windowsfilentfsrecoveryfile-recovery

Make deleted files unrecoverable


I'm cleaning a machine with Windows 7 that I use that will be reassigned to another co-worker, and I would like to clear all the deleted files so they can be unrecoverable.

I tried using cipher w:f:\, then I installed Recuva and I still can see a lot of files that can be recovered.

Then I created a little program that creates a file with 0's that has the size of the free space on disk (after creating the file, I can see on Windows Explorer that the disk has like 100kb of free space only).

Then I delete the file and I run Recuva, and again I can see all those files as recoverable.

I'm just curious about what's happening under the hood. If I leave like 100Kb of free space in the disk, then why are there more than 100k of recoverable files still?


Solution

  • To make files unrecoverable, you need to use a "digital file shredder" application. This will write a series of zeroes and ones to the file to be shredded, multiple times. While 3 passes seems sufficient for many users, the US government has set a standard of 7 passes to meet most of its security needs.

    There are several free file shredder applications, and even more commercial file shredder tools. Some security suite software (such as Antivirus with personal security protection tools) may also provide a file shredder.

    For recommendations on digital file shredder applications, please ask for Windows digital file shredder recommendations at https://softwarerecs.stackexchange.com/

    As for why "deleted" files are still listed by recovery tools as "recoverable", when a file is deleted, all that normally happens is a flag is set in the master file index maintained by the file system. The raw data of the file is left on the hard disk as "noise/garbage". If no other files are written into the area occupied by the deleted file, then it is trivial to recover the data. If other data has been overwritten on it, it becomes a non-trivial, but still possible, exercise to recover the data as it was before it was overwritten. Large scale recovery vendors are capable of recovering a file even if it has been overwritten a few tiles. This is why the "security" standards of the US government call for the file area to be overwritten 7 times, as only the most serious (and expensive) recovery operation can recover that data.

    To make a file "disappear", the master file index also needs to have the information "erased" and overwritten ("shredding" the file's meta-data to be hidden and very hard to recover).

    If you are interested in the details and how to more permanently hide or delete a file, you might want to consider asking at https://security.stackexchange.com/ about how the windows 7 file system works, and what it takes to truly delete or make a file sufficiently overridden to make it impractical to recover.