Declined Add /W(ipe) option to several commands

[Steve Fabian]

When I delete files with the DEL (ERASE) command, or move them to another volume by the MOVE command, I can use the /W option to have them wiped. I would like this option to be available for all commands which can delete files, e.g., RECYCLE, RMDIR, SYNC. I realize that SYNC already uses /W for a different purpose, so that it would need another option letter.
--
Steve

 

[vefatica]

It would be easy (and fun) to write a WIPE plugin (say in 4UTILS) ... any interest?

 

[Steve Fabian]

From: vefatica
| It would be easy (and fun) to write a WIPE plugin (say in 4UTILS) ...
| any interest?

I am particularly interested in wiping from the recycle bin. The files to be wiped are the originals saved in the recycle bin when using Outlook Express' "Folder Compact".
Another option (not one I am interested in) would be to "wipe" by overwriting more than 3 times.
--
Steve

 

[Joe Caverly]

It would be easy (and fun) to write a WIPE plugin (say in 4UTILS) ... any interest?

How about a data sanitizer?

(cmrr.ucsd.edu/people/Hughes/DataSanitizationTutorial.pdf)

I also remember reading somewhere about erase software that was built into certain drives, but was disabled by the motherboard BIOS.

Maybe that's being a bit too secure (and fun) for a plugin.

Joe

 

[vefatica]

On Thu, 11 Nov 2010 15:55:17 -0500, Steve Fábián <>
wrote:

|From: vefatica
|| It would be easy (and fun) to write a WIPE plugin (say in 4UTILS) ...
|| any interest?
|
| I am particularly interested in wiping from the recycle bin. The files to be wiped are the originals saved in the recycle bin when using Outlook Express' "Folder Compact".
| Another option (not one I am interested in) would be to "wipe" by overwriting more than 3 times.

Three times seems enough for the DOD! The number of times could easilly be made
an option.

Does the recycle bin actually use a disk location for the files it houses
different from their location before deletion?

 

[David Marcus]

With Vista or Windows 7, don't you also need to erase the shadow copies?

 

[Steve Fabian]

---- Original Message ----
From: vefatica
To: [email protected]
Sent: Thursday, 2010. November 11. 17:01
Subject: RE: [Suggestions-t-2419] Add /W(ipe) option to several commands

| On Thu, 11 Nov 2010 15:55:17 -0500, Steve F�bi�n <>
| wrote:
|
|| From: vefatica
||| It would be easy (and fun) to write a WIPE plugin (say in 4UTILS)
||| ... any interest?
||
|| I am particularly interested in wiping from the recycle bin. The
|| files to be wiped are the originals saved in the recycle bin when
|| using Outlook Express' "Folder Compact". Another option (not one I
|| am interested in) would be to "wipe" by overwriting more than 3
|| times.
|
| Three times seems enough for the DOD! The number of times could
| easilly be made
| an option.

I was trying to locate the DoD standard, but could not locate it on the 'net. An older version required all zeroes - all ones nine times for confidential data on magnetic media; more for higher classifications.

|
| Does the recycle bin actually use a disk location for the files it
| houses
| different from their location before deletion?

It is my GUESS that it behaves like "rename", the file body - which is what needs to be wiped - would not be moved, only recataloged. To test this, I checked the inode of a junk file, deleted it to the recycle bin, and found that it had the same inode in the recyle bin as the original. I thus think that "delete to recycle bin" is a process which renames the file into the recycler directory, and catalogs its original name in the data file INFO2 of the bin.

As another experiment, I used DEL /W to delete everything from the \RECYCLER directory, then deleted a file to the recycling bin. Everything worked fine. For now I think I will just use DEL/W on the contents of the recycler bin, and will not need a new plugin command.
--
Steve

 

[vefatica]

On Thu, 11 Nov 2010 21:05:56 -0500, Steve Fábián <>
wrote:

| It is my GUESS that it behaves like "rename", the file body - which is what needs to be wiped - would not be moved, only recataloged. To test this, I checked the inode of a junk file, deleted it to the recycle bin, and found that it had the same inode in the recyle bin as the original. I thus think that "delete to recycle bin" is a process which renames the file into the recycler directory, and catalogs its original name in the data file INFO2 of the bin.
|
| As another experiment, I used DEL /W to delete everything from the \RECYCLER directory, then deleted a file to the recycling bin. Everything worked fine. For now I think I will just use DEL/W on the contents of the recycler bin, and will not need a new plugin command.

