Augeas

How can you put forward an article entitled 'Single drive wipe protects data' as evidence that it wont? How can you say that newer technology would make the job even easier when Gutmann says that 'Any modern drive will most likely be a hopeless task'? How would your 'good intelligence or recovery professional' even start to recover overwritten data? Why do you say that CC's overwrite 'achieves next to no security' when recovery professionals say that recovery can't be done?

And here's the full quote: Wright did find that multiple passes do make it harder to recover data and that data written to a pristine drive is much easier to recover. Yet, in the most common case, where the drive has been used and written to multiple times, a user can be assured of their privacy by a single pass. "In many instances, using a MFM (magnetic force microscope) to determine the prior value written to the hard drive was less successful than a simple coin toss." I'm bemused. I would have used the article in John's link (which is titled 'Single drive wipe protects data, research finds'), and the two links that article refers to, as an indication that data overwritten once cannot be recovered by any means. To quote guru Gutmann, from a link in John's article, 'On using a Magnetic Force Microscope to recover data from offtrack writes,' 'Any modern drive will most likely be a hopeless task, what with ultra-high densities and use of perpendicular recording I don't see how MFM would even get a usable image, and then the use of EPRML will mean that even if you could magically transfer some sort of image into a file, the ability to decode that to recover the original data would be quite challenging. OTOH if you're going to use the mid-90s technology that I talked about, low-density MFM or (1,7) RLL, you could do it with the right equipment, but why bother? Others have already done it, and even if you reproduced it, you'd just have done something with technology that hasn't been used for ten years.' The point stands. Provide any evidence that any data has ever been recovered after being overwritten once, or any company that purports to do this. Although Gutmann says that it has been done on old technology, he cites no examples of it being done for more than a few bits. Where's the oft-quoted missing gaps on the Nixon tapes, technology that's older than Methusela?

If you deleted your files/folders to the recycler and then emptied that, the files will be renamed in XP and Vista. Apart from that just running stuff on your pc can overwrite file entries in the MFT very quickly (a simple prefetch file, for instance), but I wouldn't expect that to happen to all files. I would sort the Recuva output by size or date last modified order, in an attempt to locate them. Recover any suspects to a flash drive before looking at them.

I made that statement, John. Funnily enough the DoD did check their research, and no version of the manual since 1997 specifies any method of data sanitisation, as they call it. The responsibility for this lies with the Cognizant Security Authority: one of these, The Defense Security Service, provides a Clearing and Sanitization Matrix which does specify methods. In the June 2007 edition of the DSS C&SM (phew!) overwriting is no longer acceptable for sanitisation of magnetic media; only degaussing or physical destruction is acceptable. A problem with disk-wiping is that it can't clean hard drives that have physically failed, presumably why degaussing or physical destruction is specified. Furthermore in late 2004 the U.S. National Security Agency (NSA Advisory LAA-006-2004) found that a single 'DoD' overwrite instead of the three passes is sufficient to render electronic files unrecoverable. There is no way on God's earth that a hypothesis is true because an authority, no matter how high, guards against it. It must be proven, and nobody can prove or show that overwritten data can be recovered. It can however be shown that it is not physically possible to read any magnetic track 'overlays', and if it were it is statistically impossible to recover a single error-free byte.

Well, if you agree with the statement that one overwrite makes the previously written data unrecoverable, then any more than one would be superfluous. I guess the DOD etc are just super cautious, or perhaps Mr Gutmann was on board as an advisor.

After slumping in front of a Top Gear rerun (the Vietnamese trip - excellent) thers's not much wit and wisdom left now. The link you posted has nothing to do with whether you can recover overwritten data, but appears to be some misuse or malfunction of Eraser. Indeed the last but one post indicates that overwriting data (by using any method) makes it unrecoverable. One overwrite of data makes that data unrecoverable. That's all there is to it.

If we concentrate on just one aspect, where is the evidence that any data has ever been recovered after being overwritten? One wipe will do. PS Off to the pub now. Expect wit and wisdom when I return.

That article discusses shortcomings in the disk wiper's ability to access every area of the disk (bad sectors etc), the bios not reporting the full size of the disk, and problems with raid configurations. I don't think there's much doubt that, with the right tools and a little work, fragments of data can be retrieved from otherwise inaccessible areas on a disk that the user thought secure. There is a quote somewhere to the effect of "The pagefile is the policeman's friend." However there is no evidence or example of any data - barring a few isolated bits - being recovered after it has been overwritten by anyone anywhere. I don't how CC's free space wipe works, and I don't think think that Piriform would claim that it is a forensic standard wiper. Still, the option appears to be quite popular.

Please quote where. A quick flick on Google with 'recover overwritten data' shows nobody is offering this service. To quote one hit, from Sean Barry (Ontrack's Remote Data Recovery Manager), ?There is no chance of recovery with overwritten clusters. The bit density on hard disk drives is so great now that when the magnetics are rewritten, the data is gone." Ontrack.com claims to be the world leader in data recovery.

Just out of interest, how would any recovery professional 'unencrypt' overwritten data, and who advertises that they do this? I agree that for the overwhelming majority of the human race this is a waste of time, but people love gadgets and tweaking stuff.

I think that it would need extensive code changes/addition, for what would be a rare requirement. Have a look at download.cnet.com there are a few cd/dvd recovery free applications, but I don't know how good they are.

