[mphenterprises]

Hi All. Okay, I had a very eventful evening last night. I found out some information that I wanted to share with all of you and get your opinions. First, a bit of lead-in information.

I normally do a system cleaning with CCleaner about every week or so. For those that do not use CCleaner, the application has an Secure File Deletion process called the Guttman Process to pass over a hard drive 35 times. The theory is that the more passes the application does, the cleaner the drive. Here is a snippet of that section:








The process normally takes about an hour and I usually recover anywhere from 3-5GBs of hard drive space. Last night, just before 24 started, I started the scan. Remember, this is 9pm EST. After 24 was done (very good episode by the way), I minimized the television application and checked the process and it was still emptying the Recycle Bin. Okay, no big deal. I will just watch a movie. So me and the misses watched Superbad (very good movie). When the movie was over, I checked the application again. Still emptying the Recycle Bin.

This is now over two and a half hours. Now I am getting a bit nervous. Okay, still no worries. I went downstairs and watched television for a few more hours. So, it's now 2:30 in the morning and I am about ready to go to bed. I checked the computer thinking there is no way this should still be going. Sure enough, when I went to the application, it's still running. Now, it is emptying the E: Drive's Recycle Bin. I have numerous partitions so the only thing I could think of was to let it continue working.

It's now 3:30AM EST and I am heading to bed. The misses is long asleep and I should be since I have not stayed up this late in a long time. I checked the application one final time, yup you guessed it...still running. This time, it's emptying the I: Drive's Recycle Bin. This cannot be normal. It never takes this long to run a scan no matter how much data there is.

I go to the Piriform's website and start looking around to see if there is anyone else with this same issue. I come across a thread that is very, interesting to say the least. The thread can be found here. Here is an excerpt from it:

"The myth that to delete data really securely from a hard disk you have to overwrite it many times, using different patterns, has persisted for decades, despite the fact that even firms specialising in data recovery, openly admit that if a hard disk is overwritten with zeros just once, all of its data is irretrievably lost. http://www.heise-online.co.uk/security/Sec...t--/news/112432"

Can Intelligence Agencies Read Overwritten Data?
http://www.nber.org/...ta-guttman.html

The Great Zero Challenge:
http://16systems.com/zero


I continue on and find a related thread and found this:

"Gutmann worked on Winchester disk technology from the early 1990's, and he had the grace to acknowledge in his 1996 paper that later disks, which everyone outside of a musuem is now using, use different coding techniques that make his overwriting patterns irrelevant. He said that 'A good scrubbing with random data will do about as well as can be expected.' But nobody reads that part of his paper. I doubt whether many people have read any part of his paper."




Now, my question to all of you is this, is this information that you would take to the bank? Is just deleting the file or scanning the hard drive just one time enough to securely remove data from a hard drive?



(Oh, and just to enlighten your curiosity, the scan took 8 and a half hours and I recovers over 20GBs of hard drive space.)

[lilxkid24]

I have not done the Guttman Process yet. I always run Normal deletion with simple overwrite and it only takes a couple seconds.

Edit: I just ran the guttman thing and it took a couple seconds as well o 0. Only about 160mb of stuff was deleted but it was quick

[piyushsingh]

so do you always run that 35 times ?

lets have a look at another example since i have never used Ccleaner.

mcafee has a shredder for files and disks - it offers 1 passes for quick 10 pass(longest) for comprehensive. They haven't disclosed the deletion algorithm used in their shredder but 10 is their maximum.

the text below is taken from one of the links provided by you.

Quote

They concluded that, after a single overwrite of the data on a drive, whether it be an old 1-gigabyte disk or a current model (at the time of the study), the likelihood of still being able to reconstruct anything is practically zero. Well, OK, not quite: a single bit whose precise location is known can in fact be correctly reconstructed with 56 per cent probability (in one of the quoted examples). To recover a byte, however, correct head positioning would have to be precisely repeated eight times, and the probability of that is only 0.97 per cent. Recovering anything beyond a single byte is even less likely.> Nevertheless, that doesn't stop the vendors of data-wiping programs offering software that overwrites data up to 35 times, based on decades-old security standards that were developed for diskettes. Although this may give a data wiper the psychological satisfaction of having done a thorough job, it's a pure waste of time.

next are taken from a wikipedia article - en.wikipedia.org/wiki/Data_remanence

Quote

As of Nov 2007, the United States Department of Defense considers overwriting acceptable for clearing magnetic media within the same security area/zone, but not as a sanitization method. Only degaussing or physical destruction is acceptable for the latter.[4]On the other hand, according to the 2006 NIST Special Publication 800-88 (p. 7): "Studies have shown that most of today's media can be effectively cleared by one overwrite" and "for ATA disk drives manufactured after 2001 (over 15 GB) the terms clearing and purging have converged.

one overwrite is fine and does the job according to most previous quoted lines, 35 gives a lot of satisfaction but it is a waste of time. Maybe 4-5 passes will give both.

