Undelete-secure AES software and software for carrying out "full undeletion" free-partition-space zeroing/reformatting on Windows?

Question

It is fairly well known that on Windows, when you delete a file (or folder which may contain any number of files and subfolders possibly containing other files and subfolders and so on), Windows just deletes the filesystem pointer to the node corresponding to the file or folder in the corresponding filesystem tree structure.

So, I would like to know, if someone uses 256-bit AES as available as part of the implementation 7-zip, TrueCrypt, or BitLocker, or any other conforming software, and uses, say, a 20-character passord which uses uppercase, lowercase, as well as numeric digits, then the encrypted folder should would be encrypted with enough strenght that nobody could open it unless they had the password.

But my concern is that in creating the encrypted folder, the old data would remain unencrypted on disk, and could therefore be recovered with a program used to undelete files (and I'm sure there are several of these). So, which of the encrypting solutions I've mentioned actually zeroes-out the old data?

Even if so, I don't even know if this is a real solution. If the user has only moved the file across the same hard-drive throug cut-and-paste operations, then theoretically Windows would not have copied the information contained in the folder, just updated the pointer to it. But if the user has copied the information from one drive/partition to another, than the information contained in the folder would also end up being copied, and the information could still be recovered via a Windows undelete program.

Furthermore, I don't know whether there are any circumstances where the user doesn't do anything but Windows copies the data associated with the folder, leaving an old copy of the data behind (perhaps defrag, I don't know of any other situations).

So, my question is, how secure are 7-Zip, TrueCrypt, BitLocker, or any other preferable viable alternative, in fully deleting the original folder after it has been encrypted. If none do, then are there any programs available which will zero-out any unused portions of a drive/partition without reformatting it?

Thanks.

Answer 1

The solution to the problem could be downloading and installing the latest version of Piriform CCleaner. Once an AES-encrypted version of the folder to be encrypted is created with something such as 7-Zip, the following points must be taken into consideration:

1. Any program which may have been used to open the file could have created on-disk cache files containing pieces of information from the folder that was encrypted prior to its encryption, including transformed data obtained from such a file, and any of these files may also have been deleted by such programs, and, since such deletions would have been regular filesystem deletions and not full filesystem deletions, pieces of data from the original folder could be still lying hidden somewhere on the hard drive.

2. For each such program that was used to open data from the folder from which the encrypted folder was created, if CCleaner displays knowledge of such app in Cleaner -> Applications, then check such application to delete its cache files (be sure to leave checked defaults checked in Ccleaner -> Windows -> System). Also check Options -> Settings -> Secure Deletion to make sure such files are fully deleted. Also, if some program used to open the folder's contents is not listed, and you know where its cache files are kept, you can delete those as well by adding the folder that contains them with Options -> Include -> Add.

3. If some program not listed in CCleaner was used to open a file, and you cannot find where it keeps its cache files, just uninstall it, reinstall it, and then wipe your drive's free space (slow), which will also wipe any partially deleted cache files from the uninstall.

4. With the Settings -> Secure Deletion option enabled, delete the unencrypted version of the encrypted folder, so as to completely get rid of it, but...

5. In any case, since, as pointed out, you never know what a program used to open the contents of a folder deletes and what it doesn't delete, including its own cache files, so deleted bits of information may still remain on disk. Also, as pointed out in my original question, if a file is moved from one partition to another, the information it contains will be copied, and the information could be recovered from the other partition if not securely deleted. The same can happen on the same partition under some cirumstances (e.g. programs such as defrag may copy bits of files around unsecurely, leaving partially or fully recoverable traces of files elsewhere). So, the only way to be sure everything is really gone, thus making the information in the encrypted folder truly hacker-proof (unless, of course, you happen to give away your secure password), is to run Cleaner -> Windows -> Options -> Wipe Free Space. That should do it.

Hopefully whenever you open the encrypted file you will have to make sure its contents are stored in memory, where they will be completely gone once the computer is turned off, and not on disk, (and also make sure that the computer is not attached to a network for extra security, and hope that no keyloggers have been installed on your computer to sniff your password as you type it), or you may have to rerun this process all over again.

NOTE: I am not an expert on the subject, so please let me know if I have left something out.