[dba-Tech] Retrieving Deleted Files off a hard drive

John Bartow john at winhaven.net
Thu Jul 31 18:36:04 CDT 2003


The hard drive can be cleaned beyond most attempts by several utilites that
are available that basically write 1 & 0s to any unused portion of the disk
(as noted by the File Allocation Table) a certain number of times. IIRC 7
writes is US govt spec for security. It erases the magnetic memory that
allows the gurus to "see" what used to be there.

However,
I would think an audit would first look through the various folder/files
that windows doesn't expose to the average (sometimes even power) user. That
would be the most obvious way to go about it - registry, internet history
folders, cache folders, temporary files, email, etc.

I think it would take along time and some effort to actually erase all of
your tracks from a windows computer if an expert was looking for something.
Easier to start from scratch.

Norton SystemWorks has quite a few of the tools to do this but many if not
all can be found for free on the internet. If someone has run NSW and not
manually cleaned the registry afterwards you can find tracks that NSW was
used :o)

HTH
JB

> -----Original Message-----
> From: dba-tech-bounces at databaseadvisors.com
> [mailto:dba-tech-bounces at databaseadvisors.com]On Behalf Of Stoker,
> Kenneth E
> Sent: Thursday, July 31, 2003 2:50 PM
> To: dba-Tech (E-mail)
> Subject: [dba-Tech] Retrieving Deleted Files off a hard drive
>
>
> Everyone,
>
> I recently had a discussion with a coworker about the subject of
> retrieving deleted files off a hard drive.  We got on the subject
> because we are having an audit on those company-owned computers
> systems that some staff may have at home for business use.  He
> claims that any file can be reclaimed, even if a defragmentation
> has been run.  I thought that once a disk has been defragmented,
> those files were truly gone, if the anyone defragmented the disk,
> the audit would basically be a waste of time.  Is this true?  The
> computer security group here is, I'm sure, quite good, don't let
> any limitations be considered in any advise returned to settle
> this score.
>
> If it is possible, does that also apply to a reformatted disk?  I
> would think that a reformatted disk would be the ultimate
> cleanup, but that would have me wondering now if a defragment
> doesn't work.  Which would cause some serious concerns at this
> location as much of the stuff that I work with is very sensitive
> and would make me wonder about correct processes when buying a
> new machine and excessing the old one.
>
> Thanks for your help in settling the discussion.
>
>
> Ken Stoker
> Technology Commercialization
> Information Systems Administrator
> PH: (509) 375-3758
> FAX: (509) 375-6731
> E-mail:  Kenneth.Stoker at pnl.gov
>
>
> _______________________________________________
> dba-Tech mailing list
> dba-Tech at databaseadvisors.com
> http://databaseadvisors.com/mailman/listinfo/dba-tech
> Website: http://www.databaseadvisors.com
>
>



More information about the dba-Tech mailing list