When is a file actually deleted?

[virux404]

hence the big explosion destroying the hard drive. its the only fool profe way. the only problem is explaining why you did it....


personally I like mcafee's undelete utility for undeleteing files. its alright.

and as far as being a newbie: just cuz I'm a newbie doesnt mean im ignorant, and you had better believe im not

[virux404]

hence the big explosion destroying the hard drive. its the only fool profe way. the only problem is explaining why you did it....


personally I like mcafee's undelete utility for undeleteing files. its alright.

and as far as being a newbie: just cuz I'm a newbie doesnt mean im ignorant, and you had better believe im not

[Therance]

hai jethro
how this will work? pls write briefly

[micael]

- Informational QuickErase -

In the "old days" they used to have big electromagnets and external hdd's. Incase of a unwanted visitor, they just pulled the switch.

It worked then and should probably work fine with todays hdd's aswell.

You'll not be able to use the hdd anymore and that's the sad part when dealing with electromagnet-erasing.

[Und3ertak3r]

Had a client bring in his HDD a few days ago.. problem his computer didn't boot. So on the advice of an "expert" he run scan disk.... now all he had was a hdd full of DIR0xxx folders .. yep damaged FAT.. and he let M$hit Scandisk f*** it for him. He finaly decided to bring it to me to see what I could do.. He had his business data for the last 3 years on it and had been backing up the wrong files.. his sorrow only compounded a mistake a few days earlier where he had accidently deleted an important file..

A FREEWARE proggie was thrown into action.. a couple of hours later, and with the realisation that 20% of the data on a normal FAT recovery was corrupt, and not going any deeper we had ALL of the data he was after.. all the corruption was in M$ windaz.. not his data.. now if that had failed, I had two other proggies that I could have played with..
but the pile of "red backs" would have been higher..

so if it is deleted or "written over" it isn't Gone.. 6 months ago I would have believed different.. but thanks to links from the crew here oh and Google I now KNOW different..

At the moment I believe that all data is lost when the HDD is reduced to the molecular level, certainly lost when hdd is reduced to the atomic level, and definatly lost when the HDD is reduced to the Sub-Atomic level.. But I have been proven wrong..

Cheers

[GreekGoddess]

I have used evidence eliminator in the past, it seemed as if it was working, but honestly, I don't know enough about the technology behind it to know if it really worked or not. It was pulling up stuff that I hadn't seen in ages.

What program is recommended for eliminating all of the deleted material? Has anyone ever tried EE? If so, should I be using this program or is there something better?

[T1T3SONET]

Just my two cents to the topic at hand. I haven't ever used Evidence Eliminator, so I can't speak about it. I have tested a program called Eraser that seems to do the job for you. You can find the download for it HERE along with a few others.

Hope this helps someone!

[mohaughn]

Originally posted here by dmedici

That kid a few days ago from Austria (I believe), who hacked into the Pentagon. If I were him, and I wanted to clean the evidence from my hard drive, what would I do?

Not related to deleting files at all.. But that story was totally faked. The kid did no cracking of any kind and just faked the documents. You will have to translate the original from German. I'm just going to link to the Security Network news blurb about it as they have a lot of links with good information about this.

http://www.atstake.com/security_news/

It is about the fourth blurb down.

[mohaughn]

Originally posted here by LoggOff
illv--> no, DOS only deletes the reference in the FAT. the data is still there and can easly be re constructed just by pointing to it again without overwriting the data. if its "deleted" then its like a peice of paper thats sitting in your trashcan (real trashcan, not puter one).....

Actually DOS doesn't even do that. They just replace the first character, or was it that last, with a '?'. The filesystem then knows that that sector can be used again, all an undelete does is remove the '?', which is why in older dos versions doing an undelete would cause the last character to be removed if you had already hit the file name size limit. You can actually do a delete by renaming a file xxx.xxx to ?xxx.xxx.

This worked in dos 6.1. Not sure about the versions that came with 98, etc..

[LoggOff]

hmmmm i veaguly remember seeing those ?files once or twice..... i dont remember how or anything cause it was before my geek days......