2

Possible Duplicate:
C# - Deleting a file permanently

I read some articles how data recovery software are working. They said that deleted files are still on the HDD but are invisible for the OS. The files are in the same location (memory), but the pointers are different, this is why the OS can't see them.

I want to build a program in C# or C++ which can help me to completely erase files defined by me. Is it enough to use remove() (C++) to remove files permanently? Where should I start my documentation or what I am supposed to do?

Community
  • 1
  • 1
Reteras Remus
  • 923
  • 5
  • 19
  • 34

4 Answers4

3

Try creating a filestream that overwrites the entire file with file with lots of 0, then delete that file? Then, any file recovery programs will recover lots of zeros.

DuskFall
  • 422
  • 2
  • 14
2

Deleting a file removes the file system entry (i.e. a record that tells the file system where a file's data lives on the disk). The data it pointed to is contained is still on the disk platter (though, it may eventually be overwritten).

If you want to remove the data from disk platter, overwrite it with random numbers before removing the file record.

It's like removing your address from a directory; your home still exists, people just can't look up it's location any more. If they are dedicated enough, they could find your house. If you absolutely need to make sure they can never find it, level it with a bulldozer.

Mud
  • 28,277
  • 11
  • 59
  • 92
  • You'll probably need more than one pass to truly delete it. – ChrisF May 05 '12 at 21:50
  • @ChrisF One pass is enough. The "myth" about several passes all stem from one dissertation stating something along the lines, that in the future when magnetic force microscopy would be better, being able to read "old" data would be possible. Unfortunately I can't find the article that dissaproved it. but there is some info here: http://www.anti-forensics.com/disk-wiping-one-pass-is-enough-part-2-this-time-with-screenshots – Holger May 06 '12 at 09:13
2

Simply told, when files are deleted the "pointer" to the first block of data is deleted. But the data is still on the disk. If consequent writes are performed to the disk, there is a chance that the data will be overwritten.

This is very simply told what "unerease" programs do. They search the disk for data that is there, but has no "pointer" in the data structures the file system has.

What is required is usually that the blocks of data are overwritten.

This can be done a number of times, to ensure that data can't be restored.

There are a lot of programs that do that already, thought I'm not suire C# can do it (without resorting to unmanaged code).

See C# - Deleting a file permanently for details.

Community
  • 1
  • 1
Holger
  • 2,243
  • 17
  • 19
  • 2
    According to the accepted answer on the question you linked to, overwriting the blocks which currently contain the file both is surprisingly difficult and also may not be enough. – Ben Voigt May 05 '12 at 22:13
1

With the opaque way that modern operating systems allocate actual sectors when building a file, and with solid state harddrives transparently remapping logical sectors to spread out loading on physical sectors as operating systems thrash the pagefile, the only sure-fire way to guarantee that your data is never recoverable is to drill holes in the hard drive, then burn it. Either that or use an encryption keys for all relevant files, and never store them on the harddrive (i.e. store them in the user's brain). Note also that you need to zero all RAM used in encryption immediately after use to ensure it doesn't get paged out to disk.

Nathan Wiebe
  • 794
  • 5
  • 12
  • 1
    Or use the "secure erase" command built into the drive firmware, which is fully aware of the remapping scheme. – Ben Voigt May 05 '12 at 22:14
  • 1
    I guess that would work if you were okay with your software only working on one harddrive type, or if you are going to implement the secure erase for all possible harddrives :) Here is a research paper backing up my statement, indicating that secure erase feautres are virtually impossible to guarantee through software alone:http://www.google.ca/url?sa=t&rct=j&q=solid%20state%20secure%20erase&source=web&cd=1&ved=0CE4QFjAA&url=http%3A%2F%2Fwww.usenix.org%2Fevent%2Ffast11%2Ftech%2Ffull_papers%2FWei.pdf&ei=naulT8_6FMXe6QHvsuCpBA&usg=AFQjCNFDafWCVKAYoAD34ChHRhtYiwGPlw – Nathan Wiebe May 05 '12 at 22:39
  • 1
    The secure erase command is standardized (ok, you might need two, one for ATA, one for SCSI). On many drives, secure erase is implemented by changing a whole-drive encryption key, which is the same software solution you recommended. It's not really a software vs hardware thing, it's OS vs internal logic. And your answer is spot on when it says the OS doesn't have direct enough access. – Ben Voigt May 05 '12 at 23:07