AM

@John Ok I will normally delete some files then use all those advanced cCleaner options and then try to recover them. Will keep you posted.

 

@housefinder I prefer to use one tool that does the job. File Shredder might be good but right now cCleaner seems ok :)


Edited by exus69, 25 April 2014 - 08:47 AM.


#10 exus69

exus69
  • Topic Starter

  • Members
  • 21 posts
  • OFFLINE
  •  
  • Local time:06:41 AM

Posted 28 April 2014 - 10:59 PM

While I've started with the wipe free space process with 3 overwrites, I've a question. Suppose if I normally delete an important file

from C drive later I realise that I need to securely delete it. Should I wipe only the free space of C drive or D and E drives as well??






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users