I experimented a bit too. When I went into
e:\recycler\s-1-5-21-3291446647-2681218026-3195555329-1005\ with a command
prompt, DIR showed files with different names than they had before they were
deleted. Is that typical (I don't often use the recycler)? I also found that
deleting all files there (with TCC) left the recycle bin's desktop icon screwed
up.

I'd think overwriting several times with random characters would be better than
with all zeroes/ones but I'm no expert.

 

[rconn]

When I delete files with the DEL (ERASE) command, or move them to another volume by the MOVE command, I can use the /W option to have them wiped. I would like this option to be available for all commands which can delete files, e.g., RECYCLE, RMDIR, SYNC. I realize that SYNC already uses /W for a different purpose, so that it would need another option letter.

That would be impossible for RECYCLE (until Microsoft provides a few currently non-existent APIs).

RD /S just calls DEL /S, so there's nothing to be gained there.

 

[Steve Fabian]

| I experimented a bit too. When I went into
| e:\recycler\s-1-5-21-3291446647-2681218026-3195555329-1005\ with a
| command prompt, DIR showed files with different names than they had before
| they were deleted. Is that typical (I don't often use the recycler)?

Yes it is. The recycler is a flat directory, so files with the same name deleted from different directories can no longer have their original names. The file INFO2 appears to contain the mapping of RECYCLER content to original (full) file specification.

| I also found that deleting all files there (with TCC) left the recycle bin's desktop
| icon screwed up.

Not here.

| I'd think overwriting several times with random characters would be
| better than with all zeroes/ones but I'm no expert.

The phenomenon called HYSTERESIS is the reason to perform multiple overwrites; what's important is to flip each bit multiple times. Using the same value for each bit may reduce "crosstalk" hysteresis (e.g., between adjacent disk tracks).
--
Steve

 

[Steve Fabian]

| That would be impossible for RECYCLE (until Microsoft provides a few
| currently non-existent APIs).

Is there an API to restore from the recycle bin? If there is, a work-around would be to
1/ save (rename) the current file before restoring its recycle-bin namesake;
2/ wipe the restored file;
3/ restore the save file.

| RD /S just calls DEL /S, so there's nothing to be gained there.

But unlike "DEL /S /W", currently "RD /S /W" is an illegal command. However, a simple comment in HELP topic "rd.htm" how the former can be used to achieve the latter would be sufficient.
--
Steve

 

[vefatica]

On Thu, 11 Nov 2010 22:54:14 -0500, Steve Fábián <>
wrote:

|| I'd think overwriting several times with random characters would be
|| better than with all zeroes/ones but I'm no expert.
|
| The phenomenon called HYSTERESIS is the reason to perform multiple overwrites; what's important is to flip each bit multiple times. Using the same value for each bit may reduce "crosstalk" hysteresis (e.g., between adjacent disk tracks).

If flipping bits is the goal, perhaps more to the point is that writing random
characters will only flip, on the average, half the bits.

 

[Jim Cook]

>
> || I am particularly interested in wiping from the recycle bin. The
> || files to be wiped are the originals saved in the recycle bin when
> || using Outlook Express' "Folder Compact". Another option (not one I
> || am interested in) would be to "wipe" by overwriting more than 3
> || times.
>

If it is important that you actually wipe the data, be sure that the medium
you are wiping writes data the way you think. I believe some compact flash
file system implementations, for example, always round-robin allocate a new
block when writing, thus extending the MTBF as much as possible. In that
case, overwriting to wipe does no good at all, until you fill the medium.

--
Jim Cook
2010 Sundays: 4/4, 6/6, 8/8, 10/10, 12/12 and 5/9, 9/5, 7/11, 11/7.
Next year they're Monday.

 

[Steve Fabian]

Jim Cook:
| If it is important that you actually wipe the data, be sure that the medium
| you are wiping writes data the way you think. I believe some compact flash
| file system implementations, for example, always round-robin allocate a new
| block when writing, thus extending the MTBF as much as possible. In that
| case, overwriting to wipe does no good at all, until you fill the medium.

Overwriting does not allocate new blocks, it updates the contents of previously allocated blocks. I seriously doubt any filesystem would write everything into a new block, and release the original block. Regardless, my personal interest is in standard hard drives using NTFS, so the issue is irrelevant, but thanks for the interesting information.
--
Steve

 

[Jim Cook]

From http://en.wikipedia.org/wiki/CompactFlash

"The even more advanced CompactFlash controllers will also move the data
that is rarely changed so that all blocks are worn evenly."


Also, reading
http://technet.microsoft.com/en-us/library/cc785914(WS.10).aspx says that
shadow copy on write is possible, so if your system is using that, the
storage medium is irrelevant, and the original contents will not be
overwritten. Some virtual machines also do delta / differential disk
writing, to preserve the original state.