The gutmann algo is of overwriting with zeroes. Other algos may be different - writing random data etc etc. When it comes to erasing an entire disk , it will be best to overwrite with zeroes n number of time till one is satisfied. Things are a bit different when you want to securely delete one file from your hard disk. A normal deletion just deletes pointers and data is still there. Here is some good info from - [http://en.gentoo-wiki.com/wiki/Secure_deletion]



>When a filesystem overwrites a file, basically the same thing happens. For the filesystem, overwriting a file basically means deleting and therefore forgetting the old file, and creating and therefore writing a new file with the same name. However, since a filesystem writes new files whereever there just happens to be free space, there is no guarantee that the new file will be written in the same place as the old file. Therefore it is possible that by overwriting a file in a filesystem, what physically happens on the disk is that the data of the old file remains untouched, and the data of the new file gets written in a new location. In other words, it's a copy.

Now the above lines may or may not be true. It depends upon how the particular file system works and how the software used for overwriting works.

Next the article states :

>Overwriting all sectors of a disk is the only way to make absolutely sure that there is no trace of old data left.

Now to delete a single file , you again have to overwrite entire disk or at least the free space on the disk. (mph - just check and tell me if Ccleaner does that also in its process i.e overwriting free space also rather than just files to be deleted).

In the end the article also states that there is a .95 probabiltiy for a random OS to access all its free space.


So imo -
Since everything is based on probability , anything is possible . Even after 35 passes your data may be recovered but with what probability ? That is important. Overwriting with zeroes is the best thing we can do at the software level. It seems good for entire hard disks. And good enough for single files if free disk space is also overwritten.

[Flashorn]

Hey MPH !



Interesting info. and sorta validates what I have thought all along about deleting or

more precisely retrieving deleted files. I guess if the files have not been overwritten

and you move quickly enough then, you might have a chance at retrieval.

I have been using Securely Delete from 2BrightSparks for a number of years.

It's freeware and seems to work very well. This is what they say about their utility :

When you delete a file
or folder using Windows, it is usual for
the file or folder to be moved to the Recycle
Bin (Trash). When the Recycle Bin is emptied,
the data you have deleted is not actually
removed from your computer. Instead, Windows
makes the space occupied by the file available
for writing. In other words, every file
you delete using Windows is potentially
recoverable in the short term. If you create
a new file after deleting using Windows,
or save a changed file, it may write over
the 'deleted' file's space, thus destroying
it permanently. Likewise, defragmenting
will possibly overwrite the deleted files.
Deleteonclick completely deletes files in one click rather than sending the file
to the recycle bin. The data becomes unrecoverable. For this reason you must *use
this program carefully*. Once a file is 'Securely Deleted' no
one can undelete it.



I haven't used CCleaner because I just don't trust what it cleans. I know allot of you like this free app. but, I cannot

recommend it unless you can safely say that you can recognize every file it will delete. As you mentioned , most of the

members coming here to ask for help are not able or could not differentiate one file from another. This is why I don't recommend

the Securely Delete application. If , by mistake , you should delete an important file then, your cooked. Interesting thread .

Just can't wait to see what others have to say about this subject.



FLASHORN. !http://forums.pcworld.com/legacyimages/
1!

[mphenterprises]

Hi LilxKid. Yeah, the time it takes and the amount of space it recovers differs from person to person. I have many files that I organize and discard on a regular basis so my results will differ from yours.

[mphenterprises]

piyushsingh said:

>

Quote

so do you always run that 35 times ?

Hi Piyush. Thanks for all the information. Yup, ever since I installed the application...many moons ago...I have used the Guttman security pass. At that time, and until a couple of days ago, I figured more is better. CCleaner also has DOD (3 pass) and a NSA (7 pass) options. I am going to start using those options from now on.

[mphenterprises]

Hi Flashorn. Always good to get your insight on things. Yeah, this is one of those areas that I would never have even thought about if it wasn't for the "hiccup" a couple of nights ago.

[number6]

Thanks for the good info, MPH. I still don't understand why you can't write zeros across the whole file and have assurance that it will be completely cleared.

Interesting thread. As you can tell from my signature, I use CCleaner. I usually use the simple erase, but occationally I've used Guttman. I think I'll be using the other methods now to save time.

[mphenterprises]

Hi Number. Yeah, I have not tried the lesser secure options but I will post back when I do. I do not think I will ever have another instance where I recover over 20GBs of hard drive space. :D

What all this tells me is that you really can learn something new everyday.

[techie4fun]

mphenterprises said:

Hi All. Okay, I had a very eventful evening last night. I found out some information that I wanted to share with all of you and get your opinions. First, a bit of lead-in information.


Now, my question to all of you is this, is this information that you would take to the bank? Is just deleting the file or scanning the hard drive just one time enough to securely remove data from a hard drive?




