1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Add /W(ipe) option to several commands

Discussion in 'Suggestions' started by Steve Fabian, Nov 11, 2010.

  1. Steve Fabian

    Joined:
    May 20, 2008
    Messages:
    3,523
    Likes Received:
    4
    When I delete files with the DEL (ERASE) command, or move them to another volume by the MOVE command, I can use the /W option to have them wiped. I would like this option to be available for all commands which can delete files, e.g., RECYCLE, RMDIR, SYNC. I realize that SYNC already uses /W for a different purpose, so that it would need another option letter.
    --
    Steve
     
  2. vefatica

    Joined:
    May 20, 2008
    Messages:
    7,794
    Likes Received:
    29
    It would be easy (and fun) to write a WIPE plugin (say in 4UTILS) ... any interest?
     
  3. Steve Fabian

    Joined:
    May 20, 2008
    Messages:
    3,523
    Likes Received:
    4
    From: vefatica
    | It would be easy (and fun) to write a WIPE plugin (say in 4UTILS) ...
    | any interest?

    I am particularly interested in wiping from the recycle bin. The files to be wiped are the originals saved in the recycle bin when using Outlook Express' "Folder Compact".
    Another option (not one I am interested in) would be to "wipe" by overwriting more than 3 times.
    --
    Steve
     
  4. Joe Caverly

    Joined:
    Aug 28, 2009
    Messages:
    639
    Likes Received:
    7
    How about a data sanitizer?

    (http://cmrr.ucsd.edu/people/Hughes/DataSanitizationTutorial.pdf)

    I also remember reading somewhere about erase software that was built into certain drives, but was disabled by the motherboard BIOS.

    Maybe that's being a bit too secure (and fun) for a plugin.

    Joe
     
  5. vefatica

    Joined:
    May 20, 2008
    Messages:
    7,794
    Likes Received:
    29
    On Thu, 11 Nov 2010 15:55:17 -0500, Steve Fábián <>
    wrote:

    |From: vefatica
    || It would be easy (and fun) to write a WIPE plugin (say in 4UTILS) ...
    || any interest?
    |
    | I am particularly interested in wiping from the recycle bin. The files to be wiped are the originals saved in the recycle bin when using Outlook Express' "Folder Compact".
    | Another option (not one I am interested in) would be to "wipe" by overwriting more than 3 times.

    Three times seems enough for the DOD! The number of times could easilly be made
    an option.

    Does the recycle bin actually use a disk location for the files it houses
    different from their location before deletion?
     
  6. David Marcus

    Joined:
    Jun 4, 2008
    Messages:
    646
    Likes Received:
    1
    With Vista or Windows 7, don't you also need to erase the shadow copies?
     
  7. Steve Fabian

    Joined:
    May 20, 2008
    Messages:
    3,523
    Likes Received:
    4
    ---- Original Message ----
    From: vefatica
    To: ESFabian@comcast.net
    Sent: Thursday, 2010. November 11. 17:01
    Subject: RE: [Suggestions-t-2419] Add /W(ipe) option to several commands

    | On Thu, 11 Nov 2010 15:55:17 -0500, Steve F�bi�n <>
    | wrote:
    |
    || From: vefatica
    ||| It would be easy (and fun) to write a WIPE plugin (say in 4UTILS)
    ||| ... any interest?
    ||
    || I am particularly interested in wiping from the recycle bin. The
    || files to be wiped are the originals saved in the recycle bin when
    || using Outlook Express' "Folder Compact". Another option (not one I
    || am interested in) would be to "wipe" by overwriting more than 3
    || times.
    |
    | Three times seems enough for the DOD! The number of times could
    | easilly be made
    | an option.

    I was trying to locate the DoD standard, but could not locate it on the 'net. An older version required all zeroes - all ones nine times for confidential data on magnetic media; more for higher classifications.

    |
    | Does the recycle bin actually use a disk location for the files it
    | houses
    | different from their location before deletion?

    It is my GUESS that it behaves like "rename", the file body - which is what needs to be wiped - would not be moved, only recataloged. To test this, I checked the inode of a junk file, deleted it to the recycle bin, and found that it had the same inode in the recyle bin as the original. I thus think that "delete to recycle bin" is a process which renames the file into the recycler directory, and catalogs its original name in the data file INFO2 of the bin.

