Re: Cant find an 'answer' no matter where I look or post

Geoff wrote:

Hello,.

I have spent time on & off trying to understand the abilitie(s) of Defrag
and file wiping.

My question is simple, ( well at least in typing it) Does or does not
defragging eventually cleanse a hard-drive to the extent that nothing
could be recovered?

Does not. Not only is it possible that the stuff you actually deleted
could be recovered because it's outside any sectors that ever get
written over by the defrag process, defragging does absolutely nothing
to obscure files or fragments of files that haven't been deleted at
all. And "eraser" programs are notoriously flawed. I doubt even
Micro$oft themselves knows every little hiding place Windows might
stash bits of your data. How is Joe from Joe's Eraser going to get them
all? :(

I have heard that if a drive is defragged often enough not even military
software can rebuild or identify anything the hard-drive may have had
on it.

I've heard that if you dance naked under a full moon and chant the
words "baradda nikto filezgobyebye" you're safe too. <grin>

Think about it. Defrag generally tries to align and make contiguous
sectors of data that are scattered across a drive. IOW, if you have a
track that looks like this....

--------------------------------------------------------------------
File1 | File2 | File 1 | empty space | File1 | File2 |
--------------------------------------------------------------------

Defrag tries to make it look like this....

--------------------------------------------------------------------
File1 | File2 |
--------------------------------------------------------------------

See all the empty space at the end where parts of File1 and File 2 use
to be? They may or may not have been overwritten at all. Probably not.
And even if they were it's a one or two step overwrite, with other
data you might not want revealed no less. So it's a VERY good chance
that at least part of your "deleted" data is going to be recoverable.

I personally have a program called "super-shredder"., but if I feed it
anything larger than a 'meg' it seems to balk....... should I even
bother with this?

Don't know a thing about your super-shredder, but there's literally
hundreds of utilities both big and small to "securely delete" files.
Some are better than others, some are total snake oil, and it's
debatable to what extent they're effective in the first place. Military
Wipe is pretty much a meaningless buzz word because you're not using
the same equipment the military uses. Their read/write heads are
likely to be a whole lot more sensitive and powerful than the heads in
your consumer grade drive, so it's possible that you'll NEVER be able
to completely wipe a drive to the point it will stand up to "Military
Grade" analysis. Note that "military" might mean FBI or their ilk in
this context.

If you want the best possible protection against having your files
recovered by LE or other attackers then encrypt them. Whole disk
encryption if you possibly can. If they're that valuable the penalty
for not handing over the pass phrases will be less than them having the
evidence (if there's any penalty at all), and you can be just shy of
100% sure they'll not be able to recover anything. Use very strong pass
phrases, like in the 25-30 random character range, and you're golden.
Mainstream, peer reviewed whole disk encryption using known secure
algorithms in conjunction with pass phrases of equal or better strength
and I'd even go out on the limb and give it the 100% unrecoverable seal
of approval. With a "for all practical purposes" disclaimer. ;) You
never know if space aliens haven't given your government ultra-secret
methods of factoring very large numbers or something. ;)

.

Relevant Pages

  • Re: file attribute HSA
    ... Try to open the file with notepad, wordpad, or word (use Recover Text From Any File converter). ... > meant was actually that the FILE windows\0 had over 800 fragments in it. ... > Fourth, I tried a defrag, in safe mode just to alleviate as many ... Note that even though 0,9, S and Y don,t report as fragmented, they ...
    (microsoft.public.windowsxp.perform_maintain)
  • Re: Huge .stm file mystery
    ... The online defrag claim that no space is recovered. ... run an offline defrag and it didn't recover much space at ... which parallels what Exchange System ...
    (microsoft.public.exchange.admin)
  • Re: Lost Pics
    ... >> Photo Gallery which includes every single photo I've ever ... >> and a defrag after I messed around with the files. ... >> recover these pics after a defrag? ... You have learned that system restore doesn't restore ...
    (microsoft.public.windowsxp.general)
  • Re: How to decrease the priv1.edb size
    ... store and set retention period to zero. ... infomation store and at next defrag pass it will recover ...
    (microsoft.public.exchange2000.information.store)
  • Re: Urgent advice requested re: Exchange 5.5 Online/Offline defrag
    ... Online maintenance is used to ... recover database space. ... it is *often* recommended to run an off-line defrag. ... >> Offline defrag with temp file on the network is supposed to be long ...
    (microsoft.public.exchange.admin)
Loading