1

Say I have a file I want to erase. Simply deleting it is not enough. It still resides in the recycle bin. Emptying the recycle bin does little as well, the actual data is not deleted just the pointer, this means that as long as the file is not overwritten the data is still recoverable. Lets say I have a file I want to completely delete and hide the contents of. Before deleting the file. I open the file and remove all the content inside it and replace it with a series of zeros.

So a file like this:

THIS IS SOME SAMPLE TEXT

Turns into this:

000000000000000000000000000000000000000000000000000000

When I delete the file after replacing everything with zeros is the original data(THIS IS SOME SAMPLE TEXT) gone? The pointer is gone and the series of zeros is still on the disk but is actually still possible to recover those zeros and figure out that before those zeros were there the original data was "THIS IS SOME SAMPLE TEXT"? If not would that original piece of data be erased without any hope of recovery? If the data can still be recovered, whats the best way of erasing it so that its hardest for anyone to recover it through digital forensic tools?

baldPrussian
  • 2,778
  • 2
  • 10
  • 14
eclipse
  • 83
  • 4
  • 2
    This depends on a lot of factors (CoW in the filesystem, journaling, SSD wear leveling, snapshots, and more). In general, the assumption should be that only overwriting the full disk is sufficient, and that overwriting individual files on any modern filesystem may not do what you intend. – forest Nov 28 '17 at 14:17
  • 2
    Also, this question has been asked dozens of times before. See https://security.stackexchange.com/questions/31390/whats-a-good-secure-file-deleter?rq=1 for example. – forest Nov 28 '17 at 14:25
  • The question you two link is slightly different. That is asking for the best way to delete data. This question is asking if this particular way is a valid way to delete data. – Goose Nov 28 '17 at 15:18
  • 2
    While the question itself isn't a duplicate, the accepted answer there answers this question, I think. – Xiong Chiamiov Nov 28 '17 at 18:36
  • @XiongChiamiov exactly my thoughts. The accepted answer explains the caveats of your method of file shredding, such as where leftover data and metadata may remain. – forest Nov 29 '17 at 05:11

0 Answers0