Simple Informations

In the previous post we discussed why deleted files are recoverable from a drive? So lets look at how we can actually remove the file contents from the hard disk which may be needed if you have got confidential data. In any of the present filesystems, the OS doesn’t actually wipe the data contained in a file when it is deleted. But rather the metadata of the file is deleted. In order for a file to be unrecoverable it should be overwritten with some random data. To save processing and other system resources, the OS will simply delete it from corresponding indexes.

Peter Gutmann of Auckland University presented a paper that explained recovering data that has been overwritten by other data on a Magnetic storage media. Theoretically this could mean anybody can recover data aging back to any time from a drive, but practically this is very hard (forget about the any date part). Even recovering data with just a single pass overwrite is difficult.

The number of passes used during an overwrite of a file to render it unrecoverable doesn’t need to be given much importance for normal uses. A 4 pass would be sufficient if you have the time. If your disk fills up easily you may need to use just a single pass and save time.Here a pass means writing the file using pseudo random data in order to render it unusable.

If you have anything confidential on your harddisk, consider deleting it using a file shredder like Window Washer, sdelete, or using a degausser.

If you are new here you may want to subscribe to this blogs full feed RSS
so that you will get the updates automatically to your feed reader.

Tags: Introduction, Recovery

You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.