2

I was wondering how secure are the file shredding software and free space wipers?

Lets say we are using PC Windows, and software CCleaner (from piriform) or File Shredder (found here) to securely delete our files or wipe our free disk space. We assume that the software is downloaded from the developer's sites.

I know I might thinking too negatively, but while those software are securely deleting the files or wiping free disk space, is there any chance for those programs to collect information of the deleted files, for example by making small screenshots of our data or compressed copies of the txt files, documents, passwords, or jpg or videos files and transmit to an external IP through the internet?

Even though unplugging the ethernet internet cable or use the firewall to block those programs to send any data over internet while the deleting process happens, isn't there any possibility for the software to copy all our deleted files to another position of our hard disks, hidden from us, and transmit them slowly and at random times when the software traces that we are back online?

They know that we are using that kind of software for deleting confidential files, so they might be after our data. I am considering to wipe the free disk space of my hard disk drives, but I am really not sure if CCleaner or File Shredder are really 100% secure. CCleaner is closer to my selection, but for some reason it sees my external USB drives as SSD, and can perform only one pass of free space wipe. I am using the portable version of CCleaner.

File shredder is a bit more suspicious to me, since the developer company site doesn't have an email or the firm is not well known. But I might be wrong.

Also which free disk space wiper are you using and do you feel 100% secure and safe when wiping free space or shredding your files?

Improve this question
5
  • I did not see any network activity by them when I deleted files. But there are also other alternatives like Eraser. Do not forget to erase cluster this and entries in the MFT which you can do with Windows commandline tools. CCleaner deletes files but not the entries from the MFT so the filenames are still recoverable. You can see this with Recuva.
    – user6090
    Commented Jan 16, 2016 at 7:51
  • Thanks for your reply. So you recommend Eraser above all ? It has only 3.8 in the rating. of the sourceforge > sourceforge.net/projects/eraser
    – Vonzar
    Commented Jan 17, 2016 at 8:28
  • like @Geir wrote Eraser is opensource so you can inspect the sourcecode and build it yourself.
    – user6090
    Commented Jan 17, 2016 at 11:08
  • 2
    If you push your paranoia to the extreme, how do you know your operating system will actually do the erasing that the wiping software attempts? And since the NSA can actually replace the firmware in a harddrive remotely (if they infect your computer first), how do you know the disk itself will not just ignore attempts to wipe it? If you are truly paranoid, physically destroy the disk platters and microchips. I would recommend using the built-in-the-harddrive SATA Secure Erase commands as one step in erasing a disk. Then all you have to trust is the harddrive's firmware.
    – cybermike
    Commented Jan 17, 2016 at 20:16
  • 1
    I am just a beginner in coding, can't inspect the code of Eraser. However I believe it's a bit paranoid to think that negatively. I believe , so many people is using the file shredding software , none reported something like this, so all seems good so far. However I am going to do it the classic way. Write and overwrite the full data of the hard disk manually. Thank you all for sharing your opinion.
    – Vonzar
    Commented Jan 18, 2016 at 15:29

2 Answers 2

Reset to default
3

You can of course never be sure that there are no back doors in software you get from random places on the internet. So you have to a similar "due diligence" that is always warranted in security: to consider the value of what you are trying to shred up against how much you can trust the vendor.

So go with the high-reputation vendors or write your own software. For instance, with http://sourceforge.net/projects/eraser/ (not a recommandation, just an example) lets you verify the source code and build it your self.

An alternative (or complementary) is to encrypt the files in the first place, leaving no content to recover if someone seizes your disks.

Improve this answer
2

This was exactly my concern after I used Hardwipe to shred a drive. While Hardwipe seems to be a legitimate app, going forward what I will be doing is first formatting the drive using the OS, then running the hard drive shredding software.

Alternatively, what you can do is run shredding software off a USB stick or CD. This way, depending on your hardware setup, you can minimize what hard drives are running and essentially nix data being copied somewhere without your knowledge. At work I set up a dedicated shredding station that booted up using DBAN on CD. The only hard drives that were connected to the PC were the ones to be shredded - it didn't even have an OS drive since I was able to bypass it in the BIOS.

One other tip for wiping files and free space would be to first encrypt the files that you want to delete (using 7zip or AxCrypt for example), then wipe those files using shredding software. This at least gives you an added layer of security in that even if the files were somehow stolen by the shredding software, they would be virtually inaccessible because of encryption.

Currently I use a combination of PrivaZer and Eraser to shred files and delete free space on PCs, Hardwipe and DBAN to shred hard drives, and Shreddit on mobile.

At the end of the day, you just have to have trust otherwise paranoia will make you go crazy!

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .