Sign in to follow this  
Followers 0
Mulligan

Erasing unused disk space, how?

8 posts in this topic

The concept doesnt make much sense to me...how is it done? How is it possible to tell the harddrive to overwrite an area where no files exist in the first place? Seems like the OS would prevent it. Thanks
0

Share this post


Link to post
Share on other sites
Your mistake is in assuming that the space is empty. When you delete a file in windows, it isn't actually gone - Windows essentially just removes the information from the file table, basically just making it so that there is no marker of where the file begins or ends. All the data will still be there until it is overwritten (and can even be recovered in that situation sometimes, although the quality will degrade with every rewrite).

To really get rid of something (without physically destroying the disk), you need to overwrite it several times with psuedorandom data (or a special pattern of data), which can be done using a program like Eraser.

I don't know of any freeware tools for recovery of deleted files, you'd probably have to pay for something if you were interested in that.

Hope that answers your question. [smile]
0

Share this post


Link to post
Share on other sites
Thanks for the reply, but I was really asking how programs like Eraser work. They have an option to "Erase Unused Disk Space". How does THAT feature work?
0

Share this post


Link to post
Share on other sites
Quote:
Original post by Mulligan
Thanks for the reply, but I was really asking how programs like Eraser work. They have an option to "Erase Unused Disk Space". How does THAT feature work?


They 'erase' the unused space (or space occupied by a file for that matter, it all works the same) by overwriting it with either pseudorandom data, or algorithmically generated data specially designed for the purpose. As a single pass doesn't completely remove the data (just as a new file being written over the top also wouldn't completely destroy underlying data), multiple passes are written in this fashion. Typically between 3 and 7 passes are used, but most programs will give the user the option to select the number of passes they wish to perform.

Because the empty space isn't in the file table, it will still show up as empty space afterwoulds, but will now contain pseudorandom data instead of the deleted data which previously exists. In the case of a file rather than empty space, a regular delete is performed before the overwrite - the effect is the same. Some programs of this type will also zero the unused space after the erasing passes, just for neatness, but this isn't required and has no real benefit.
0

Share this post


Link to post
Share on other sites
Quote:
Original post by Kazgoroth
As a single pass doesn't completely remove the data (just as a new file being written over the top also wouldn't completely destroy underlying data), multiple passes are written in this fashion.


I'm not quite sure what you mean.

Is it just that when writing a new file to the same spot, its unlikely to be the same size and take up exactly the same clusters, therefore some of the old file is still likely to be there?
0

Share this post


Link to post
Share on other sites
Singlepass overwrite is secure against any kind of softwarebased recovery of the old date. Multipass overwrite is secure even against hardware recovery (disassembling the hard drive and reading it with special hardware).
0

Share this post


Link to post
Share on other sites
Quote:
Original post by Mulligan
How is it possible to tell the harddrive to overwrite an area where no files exist in the first place? Seems like the OS would prevent it.


Then, how would you go about creating a file, if you couldn't write to "empty space"? Just because you are restricted in what you can do in user mode doesn't mean the same restrictions apply to a program run in kernel mode.
0

Share this post


Link to post
Share on other sites
Logically, if you create a single file which uses up all remaining space on the disc (partition, or whatever), it MUST use up all the space previously used by any other files that were deleted.

Therefore, if you do this, and ensure that the OS syncs the disc, deleted files can no longer be recovered.

After using up all the space, a program typically then deletes the file.

Mark
0

Share this post


Link to post
Share on other sites
There is a problem with all of this "unused space erasing":
Modern harddiscs do bad-block management. The harddisc is really a significant part bigger than the OS-usable part. Once they notice a block to become bad they move the data to a yet unused block. The data in the bad block stays there forever.
0

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now
Sign in to follow this  
Followers 0