Hot answers tagged

242

Because of the following reasons: Performance - it takes up resources destroying files. Imagine an application that uses hundreds or thousands of files. It would be a huge operation to securely delete each one. Extra wear and tear on the drives. Sometimes the ability to retrieve a file is a feature of the OS (e.g. Trash, Recycle Bin, Volume Shadow Copy). ...


97

It doesn't have to be corrected because it's not a fault. The pointers to the file are deleted, and the area the file occupied is marked as free space. The drive then overwrites this area in its own time. It's purely there to save wear and tear on the drive. After all, hard drives (especially SSDs) have a limited number to times they can write before they ...


97

Instead of another "You are wrong because" answer I'd like to take a slightly different approach: Early computer OS's were written by programmers for programmers. Any one who programs and knows what pointers are understands that "deleting" a pointer doesn't delete the thing its pointing at: they are separate. That doesn't mean that delete doesn't actually ...


73

You seems to have a wording problem with the delete term and a wrong expectation about what the functionality should do. You can check the simple definition on the Merriam-Webster website: delete: to remove (something, such as words, pictures, or computer files) from a document, recording, computer, etc. The goal of the delete feature is to remove the ...


65

Best stop doing that. Never overwrite an SSD/flash storage device completely in order to erase it, except as a last resort. NVRAM has a limited amount of write cycles available. At some point, after enough writes to an NVRAM cell, it will completely stop working. For modern versions, we're in the ballpark of an estimated lifespan of 3,000 write cycles. ...


63

Summary: it was marginally better on older drives, but doesn't matter now. Multiple passes erase a tree with overkill but miss the rest of the forest. Use encryption. The origin lies in work by Peter Gutmann, who showed that there is some memory in a disk bit: a zero that's been overwritten with a zero can be distinguished from a one that's been overwritten ...


45

Yes. If you do a normal format, the old data can be recovered. A normal format only deletes/overwrites a tiny bit of filesystem metadata, but does not overwrite all of the data itself. The data is still there. This is especially true on SSDs, due to wear levelling and other features of SSDs. The following research paper studies erasure of data on SSDs: ...


31

The only NIST approved method to securely erase a hard drive is by utilizing the secure erase internal command - documented at the Center for Magnetic Recording Research (CMRR) - and that is what everyone should be doing. It is an ATA command, and covers (S)ATA interfaces. After that, you can optionally degauss the drive to erase the firmware itself. Lots ...


27

I would still recommend using secure delete in your scenario. Should your machine be compromised when you are logged in (malware etc), full disk encryption will not protect you from a undelete operation via C&C malware for example. SSDs have problems erasing files but a number of manufacturers provide utilities for their drives to securely erase a file ...


20

The proper answer for this question is very situational, and dependent upon the policies and procedures in place at your company. Many companies have in place methods of backing up portions of the drive meant for user data, or even the entire drive, across the corporate network. If they've performed such backups on your system, there's nothing you can do ...


20

First of all (just to be on the safe side) verify the file isn't in the Recycle Bin. If it is, choose Restore and of course shred the recovered file (or maybe you can shred it while inside the Recycle Bin). If the file has been "truly deleted", recover it using an undelete tool such as Piriform's Recuva, then shred it for good. Note (suggested by Chris H): ...


19

The reason you write '0' instead of '1' has to do with the way magnetic storage encodes the 0 and the 1. a long explanation of it can be found on Wikipedia under Run-length_limited. In short RLL is the methodology used to store the '1' and '0' and it is more complex than just to store the bit values themselves. On a side note to make the drive more like it ...


18

From a theoretical standpoint the idea of total drive destruction may be the only way of destroying data on a hard drive fully. From a practical standpoint, I've not seen any evidence that it's possible to recover meaningful data from a standard hard drive (ie, not taking SSDs or other devices that use wear levelling or similar technologies) after a once ...


18

Overwriting the data is either insufficient or useless, depending on how things are done internally by the device itself. Flash memory has a limited life, expressed in terms of read/write cycles. To sum it up, you can have one block of data full of zeros; bits can be changed from zero to one individually, but the reset to zero can be done only for a complete ...


12

As storage technologies change over time, using different encodings and remappings to deal with sector errors, the best way to permanently erase data changes also. Very smart people have expended enormous amounts of time and effort arguing over this problem. Most of them end up at the same bottom line, which is: the only method you can truly trust is ...