    As another experiment, I used DEL /W to delete everything from the \RECYCLER directory, then deleted a file to the recycling bin. Everything worked fine. For now I think I will just use DEL/W on the contents of the recycler bin, and will not need a new plugin command.
    --
    Steve
     
  8. vefatica

    Joined:
    May 20, 2008
    Messages:
    7,794
    Likes Received:
    29
    On Thu, 11 Nov 2010 21:05:56 -0500, Steve Fábián <>
    wrote:

    | It is my GUESS that it behaves like "rename", the file body - which is what needs to be wiped - would not be moved, only recataloged. To test this, I checked the inode of a junk file, deleted it to the recycle bin, and found that it had the same inode in the recyle bin as the original. I thus think that "delete to recycle bin" is a process which renames the file into the recycler directory, and catalogs its original name in the data file INFO2 of the bin.
    |
    | As another experiment, I used DEL /W to delete everything from the \RECYCLER directory, then deleted a file to the recycling bin. Everything worked fine. For now I think I will just use DEL/W on the contents of the recycler bin, and will not need a new plugin command.

    I experimented a bit too. When I went into
    e:\recycler\s-1-5-21-3291446647-2681218026-3195555329-1005\ with a command
    prompt, DIR showed files with different names than they had before they were
    deleted. Is that typical (I don't often use the recycler)? I also found that
    deleting all files there (with TCC) left the recycle bin's desktop icon screwed
    up.

    I'd think overwriting several times with random characters would be better than
    with all zeroes/ones but I'm no expert.
     
  9. rconn

    rconn Administrator
    Staff Member

    Joined:
    May 14, 2008
    Messages:
    9,732
    Likes Received:
    81
    That would be impossible for RECYCLE (until Microsoft provides a few currently non-existent APIs).

    RD /S just calls DEL /S, so there's nothing to be gained there.
     
  10. Steve Fabian

    Joined:
    May 20, 2008
    Messages:
    3,523
    Likes Received:
    4
    | I experimented a bit too. When I went into
    | e:\recycler\s-1-5-21-3291446647-2681218026-3195555329-1005\ with a
    | command prompt, DIR showed files with different names than they had before
    | they were deleted. Is that typical (I don't often use the recycler)?

    Yes it is. The recycler is a flat directory, so files with the same name deleted from different directories can no longer have their original names. The file INFO2 appears to contain the mapping of RECYCLER content to original (full) file specification.

    | I also found that deleting all files there (with TCC) left the recycle bin's desktop
    | icon screwed up.

    Not here.

    | I'd think overwriting several times with random characters would be
    | better than with all zeroes/ones but I'm no expert.

    The phenomenon called HYSTERESIS is the reason to perform multiple overwrites; what's important is to flip each bit multiple times. Using the same value for each bit may reduce "crosstalk" hysteresis (e.g., between adjacent disk tracks).
    --
    Steve
     
  11. Steve Fabian

    Joined:
    May 20, 2008
    Messages:
    3,523
    Likes Received:
    4
    | That would be impossible for RECYCLE (until Microsoft provides a few
    | currently non-existent APIs).

    Is there an API to restore from the recycle bin? If there is, a work-around would be to
    1/ save (rename) the current file before restoring its recycle-bin namesake;
    2/ wipe the restored file;
    3/ restore the save file.

    | RD /S just calls DEL /S, so there's nothing to be gained there.

    But unlike "DEL /S /W", currently "RD /S /W" is an illegal command. However, a simple comment in HELP topic "rd.htm" how the former can be used to achieve the latter would be sufficient.
    --
    Steve
     
  12. vefatica

    Joined:
    May 20, 2008
    Messages:
    7,794
    Likes Received:
    29
    On Thu, 11 Nov 2010 22:54:14 -0500, Steve Fábián <>
    wrote:

    || I'd think overwriting several times with random characters would be
    || better than with all zeroes/ones but I'm no expert.
    |
    | The phenomenon called HYSTERESIS is the reason to perform multiple overwrites; what's important is to flip each bit multiple times. Using the same value for each bit may reduce "crosstalk" hysteresis (e.g., between adjacent disk tracks).

    If flipping bits is the goal, perhaps more to the point is that writing random
    characters will only flip, on the average, half the bits.
     
  13. Jim Cook

    Joined:
    May 20, 2008
    Messages:
    605
    Likes Received:
    0
    If it is important that you actually wipe the data, be sure that the medium
    you are wiping writes data the way you think. I believe some compact flash
    file system implementations, for example, always round-robin allocate a new
    block when writing, thus extending the MTBF as much as possible. In that
    case, overwriting to wipe does no good at all, until you fill the medium.

    --
    Jim Cook
    2010 Sundays: 4/4, 6/6, 8/8, 10/10, 12/12 and 5/9, 9/5, 7/11, 11/7.
    Next year they're Monday.
     
  14. Steve Fabian

    Joined:
    May 20, 2008
    Messages:
    3,523
    Likes Received:
    4
    Jim Cook:
    | If it is important that you actually wipe the data, be sure that the medium
    | you are wiping writes data the way you think. I believe some compact flash
    | file system implementations, for example, always round-robin allocate a new
    | block when writing, thus extending the MTBF as much as possible. In that
    | case, overwriting to wipe does no good at all, until you fill the medium.