(Oh, and just to enlighten your curiosity, the scan took 8 and a half hours and I recovers over 20GBs of hard drive space.)

No, I would send my hard drive through a burning furnace to ensure that nothing survives ;)

[number6]

I had to delete 11GB of .au files the other day when I left Audacity running over night. The only reason it stopped at 11 GB is it ran out of space. Luckily the temp directory was on the D: drive. Try that and see how long it takes to run CCleaner. :D

[OlPhilosopher]

I've only used ACE Utilities for wiping my disk, and all it's ever recovered is the space on the hard drive taken up by previous version of Windows System Restore files.

My only comment about all this is that my experience with DOD standards from years ago was that they deemed it sufficient to "wipe" the highest classified information to the point even military techs couldn't recover it. I'd be confident that newer "DOD Standards" would be all a civilian user should ever need.

[mphenterprises]

Hi OlPhilosopher. Thanks for that information. I am going to try the DOD option shortly and report back how it went.

[Flashorn]

Hey MPH !



This is what Deleteonclick does. It uses DOD references to delete any files

by Right Clicking and choosing the option in the Context Menu. It will go

over one or many files three times with ones and zeros. This way you don't

have to wait or forget them. It's done right away as long as you don't regret

deleting that file . LOL !



FLASHORN. !http://forums.pcworld.com/legacyimages/
1!

[mphenterprises]

:D Hi Flashorn. I actually downloaded that app you recommended. I am waiting to do another mass cleaning so it may be a few days. I will definitely keep you informed.

[mphenterprises]

Hi All. Here's an update. Well, I ran CCleaner again but this time I used DOD (3 passes). Guess what, it seems to be worth it. I recovered 23GBs of hard drive space in just under an hour and a half.

I will try Deleteonclick the next time I need to do another scan.

[OlPhilosopher]

Interesting...for several reasons.
I installed CCleaner v2.16.830 today, and ran all the clean up routines accessible. It took me awhile to figure out the "secure file deletion".

I'm a real light weight when it comes to computer usage, I guess. MPH, you said you reclaimed 20+ Gb of space. Hahaha...that's almost the entire size of my drive! :0

The first time I ran CCleaner, I "cleaned" 500 Mb, this second time, using the "secure" option, I got another 21 Mb. I did notice that the "free space" on my drive didn't increase even 1/10th of a Gb. Hummmm.....

Anyway, this "secure file deletion" in CCleaner is not what I thought it was. When you opt to delete the unnecessary files CCleaner finds, yes it will apply the desired secure deletion method TO THOSE FILES ONLY.

I have been using ACE Utilities, because on that monthly house keeping day, ACE will completely wipe ALL the "free space" left behind after file deletions, and disk defrag. Every part of the drive not allocated by the NTFS gets over-written, not just files removed by ACE.

I hope I'm saying this clearly. CCleaner is NOT a disk wiper, it's a file destroyer.

[mphenterprises]

Hi OlPhilosopher. Nope, no problem. I have Version 2.15.815

- From the main window, click on Options and then click on Settings.

- Under the Setting section, you will see Secure Deletion.

- Select "Secure File Deletion (slower)" and the drop down option will appear. You will see four options:

# Simple Overwrite (1 pass)
# DOD 5.220.22-M (3 passes)
# NSA (7 passes)
# Guttman (35 passes)




Here is a snippet for you as well: (Click on the image to enlarge it.)

[OlPhilosopher]

Sorry...I was updating my previous post as you were replying. Hope you scroll up, as I added some observations.

[mphenterprises]

OlPhilosopher said:

>

Quote

MPH, you said you reclaimed 20+ Gb of space. Hahaha...that's almost the entire size of my drive! :0

:D Yeah, I figured that number may come as a major surprise to some knowing that I just gain 20GB from a previous scan not more than a few days ago, maybe even earlier than that. I have a grand total of 4TBs of hard drive space between various internal and external drives. If this year goes well for my wife and I, she may even let me upgrade my computer again. LOL My last major upgrade, the one referenced in my signature, was done before we got married. I am looking into SSD Hard Drives, increasing my DDR3 memory, getting one or two of those 2TB hard drives from Western Digital (when it comes out) as well as keeping my existing hard drives, and finding a motherboard utilizing USB 3.0 technology (again, when it comes out).

OlPhilosopher said:

>

Quote

I have been using ACE Utilities, because on that monthly house keeping day, ACE will completely wipe ALL the "free space" left behind after file deletions, and disk defrag. Every part of the drive not allocated by the NTFS gets over-written, not just files removed by ACE. I hope I'm saying this clearly. CCleaner is NOT a disk wiper, it's a file destroyer.

>
>




Well, I am glad that you are in this Discussion. To be honest, this is all new to me. I figured the way I was doing it was the right way to go. Learn something new everyday. Can you elaborate on the ACE utilities? Flashorn has given me a good recommendation which I will use the next go around. I would like to try ACE as well.