12

The problem with deleting files is that the file data is just one small part of what really gets saved onto your disk. On a modern filesystem there will be lots of metadata and other artefacts scattered around the disk: Journal entries on journalling filesystems, e.g. NTFS, ext3, ext4. Search index entries. Prefetch / superfetch cache entries. Shadow ...


12

The 7 and 35 passes very probably come from the paper "Secure Deletion of Data from Magnetic and Solid-State Memory" by Peter Gutmann. There, he described various overwrite patterns targeted at specific hard drive write encodings. However, the paper, and the 35 passes, are now obsolete, as they were for old hard drive technology, as even the author readily ...


12

A paper from 2011 by four people from the University of California, San Diego writes in section "3.2.1 Built-in sanitize commands": Of the 12 drives we tested, [...] Eight of the drives reported that they supported the ATA SECURITY feature set. One of these encrypts data, so we could not verify if the sanitization was successful. Of the remaining ...


12

For performance reasons. Deleting the file from the index, and declaring that the zone where the file was is now free and can be re-used is far more efficient that erasing all data over that zone.


11

There is a well-known reference article by Peter Gutmann on the subject. However, that article is a bit old (15 years) and newer harddisks might not operate as is described. Some data may fail to be totally obliterated by a single write due to two phenomena: We want to write a bit (0 or 1) but the physical signal is analog. Data is stored by manipulating ...


11

You are seeing a consequence of the ongoing war between binary and decimal systems. Namely, 210 = 1024, which is close to 1000. Hence a widespread habit of saying "kilobyte" (as in "1000 byte") for a quantity of 1024 bytes. When we go to megabytes and gigabytes, the deviation increases: 220 = 1048576, and 230 = 1073741824. Therefore, if tool A displays a ...


10

Do you need to erase the data, or do you need to persuade other people that the data has been erased? (I will only talk about 'entire disk' wiping on conventional drives; I'm not talking about wiping single files or slack space or SSDs.) As far as I am aware there is no software package that claims to be able to recover data that has had a single ...


10

You've described the principles behind a live CD boot. This can be most strongly ensured by having no permanent media within the machine. I'm going to gear my answer towards Linux as that's what I'm most familiar with in this context. Having a hard drive with all disk partitions mounted as read-only and all read-write partitions mounted in memory would also ...


10

It can be. Generally speaking, programs while running don't tend to wipe out their data (they do, after all, tend to need it), and any process with the ability to access other programs' allocated RAM can, in fact, read it. This is how, for example, the recent spate of big box store hacks were able to leak so much credit card data -- the attacks were carried ...


10

NTFS sort of does if you include The Encrypting File System as part of it. The Encrypting File System (EFS) on Microsoft Windows is a feature introduced in version 3.0 of NTFS Secure deletion is supported by cipher.exe: You can use the Windows Cipher utility (with the /W option) to wipe free space including that which still contains deleted ...


9

I'll put my proper IT hat on - still just about fits - and suggest you could try asking your IT team what their process is - the answer might reassure you. Typically, IT are going to make a "just-in-case" backup of your drive and put it on a shelf ("just-in-case" management realises a year after you've gone that you had a file on your drive that is ...


9

Logically deleting is very common in many application that handle huge amounts of data for performance reasons. This includes other email programs for example Microsoft Outlook and even database servers for example MySQL. Even files, that you delete from your hard disk, are not actually destroyed. The space is just flagged as empty and may be override in ...


9

You are correct, in order for a file to be deleted the actual disk blocks it previously inhabited must be overwritten. This is generally done with random data; for example, the Windows tool 'cipher' overwrites unused (e.g., formerly used) disk space with 0s, then 1s, and then random data. If a forensic investigator were to look at your computer's disk, and ...


9

As quoted from this page: Secure erase overwrites all user data areas with binary zeroes. Enhanced secure erase writes predetermined data patterns (set by the manufacturer) to all user data areas, including sectors that are no longer in use due to reallocation. This sentence makes sense only for spinning disks, and without encryption. On such a disk, ...


9

Not everybody agrees with your definition of what "delete" should mean. For 99.9% of users, they're not worried about someone sniffing around getting data. They want space to store more torrented Telitubbies episodes. For most people, simply no longer having reserved the space for the file is sufficient. Then there's the group of individuals you are a ...



Only top voted, non community-wiki answers of a minimum length are eligible