    Overwriting does not allocate new blocks, it updates the contents of previously allocated blocks. I seriously doubt any filesystem would write everything into a new block, and release the original block. Regardless, my personal interest is in standard hard drives using NTFS, so the issue is irrelevant, but thanks for the interesting information.
    --
    Steve
     
  15. Jim Cook

    Joined:
    May 20, 2008
    Messages:
    605
    Likes Received:
    0
    From http://en.wikipedia.org/wiki/CompactFlash

    "The even more advanced CompactFlash controllers will also move the data
    that is rarely changed so that all blocks are worn evenly."


    Also, reading
    http://technet.microsoft.com/en-us/library/cc785914(WS.10).aspx says that
    shadow copy on write is possible, so if your system is using that, the
    storage medium is irrelevant, and the original contents will not be
    overwritten. Some virtual machines also do delta / differential disk
    writing, to preserve the original state.

    Similarly, JPSoft's own CascadePoint could copy the original file, so
    overwriting it will not destroy the contents.


    My point is not to dispute whether or not it will work on your system, but
    that there are things to be aware of if you have a need or obligation to
    actually destroy the data. It might not be as easy as you think. There have
    only been a couple instances when I had sensitive customer data that needed
    to be destroyed, and those were done in front of the customer to their
    satisfaction.


    On Fri, Nov 12, 2010 at 08:02, Steve Fábián <>wrote:




    --
    Jim Cook
    2010 Sundays: 4/4, 6/6, 8/8, 10/10, 12/12 and 5/9, 9/5, 7/11, 11/7.
    Next year they're Monday.
     
  16. re:
    | I also found that deleting all files there (with TCC) left the recycle bin's desktop
    | icon screwed up.

    Maybe you need to erase the iconcache then restart the computer? Are other icons messed up?




    ----- Original Message -----
    From: Steve Fábián
    To: CSGalloway@nc.rr.com
    Sent: Thursday, November 11, 2010 10:54 PM
    Subject: RE: [Suggestions-t-2419] Add /W(ipe) option to several commands


    | I experimented a bit too. When I went into
    | e:\recycler\s-1-5-21-3291446647-2681218026-3195555329-1005\ with a
    | command prompt, DIR showed files with different names than they had before
    | they were deleted. Is that typical (I don't often use the recycler)?

    Yes it is. The recycler is a flat directory, so files with the same name deleted from different directories can no longer have their original names. The file INFO2 appears to contain the mapping of RECYCLER content to original (full) file specification.

    | I also found that deleting all files there (with TCC) left the recycle bin's desktop
    | icon screwed up.

    Not here.

    | I'd think overwriting several times with random characters would be
    | better than with all zeroes/ones but I'm no expert.

    The phenomenon called HYSTERESIS is the reason to perform multiple overwrites; what's important is to flip each bit multiple times. Using the same value for each bit may reduce "crosstalk" hysteresis (e.g., between adjacent disk tracks).
    --
    Steve
     
  17. Sorery - sent too early....

    I meant the following files:

    %userprofile%\Local Settings\Application Data\IconCache.db
    %LocalAppData%\IconCache.db

    ----- Original Message -----
    From: Charles (RR) Galloway
    To:
    Sent: Friday, November 12, 2010 01:32 PM
    Subject: Re: [Suggestions-t-2419] Add /W(ipe) option to several commands


    re:
    | I also found that deleting all files there (with TCC) left the recycle bin's desktop
    | icon screwed up.

    Maybe you need to erase the iconcache then restart the computer? Are other icons messed up?




    ----- Original Message -----
    From: Steve Fábián
    To: CSGalloway@nc.rr.com
    Sent: Thursday, November 11, 2010 10:54 PM
    Subject: RE: [Suggestions-t-2419] Add /W(ipe) option to several commands


    | I experimented a bit too. When I went into
    | e:\recycler\s-1-5-21-3291446647-2681218026-3195555329-1005\ with a
    | command prompt, DIR showed files with different names than they had before
    | they were deleted. Is that typical (I don't often use the recycler)?

    Yes it is. The recycler is a flat directory, so files with the same name deleted from different directories can no longer have their original names. The file INFO2 appears to contain the mapping of RECYCLER content to original (full) file specification.

    | I also found that deleting all files there (with TCC) left the recycle bin's desktop
    | icon screwed up.

    Not here.

    | I'd think overwriting several times with random characters would be
    | better than with all zeroes/ones but I'm no expert.

    The phenomenon called HYSTERESIS is the reason to perform multiple overwrites; what's important is to flip each bit multiple times. Using the same value for each bit may reduce "crosstalk" hysteresis (e.g., between adjacent disk tracks).
    --
    Steve
     
  18. rconn

    rconn Administrator
    Staff Member

    Joined:
    May 14, 2008
    Messages:
    9,732
    Likes Received:
    81
    Nope.
     

Share This Page