How to Wipe Out Deleted Files

[bw2341]

https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-file

After some testing, I worked out a procedure to manually zero out the free space on a drive using the Windows internal command fsutil file. You should be comfortable with windows command line usage before attempting this. I used the traditional Command Prompt to do this. Powershell should work, but I don't have experience with it and have not tested it.

First, make a new directory and change to that directory to have a safe place to work. Then do a DIR.

Code: [Select]

D:\D_workingDIR\fsutilTESTINGdir>dir
 Volume in drive D is D_DRIVE
 Volume Serial Number is FFFF-FFFF

 Directory of D:\D_workingDIR\fsutilTESTINGdir

04/13/2020  10:23 PM    <DIR>          .
04/13/2020  10:23 PM    <DIR>          ..
               0 File(s)              0 bytes
               2 Dir(s)  1,234,567,168 bytes free
Copy the number of bytes free into the Windows Calculator. This is good place to store it and the commas will be removed when you copy out of Calculator and paste it back.

Code: [Select]

D:\D_workingDIR\fsutilTESTINGdir>fsutil file createNew foobarFREESPACE.raw 1234567168
File D:\D_workingDIR\fsutilTESTINGdir\foobarFREESPACE.raw is createdThis creates a file that uses up all of the free disk space. On a FAT or FAT32 drive, this will take a long time as the entire file needs to be written. If so, the task is complete and you can delete the file. I haven't tested on a FAT or FAT32 drive myself. On NTFS, sparse file support means that there are additional steps.

The next command has to be run in an Administrator Command Prompt:

Code: [Select]

D:\D_workingDIR\fsutilTESTINGdir>fsutil file setValidData foobarFREESPACE.raw 1234567168
Valid data length is changed
The next command can be run as a regular user:

Code: [Select]

D:\D_workingDIR\fsutilTESTINGdir>fsutil file setZeroData offset=0 length=1234567168 foobarFREESPACE.raw
Zero data is changed
setZeroData will take a long time as it will write zeros to the file. Once it is done, you can delete the file and your free space should be zeroed.

The commands are relatively safe to execute. The main risk is if you use the tab key for file name autocomplete, you might pick up the wrong filename and permanently delete one of your files. createNew is safe as it can only create a new file. setValidData can corrupt the file by changing the file length. setZeroData will irrevocably erase the data in a file.

If createNew fails because of lack of free space, try reducing the file size by a couple kilobytes. Windows may be using some space for housekeeping, preventing you from allocating all the space. I've only tried this on a data only drive as I suspect Windows will complain if you use up all the space on the system drive.

You might have to wait for the disk activity to stop before deleting the file as write caching may return you to the command prompt before setZeroData is finished.

On NTFS, there still may be some unerased personal information in the free space after this procedure. On very short files, NTFS stores the file data in the MFT record itself and this procedure will not affect the free space in the MFT record.

[bostonman]

I planned to try the procedure listed, however, thought to give the program CC Cleaner another try - this time on seven runs.

From what I can tell, it wipes out files completely because the HEX code shows 0s. What I'm seeing though: the file names are still present.

The way I understand it: when Windows deletes a file, it basically deletes the pointer to the file (or in simple terms, it deletes the entry in the Table of Contents to use a book analogy). If the file is blank, why doesn't the file name get deleted as well?

How can I delete the file name(s) from existence too?

[tszaboo]

You copy the files to a new drive.
You smash the old drive with a hammer.
HDD and SSD is a commodity, and the information on it is worth more than the drive.

[bostonman]

So you enjoy contributing to a throw away world?

One reason EEVBlog exists is to share information and learn. Anyone can copy files and smash - although I'd choose to use a sledgehammer.

[rdl]

Well, if the drive is being replaced or taken out of service for whatever reason, nuking from orbit is the only way to be sure. Doesn't work so good for a drive that's in active use. I'm beginning to think encrypting and sequestering sensitive data is the better way. Doesn't help much with existing data though and adds its own set of problems.

[bostonman]

Well, if the drive is being replaced or taken out of service for whatever reason, nuking from orbit is the only way to be sure. Doesn't work so good for a drive that's in active use. I'm beginning to think encrypting and sequestering sensitive data is the better way. There's still potential leakage problems with the OS, especially Windows.

Encrypting is the best way. Most of the data that I want wiped away forever is general stuff. Nothing that would have needed encrypting had I considered such a method from the start.

The drive will be kept with backup data on it, however, certain data (including file names) I'd like wiped away for good.

My last question was regarding how and why do the file names still exist even if they data is all showing HEX 0s?

[rdl]

What file system is it and where do the file names still exist?

[rsjsouza]

In Windows I usually use Puran Utilities
http://www.puransoftware.com/Puran-Utilities.html

[bw2341]

Can you clarify the program you're using?
CCleaner (two C's) is a utility program that's been around for more than a decade.
CC Cleaner (three C's) is apparently a scam program according to antimalware companies.

My last question was regarding how and why do the file names still exist even if they data is all showing HEX 0s?

I'm not in IT or CS. I'm just a Windows user, so do not take my advice as authoritative.

NTFS stores file information in the Master File Table (MFT). Each file has an MFT record associated with it. If the filename of a deleted file is still visible in scanning software, the MFT record may be simply marked as empty instead of being overwritten when a file is deleted.

I've read somewhere that Windows looks for the first free MFT record when it needs one for a new file. If so, all you have to do is create enough new files to exceed the highest number of files you have ever had on the disk. This will create 100 junk files.

Code: [Select]

D:\D_workingDIR\MakeDummyFilesDirectory>FOR /L %x IN (1,1,100) DO echo ABC123 > DummyFileNameBoyItsKindaLong1234567890ABCDEFGHIJ_%x.junkI used long filenames in the example as they may be needed to fully overwrite the old filenames of the deleted files. Scan the disk again to see if your old filenames are still visible. Check closely for partial filenames.

[Doctorandus_P]

Linux with dd works great.

If you want to keep it simple, then first delete all files, empty the recycle bin, and then write some random files to the HDD untill it complains it's full.
Then write some smaller files untill the last bit is also filled.

You won't get everything this way as some room is allocated for file names and such.
You also have to watch out for different partitions on that drive.

If the security of your data is more worth than a EUR60 second hand old HDD, then just take a hammer and hit it untill the platters are bent.
Good exercise too.

[Messtechniker]

then just take a hammer and hit it untill the platters are bent.

Before doing so, salvage the strong magnets first. These can be quite useful to collect small screws and other magnetic items from the floor. Make magnetic dishes. Attach printouts to steel panels (refrigerator, steel doors). Some of these magnets even have mounting holes. Useful to attach to wood panels.