Erasing invisible files takes special tools

By FRANCIS TILL

Getting from "delete" to "erase" isn't easy.

Hitting the "delete" key removes files from ordinary view, but that is well short of getting them off your computer.

Ordinary snoops can be effectively blocked by taking a few additional precautions, but sophisticated equipment in the hands of computer forensics specialists can recover files even from computers that have been smashed, burned and subjected to magnetic fields.

The files from hundreds of computers at the bottom of the World Trade Centre rubble have been restored through complex procedures costing up to $70,000 each that are not available to the ordinary snoop - not yet, anyway.

Also, if what you wanted to remove from your computer what came in over the internet, there are probably copies of it on other machines, and there is nothing you can do about those except to use strong encryption and privacy devices.

For a start, though, use your built-in tools to put the most common forms of footprint out of view, as outlined in the main story.

If you want additional reassurance, use one of the large and growing number of "file wipe" utilities now available. These utilities work by attempting to completely cover the contents of files you want deleted with other, random, content, but it can take up to 50 passes with the utility to completely overwrite a file.

How erasing works: Why is it so difficult? Computer files are just strings of numbers, 1s and 0s, organised into patterns, that can be rendered by a computer as information.

When you delete a file, the few number sets at the beginning of a file - the "pointer" that tells the computer where and what it is - are randomised, making the file "invisible" to the operating system.

Without the protection of its pointer the computer treats a deleted file as if it were blank space, and replaces sections of the deleted file with sections of newer files until all the numbers have been "overwritten".

Overwriting occurs randomly and some files may sit on a hard drive nearly complete for years. Any part of a file not completely overwritten can be recovered, and these are your "invisible" hard drive record.

Potentially, copies of everything you've used your computer for are at least partially recoverable from this invisible library.

Two popular wipe utilities that provide protection are mcSanitizer and ShredX.

These tools, and others, can also be used to overwrite - wipe - your entire hard drive, but specialty tools, like IBAS ExpertEraser (sold on a per-use basis) are far more effective on big jobs - and something you should use if you're planning to sell your computer.

mcSanitizer

ShredX

IBAS ExpertEraser