ks6+Pf&Ô,YnRi$M^~HH  JoE-ǹy&qbw/o~?޼ C1A1uw 92b$C i456ǂ:'rjyO$JZ&aًKlnD#ƹvfvIو',v=%$TNcdgEV5iWtg\8&О1r@Җ y>e3F\  C#B(jW/#8yDG802ê[[fTF o^ӆ[XO0)D䔜J=%$+9õ@h;loj[{f:Z4*gN:®!$Cʴ>6RhM X_Oyާί9ϩ4wGD3щfљEԀTW)e4e\֠Ә}*ӓX[1%v"*DD7k.Ml MLKݷIrǮ,JpP^1bxmGˁF9%n{?Z?86;3zeS֪M<3jB Mp`L%dNw^3 ddZP^<%E`ָ N# Zf\gnM3[KJ_'Ut=QpF gh+cjT:s!7ԞԚUY u+>nU{Z `|`27 uqI"ru"Mqv=C9cX;hc-Pffq P]=8" YS\1*)k>՝_}0t$^YZ1lq#l07N"n5+a8i^& "hUM zVCA+>qOZx,VsW4E IFrD`,POSJ#Xz+6h4om̅Ři8 5(A`jh7?9hDzCCPVA81@Fqk$麮5Gff^t:^BЊº(ƃs^"X`37MZ 3<2!nc *6GLkW,sC{Y2`: R10S"ӸSmXm!u5u=7 1@1}RS :޺CL惇?܄U?hnŀ\`E,Vwǵ>h?>3º_]B|NWyiZsw@EUPQM~]8.\:K̍pXl` ~ 47,HJ- .qe3- #4[Is0FW9jY2#̺PlQG A0@;9l7 KBBN@n?+,56f?+"w^ټoPK$w!8CoL'1^f$оn67ءUasb !eܘ쥫3}sZn`ChЪ6:*YR)uߔy2:&f&9+*uJHjƓ}XNjL8_ȘRu@cޑ7/^*~q 8l,=*֞߻ß~"pw>(A?ݣaFLK*?Ow 1$mj $jl׏V~`"WqlUfa_y5O]κ.ƾqg1F3r{ iٞ0OaU fZOsKU٧ 5QK4cb ffTtirrk%6Lss}wߕ)vHlN1f3<6"bSyr͜p"e:MFLL3yC15Z9,vo[q)mԨS ,xd4YR,ݫmF>;S]&apV+2KHq&y6]y @eQ9J?:;b}3ĭY!g\OTeCO*%qA2d#dp 5w|˷ĞUbI(L]{.Rɏ7'G7O>׼FjSvON`R$H'/z[H9 ,oFcSc>f,ɬ{ah/rnh?n4O==l>i*=$c'rR~HաjU0 єz \ܩ &@@q!?O5/G3(\۝UiZ|Wm^ި5P[< +yc"=C'\:E.|`*Mz1´h&b ̛\ 04/17/07, One Step Ahead - Almanac, Vol. 53, No. 30
Print This Issue

One Step Ahead
April 17, 2007, Volume 53, No. 30

One Step Ahead

Another tip in a series provided by the Offices of Information Systems & Computing and Audit, Compliance & Privacy.

When is a PC File Truly Deleted?

So, you dragged that sensitive file to the Recycle Bin, emptied the bin, and now the file is gone forever, right? Not so fast.

Like cats, deleted files seemingly have nine lives. When you delete a file, the operating system simply changes the first character of the filename and marks the space the file occupies as being free. The filename and data remain on the drive until overwritten and are easily retrievable using widely available recovery and forensic tools.

But wait, there’s more. For speed and efficiency, Windows creates temporary files for storing file data while the file is open, and these temporary files often remain even after deletion. Windows also uses page- and swapfiles to create “virtual memory” for faster operation, and deleted files can often remain in these as well. And what about copies on backup tapes, CDs, or other media.

Windows XP has a “Disk Cleanup” utility that can be accessed via the Start/Programs/Accessories/System Tools/Disk Cleanup menu sequence. For secure file deletion, security experts recommend using one or more disk-wiping or “shredding” utility programs that are available from many sources, some for free or minimal cost. These programs will overwrite the space occupied by a deleted file with 0’s, 1’s, or random data and can be set to make multiple passes. Opinion varies on how many passes are needed, but three is considered sufficient in most instances.

A more thorough, not overly technical discussion of file deletion can be found at www.sans.org/reading_room/whitepapers/incident/631.php.





For additional tips, see the One Step Ahead link on the Information Security website: www.upenn.edu/computing/security/.

Almanac - April 17, 2007, Volume 53, No. 30