Similarly, JPSoft's own CascadePoint could copy the original file, so
overwriting it will not destroy the contents.


My point is not to dispute whether or not it will work on your system, but
that there are things to be aware of if you have a need or obligation to
actually destroy the data. It might not be as easy as you think. There have
only been a couple instances when I had sensitive customer data that needed
to be destroyed, and those were done in front of the customer to their
satisfaction.


On Fri, Nov 12, 2010 at 08:02, Steve Fábián <>wrote:

> Jim Cook:
> | If it is important that you actually wipe the data, be sure that the
> medium
> | you are wiping writes data the way you think. I believe some compact
> flash
> | file system implementations, for example, always round-robin allocate a
> new
> | block when writing, thus extending the MTBF as much as possible. In that
> | case, overwriting to wipe does no good at all, until you fill the medium.
>
> Overwriting does not allocate new blocks, it updates the contents of
> previously allocated blocks. I seriously doubt any filesystem would write
> everything into a new block, and release the original block. Regardless, my
> personal interest is in standard hard drives using NTFS, so the issue is
> irrelevant, but thanks for the interesting information.
> --
> Steve
>
>
>
>
>

--
Jim Cook
2010 Sundays: 4/4, 6/6, 8/8, 10/10, 12/12 and 5/9, 9/5, 7/11, 11/7.
Next year they're Monday.

 

[[email protected]]

re:
| I also found that deleting all files there (with TCC) left the recycle bin's desktop
| icon screwed up.

Maybe you need to erase the iconcache then restart the computer? Are other icons messed up?




----- Original Message -----
From: Steve Fábián
To: [email protected]
Sent: Thursday, November 11, 2010 10:54 PM
Subject: RE: [Suggestions-t-2419] Add /W(ipe) option to several commands


| I experimented a bit too. When I went into
| e:\recycler\s-1-5-21-3291446647-2681218026-3195555329-1005\ with a
| command prompt, DIR showed files with different names than they had before
| they were deleted. Is that typical (I don't often use the recycler)?

Yes it is. The recycler is a flat directory, so files with the same name deleted from different directories can no longer have their original names. The file INFO2 appears to contain the mapping of RECYCLER content to original (full) file specification.

| I also found that deleting all files there (with TCC) left the recycle bin's desktop
| icon screwed up.

Not here.

| I'd think overwriting several times with random characters would be
| better than with all zeroes/ones but I'm no expert.

The phenomenon called HYSTERESIS is the reason to perform multiple overwrites; what's important is to flip each bit multiple times. Using the same value for each bit may reduce "crosstalk" hysteresis (e.g., between adjacent disk tracks).
--
Steve

 

[[email protected]]

Sorery - sent too early....

I meant the following files:

%userprofile%\Local Settings\Application Data\IconCache.db
%LocalAppData%\IconCache.db

----- Original Message -----
From: Charles (RR) Galloway
To:
Sent: Friday, November 12, 2010 01:32 PM
Subject: Re: [Suggestions-t-2419] Add /W(ipe) option to several commands


re:
| I also found that deleting all files there (with TCC) left the recycle bin's desktop
| icon screwed up.

Maybe you need to erase the iconcache then restart the computer? Are other icons messed up?




----- Original Message -----
From: Steve Fábián
To: [email protected]
Sent: Thursday, November 11, 2010 10:54 PM
Subject: RE: [Suggestions-t-2419] Add /W(ipe) option to several commands


| I experimented a bit too. When I went into
| e:\recycler\s-1-5-21-3291446647-2681218026-3195555329-1005\ with a
| command prompt, DIR showed files with different names than they had before
| they were deleted. Is that typical (I don't often use the recycler)?

Yes it is. The recycler is a flat directory, so files with the same name deleted from different directories can no longer have their original names. The file INFO2 appears to contain the mapping of RECYCLER content to original (full) file specification.

| I also found that deleting all files there (with TCC) left the recycle bin's desktop
| icon screwed up.

Not here.

| I'd think overwriting several times with random characters would be
| better than with all zeroes/ones but I'm no expert.

The phenomenon called HYSTERESIS is the reason to perform multiple overwrites; what's important is to flip each bit multiple times. Using the same value for each bit may reduce "crosstalk" hysteresis (e.g., between adjacent disk tracks).
--
Steve

 

[rconn]

| That would be impossible for RECYCLE (until Microsoft provides a few
| currently non-existent APIs).

Is there an API to restore from the recycle bin?

Nope.