[OT] Destroying files

[Thomas Wouters]

On Thu, Oct 28, 1999 at 05:37:34PM -0700, Jon Cosby wrote:

> Yes, I'm on Windows 95. No, deleting files does not remove them from your
> hard drive; They can be recovered by computer forensics experts or by nosey
> hacks. I'm putting my PC up for sale, and the thought is troubling.

Deleted files are really deleted, the _data_ that was in them is just not
erased. If I remember correctly from Way Back When(tm) I used to hack
around in DOS and other FAT-oriented OS's (Atari :) FAT16 (and probably the
newer FAT types) even keep most of the file information almost-at-hand,
everything but the first character of the filename. I may be mistaken,
though.

If you are really afraid of people reading your files, DO NOT DELETE THEM.
First, fill them with garbage, random data, by opening them and writing in
them ( -- no use removing the file and creating a new one, it wont use the
same disk-sectors) Then, dont just delete the files, just erase everything.
Format the disk, preferably by an entirely different type of computer, like
a Macintosh or a UNIX flavor with it's own ideas about disk partitioning and
the like. If you use DOS format, be sure to say 'no' to 'keep undo
information' -- you never know what the bastards can find from that. Then,
after the disk is reformated, fill it with harmless data.

This might still not be enough, however.... 'They' can currently recover
deleted AND overwritten information if they know where to look, by looking
for magnetic residue of the old pattern in the magnetic particles of the
harddrive. Not very likely, and _very_ expensive even in the best case, but
none the less... If you want to be really sure, destroy the harddrive. Wreck
it, break the airseal, take out the metal platters and mutilate those. Of
course, your PC might not be worth quite the same after you do this. :)

Still, I want to note two things about your post:

It's not possible in Python to recover deleted files, unless the win32
extensions offer it, or someone else wrote the wrappers for the necessary
function calls. It's certainly possible to use Python to do filesystem stuff
if the bindings are there. (a python-loving friend of mine even wrote an
encrypted-ext2fs driver in Python to recover the encrypted ext2fs-UMSDOS
partition he'd lost by defragmenting his DOS drive the UMSDOS partition was
sitting on. How's that for the power of Python ? :)

Nevertheless, it's all a bit overboard. Formatting your harddrive without
undo-information should make it more than moderately hard to find a specific
file. You can still read some of the data, but it wouldn't be clear what
data belongs where or in what order. If you have really sensitive
information on your harddisk, where a single 512k diskblock may contain
information that mustn't get out in the open, either corrupt it, falsify it
(great way to spread misinformation) or just encrypt it with some weak
encryption like zip's crypt -- with the file fragmented, it'd be nearly
impossible to crack it.

Or if it's _really_ _really_ sensitive, get your company (or whoever pays
you) to put in a replacement drive, and destroy the drive. But if it's
_really_ _really_ _really_ that sensitive, you should start worrying about
other things, like people getting a 'photocopy' of the sensitive information
from your own eyeballs with a simple retinal residue scanner if you've been
looking at it too long. Or being able to see what data's being sent to and
from the disk by measuring magnetic interference, so they could snoop the
data by attaching a very small sensor+transmittor to the back of your PC. Or
a guy named David hacking into your computer by randomly calling numbers and
entering random passwords, almost confusing you into starting WWIII... ;)

offtopic'ly y'rs,
	Thomas

[The day starts good if you can start the day with a longish off-topic post
on the best mailing list in the world.]

-- 
Thomas Wouters <thomas at xs4all.net>

Hi! I'm a .signature virus! copy me into your .signature file to help me spread!