Simple Informations

I was at IIT Madras (Chennai) for a week from October 1st to participate in the annual technical Festival , Shaastra, there. We planned to compete in one of the robotics events named Emergency Exit. So that was why there were hardly any posts the last week.

Although we went there with the primary aim to participate in the robotics event, we didn’t actually complete the robot and so didn’t compete. But there were hundreds of more interesting events. It was a lot fun to go and just walk theough the IIT.

If you get a chance to visit IITs especially during Saarang or Shaastra do not ever miss it.

Foxit software corporation is the makers of Foxit PDF tools. It includes PDF readers and editors both for the PC and mobile platforms. Although it is a payed product a free trial version can be obtained from Foxit. The trial version is as good as a full version except that in the trial version a water mark is added to the files you write.

Foxit PDF reader is one of the best available PDF readers. It is much lighter that Acrobat reader and also very much faster. You can download Foxit PDF reader here. To try the free PDF editor from Foxit go to the PDF editor Download page. If you want a full fledged PDF creator (not editor) you can try these methods

1. How to print and save as PDF files.

2. Save web pages as PDF files.

3. Free Online Files converter.

There was a small introduction on how files are recovered from magnetic media in the last post. In that post I had said about using repeated overwrites to render a file unrecoverable. Sdelete is a command line utility that can wipe off a file and its traces completely from your hard disk without leaving a chance for recovery. If you have some data that you don”t want others to know about, you can “securely delete” it using sdelete.

sdelete is a tool from sysinternals to erase data from Disk drives completely. It can delete data from USB drives, floppy drives, or hard disk drives. sdelete can also cleanup the freespace avilable on any drive with zeros and delete directories recursively.

You need to download the zip file from sysinternals site, extract it to C:\WINDOWS or C:\WINDOWS\system32 folder (or you can add the folder you are extracting to the PATH variable in Windows environment). so that it can be directly accessed from command prompt.

Usage :

sdelete [-p passes] [-s] [-q] <file or directory>
sdelete [-p passes] [-z|-c] [drive letter]

sdelete is free, light and installation free. You can control the number of passes (overwritings) that has to be done and moreover previously deleted file data can also be cleaned using the free space cleaning facility.

Download sdelete(free) (47Kb) , Visit sdelete webpage on Sysinternals

In the previous post we discussed why deleted files are recoverable from a drive? So lets look at how we can actually remove the file contents from the hard disk which may be needed if you have got confidential data. In any of the present filesystems, the OS doesn’t actually wipe the data contained in a file when it is deleted. But rather the metadata of the file is deleted. In order for a file to be unrecoverable it should be overwritten with some random data. To save processing and other system resources, the OS will simply delete it from corresponding indexes.

Peter Gutmann of Auckland University presented a paper that explained recovering data that has been overwritten by other data on a Magnetic storage media. Theoretically this could mean anybody can recover data aging back to any time from a drive, but practically this is very hard (forget about the any date part). Even recovering data with just a single pass overwrite is difficult.

The number of passes used during an overwrite of a file to render it unrecoverable doesn’t need to be given much importance for normal uses. A 4 pass would be sufficient if you have the time. If your disk fills up easily you may need to use just a single pass and save time.Here a pass means writing the file using pseudo random data in order to render it unusable.

If you have anything confidential on your harddisk, consider deleting it using a file shredder like Window Washer, sdelete, or using a degausser.

This is a small list of folders and files which were displayed by the method mentioned on the previous post in this series.
Recycler : Recycler is a twin of Recycle Bin. The Recycler folder contains a Recycle Bin for each user that logs on to the computer, sorted by their security identifier (SID).
System Volume Information : This contains the log files and backups of important System Files that are used for System Restore in Windows. (System Restore allows you to roll back all the settings and System Files to a previous time)
NTLDR : This is the Windows NT loader, boot loader. This is replaced by winload and Windows Boot Manager in Windows Vista
NTDETECT.COM : This file is used by Windows NT during startup to detect basic hardware. This is used for Systems having BIOS.
Autoexec.bat : is most often used to set environment variables such as keyboard, soundcard, printer, and temporary file locations. It is also used to initiate low level system utilities.
These are the main folders and files in XP.

On the last article we have discussed about seeing all the files that are part of Windows. Now lets see whether we can directly access these folders. As it turns out Windows by default will not grant you permission to the folder System Volume Information.

Thats because the folder contains important System Restore Point informations. So what do you do when you can’t touch your own property. well it is there that the Windows file sharing comes into play. It may sound a little weird at first but it is true. Lets see how.

Step 1 : Go to Tools>>Folder Options and select View tab.

Here scroll down to the bottom, you can see a check box named Use Simple File Sharing (Recommended), UNCHECK the box, click APPLY and OK. Now you are done with the settings part. So just take the Properties (ALT+ENTER) or RIGHT CLICK>>PROPERTIES) of System volume Information you can see a new tab named Security here. You can see that there will be a user named SYSTEM there and it has full permission (refer picture).

You need to add your User account as a user here and give full permission to your self in order to gain access. Click Add button and type in your user name and click Check Names your user name will be filled along with the computer name automatically.

Click OK. now just click on user name of yours and check Full control. Click Apply, OK and you are done.

You can get access to files that return an “Access Denied” error by using this method. are some Files and Folders which need some more work to open I’ll discuss it in next post. Till then try this and figure out what all were hidden from you.