Pages

Wednesday, December 14, 2011

Overwrite deleted data without third-party programs (Windows)

Deleting files doesn't erase them from the hard disk, as many criminals convicted by digital evidence have learned the hard way. When you delete a file in Windows, by default it just goes into the Recycle Bin. It can easily be discovered there and restored. Even after you empty the Recycle Bin, though, the data isn't gone. Windows simply removes the pointers to it from the file table and marks that space on the disk as reusable. Until it's overwritten by new data, computer forensics experts can still use special software to recover it.

If you have sensitive data and you need to ensure that it's wiped out completely, you can use third-party programs designed to "wipe" the disk -- or, if you have Windows Server 2003, you can use the cipher.exe utility to overwrite deleted data. The Security Rollup Package 1 for Windows 2000 also includes this new version of the cipher tool.

For instructions on how to overwrite deleted data with the cipher tool, see Microsoft's KB article 814599 at http://support.microsoft.com/default.aspx?scid=kb;en-us;814599.

No comments:

Post a Comment

Note: Only a member of this blog may post a comment.