Deleted files not really deleted, stored in "secret" folder...

http://www.geocities.com/spacepirate...uritynews.html

for more information, it contains some information about it, but most importently it has
the link to the actual article...















www.spacepirateyar.com----woohoo, gotta love those free TK re-directors.

wow - now here is a real treasure chest of information. LOL - in almost ALL cases, when I file is "deleted" it is not actually "deleted", rather just the file pointer is removed. the actuall data remains until it's physical address is over written.

I use a little program called east-tec eraser and it overwrites the files to your specs BUT the name of the file is still retrievable



whoops i read the article after I posted about deletions-talking about wrong deletions-Spybot search and destroy can take out the registry streams of where youve been and I don't use outlook so I don't know about that--but when i run spybot before I log off there is an amazing amount of stuff stored and this is after i flush the cache and cookies and regular history :(

I believe there have been MANY MANY discussions about this on here...

Even though this has been discussed before, this again brings up the question of redundant threads. If the quality of the information is helpful, I generally am not bothered by repetative and/or redundant threads on occasion. Also, considering it's Divine's first post here at AO, I think it's a good start. At least it's not some thread about phone phreaking, hacking hotmail accounts, etc.

Quote:

---

Originally posted here by avenger_jcc
I believe there have been MANY MANY discussions about this on here...

---

Yup....

But most were a lot more lively then this one !!

BTW the article is quite good.. just a bit outdated (would have been a good read in 1998 or 1999 ;))

I use Norton System Works to delete those (not) deleted files. It automaticly delete the file's after 7 days :D

The more updated version can be found on:
http://www.****microsoft.com/content...en-files.shtml

The actual text has been posted on AO before but I could not find it.

Is this version of the paper applicable to Windows XP? If not, is there a paper that is?

Thanks,
Matt

"with windows 9X in mind but not limited to"-qoute from the article/tutorial
not sure, i have Windows ME/Mandrake Linux 8.1.....mmm duel boot goodness!
anyway, it should, windows XP doesnt really differ from any other versions[atleast not anything REALY note-able...but dont blame me if it doesnt work...hehe]...you also could try the
"Updated" version that Noodle posted above...Meh.

I know that when a file is deleted... it isn't really deleted, rather the pointer to that file is just removed. In order to "delete" it, it must be written over several times.

However, I was thinking...

Does it work the same way when you cut a file and move it to a different filesystem/partition.

Example:

I "cut" a file from a NTFS partition on XP and paste to a ext3 partition via samba on a linux share.

Does that delete the file, or just remove the pointer?
Knowing the other way it works, I think* that it'll just remove the pointer and mark it as free space so the OS can write data to those sectors again.

Should one just copy the and then use a utility to overwrite it several times?

Another thing I was wondering... If you use an unerase program and find files that can be recovered, can you destroy those files from there?

Better worded: Are there utilities that search the drive for recoverable files and give you the option to write over that space with random data several times so they would be no longer recoverable? Overwrite the free white space.

Sorry for so many questions at once. I was just thinking about it before I passed out last night.

After reading this thread I researched it. I found it is not in I.E.6 or XP. Cannot remember at this point where I saw it, but I only take information from reliable sources, so rest assured XP and IE6 users don't worry.

Phish, I think it is the same for any file system, doing cuts/deletes/etc. I just had an A+ class a few months ago and when a file is deleted, as you said, the pointer is deleted. Which is the same as when you "cut" or "move" a file. It is first copied to the other drive (or network computer drive), then it is deleted from the local machine. It's kind of really copy/delete all put into one. It's really interesting if you break it down.

I'm sorry I'm not the best at explaining it. But I would get ahold of an A+ certification book if you want the real/technical answer to the question

Yeah what AciDriveHB is saying is correct. When a person deletes a file they deletes the pointer and the file will not show up under windows. However, The file can still be accesed but only through DOS. This is how a lot people who think that they have deleted everything get put in Jail. There are several programs out there that can recover deleted data, and can also delete data for you.

ONe program for deleting the data on a HD goes over the disks as many times a s you specify making characters over all data on the first pass then doing the same process over again. which therefore makes the file unreadable.

can i see tha files from linux?

Plus to add, I've seen the "recovery" programs for DOS and all the files actually have a ? character as the first character of their extention. Like if you deleted a word document (*.doc) using a recovery program it would have a file name of *.?oc.

I just thought about it and thought I would throw that in also. Don't know how Linux does it though without having extentions. That would be interesting to figure out.