Permanently erasing a file

Question

As far as I know, there is a table of files present in the hard drive that does not contain the data of each file but can point you to it.

When you delete a file, the record of it gets deleted from the file table, but the data remains on the computer.

So the question is: If you overwrite a file's data with, let's say, just using WriteFile Win API to overwrite all data with zeros, will that become unrecoverable?

Answer 1

Yes, most likely. However there can always be edge cases:

• SSDs are doing wear leveling etc., and will most probably not write your zeroes to the same cells your original data was written to. How the attacker will find and access that data is another matter altogether of course.
• On a traditional spinning HDD, the original data may exist on other sectors because the disk got defragmented. Or the OS may decide to relocate your file on write, to consolidate the file. At least OS/2 used to do that, I am not sure if current windows version still do that.
• NTFS stores small files directly in the directory structure btree, that may lead to your data getting copied around the disk.
• the OS may have created a system snapshot, etc.

Answer 2

So the question is: If you overwrite a file's data with, let's say, just using WriteFile Win API to overwrite all data with zeros, will that become unrecoverable?

Don't use the WIN API WriteFile to try and securely delete. Instead use a secure delete tool like SysInternals sdelete.

If you just use WriteFile the operating system/file system has the option of writing the new data (e.g., a bunch of null bytes or whatever) to a new block on the disk and then updating the master file table to point to the new block not the old block. You will not be assured that you have overwritten the original file data (unless you use WriteFile to, say, write a file as large as the entire disk).

Answer 3

One way to dispose of a file in a 100% reliable manner is to keep it on a separate HDD partition you can purge, or, better yet, on a separate medium you can afford to destroy.

If that's not practical, a good compromise is to make sure the file is only stored encrypted. When you need to "destroy" it, all you have to do is to forget the key. You don't have to care about edge cases leading to the file not being fully overwritten.

The next less secure alternative is to use a file shredder that you trust. If it's implemented correctly, it will track every sector on the disk associated with the file and overwrite it. Of course, it will not be able to destroy any copies of data that you, your OS, or your storage controller have made that it doesn't know about (think temporary files, swap, disk defragmentation, etc.). In general, it only makes sense to pay for a tool that was subject to a security audit.

Then comes your idea of simply overwriting the file. It's not 100% secure, but it will for sure make the data unrecoverable using off-the-shelf undelete tools. That's actually sufficient in many practical situations.

Answer 4

Effectively, yes, overwriting the blocks used by a file will make it unrecoverable.

This can be done using sdelete on Windows, or shred on Linux.

Answer 5

In order to do that securely you have to know what you are doing and the task can be quite hard depending on the OS, filesystem type, filesystem options (journaling, compression, self-defragmentation, redundancy, TRIM support), existence of automatic backup, the type of storage media (SSD, honest-to-god HDD, HDD w/ SMR), the need (or lack thereof) of plausible deniability...

and most importantly, the abilities and the motivation of the potential adverse actors.

See the links in the first comments.