Don't use your pc at all if you can help it, the more it's used the more likely the deleted file will be overwritten. Download Recuva on another pc and install on a flash drive (the portable version). Plug in the flash and run a Recuva scan. In Vista files that are deleted via the recycler are renamed, if only I could remember in what form. Ah, good old Google. They are renamed to $Ixxxxx.ext and $Rxxxxx.ext, the x's being randon chars and the ext being the file extension. Both files are the same name except for the I/R. You will have to guess, going on extension, size and date deleted, which is the one you want. Recover both to the flash drive. Plug the flash in the spare pc and look at the files. If you have found it, thank Recuva and do a backup next time. If not then a Recuva deep scan might do the trick, but it also might be too late.

If you mean IE Temporary Internet Files, yes. If you mean pagefile.sys, no. The Analyse step will show which files are to be 'cleaned' by deleting, according to what options have been chosen.

I don't have this file, and an initial scan on Google indicates that this is a virus. I would scan your system immediately. I don't know why CC is asking for it, but it doesn't sound healthy. I would, after you've done the scan, uninstall CC and then download from a secure site and reinstall.

Well, there's this... http://forum.worldstart.com/showthread.php?t=132746 among others. It seems to be some Norton glitch.

As far as I'm aware these file names - in whatever form - cannot be removed from the MFT. This is a function of how the file system (NTFS) works. Although they take up space, 1k each entry, it is not huge in real terms. Your 56,000 filenames will take up 56 mb of space. The file data these entries point to is available for use. If your partition has only 10 mb of free space then you have serious problems. Moving some files to a usb drive should free up enough space for you to archive data to cd/dvd. Or resize the partition if you can.

You can never delete them, they are after all deleted files. You can use Recuva to overwrite the file data (with the Secure Overwrite facility) which will make the data useless if it is recovered by any means. Recuva will not remove or overwrite the file or folder name so you will still end up with the same list whatever you do. Eventually these deleted files will be overwritten by new files, and further deleted files will appear. As long as you use your pc this cycle will never end.

Did you read what I posted? If you run the Cleaner section with default settings then you are unlikely to come to any harm. Well, you certainly won't, it's your pc that's unlikely. As for the new info, are you intending to run CC to cure the pc lockup you're experiencing? CC is unlikey to help here, as it clears out temporary/non-essential files only. Identifying lockups is an entirely different matter.

Check the file names found in the analyse step. If they are something.lnk, then they are shortcuts used in My Recent Documents and can be deleted. I have found the Cleaner section to be fairly harmless, the worst it does is lose your passwords or window sizes, and it won't do even this if you leave the default settings as they are. Don't run Registry Clean yet, if ever. In fact, look at but don't run any of the other sections yet. PS System Restore will not recover any data files in XP, just certain system files. CC won't delete any of these unless you are a psychotic user (and there are some).

If I may add that CC requests Windows to delete the index.dat files, so CC's secure deletion option does not apply. The files can subsequently be securely deleted using Recuva (except for those titchy ones in the MFT).

Perhaps that's because you're asking the wrong question. Does CCleaner permanently delete file data? Yes. Will CC remove all traces of my previous activity from the hard disk? No (with proviso below). If you are passing on your pc with the operating system still installed then I suggest that you backup what you wish and remove all your personal data without exception, including your emails. You can use CC to permanently overwrite this data. This will be a good start. You should also uninstall all applications you don't want to pass on, or will not be licenced to the new user. The free space on the drive will very likely contain deleted data that could be retrieved. You should 'clean' this free space on the drive using an application such as YoKenny suggested. These applications work by overwriting all free space. The proviso about CC is that the latest version offers a wipe free space function. However as this is unfmiliar with the majority of users I would advise using one of YK's suggested applications at the moment. I'm not sure what the problem is with using Google.

Do you have Autocomplete Form History ticked? This wipes passwords in IE. I'm not sure about Saved Form Information in Firefox as I've never tried it, but the box is unticked for me. Both these boxes are unticked by default, I believe. Are you a new CC user, or did you install on top of an older version?

Do you mean that Stage 1 says Scanning 1500 files, and Stage 2 says Analysing 500, for example? I think that's what I get but the info flashes up too fast to read. I usually cancel stage 2 and it seems to make no difference at all.

Hi Smeck, it's always good to hear a new perspective so the oldies don't get too stuck in the mud. I think that wiping a 1TB drive shows a certain amount of what can I say, well, optimism for a start. How long did CC run before throwing in the towel? I'm not sure what one would gain by running a disk free space wiper. It adds nothing to efficiency, space use or speed. It does of course overwrite old deleted data, along with apparently a huge amount of never-written-upon disk surface, but how many really want that? The gain, to remove the risk of sensitive information being - in extreme circumstances - retrieved, is hardly worth the trouble of regularly wiping the remainder of the entire disk. I think that too many people will run the free space wiper just because it's there. Thank heavens that Gutmann isn't an option. I think I'll develop an application for wiping new disks after purchase, but actually does sweet Fanny Adams. It'll sell by the thousands.

No, English with Irish roots. It's the usual problem when signing up to a BBS, what to call oneself. I just thought that Augeas was pertinent to CC, although he (or his cattle) did the dirtying, not the cleaning, so perhaps not so apposite after all. Augeas and I have the same approach to cleaning, don't do any, although for Augeas the consequence was death. Ah, Greek mythology on a Sunday morning, what better way to start the day.