Today probably every computer user know and used to get use of a recovery software to recover deleted files and folders. Those softwares are very useful when we delete some important files let's say you have a photograph that only in your PC and you've mistakenly deleted it. So then recovery software is like came from heaven. But on the other hand think you formatted your hard disk and you sold it out. And the photograph that you're bothered should be a very private one. And the guy who got your PC recover your hard disk from the same manner that you recovered your photograph. So he got your photographs and what do you think he will gonna do with it.
The most important thing with data is private and confidential which are deserved. So when we come to the point of data confidential, data recovery becomes very critical. So let's look how to remove a file forever and ever.
First we will look how files can be recovered. Actually any data on a disk / flash drive cannot be erase like you erase pencil marks on a book. When the data have written on the disk they last forever. Then you may ask "If files cannot be deleted what are we do by deleting files?". You may know File Allocation Table (FAT). (If you want to get some idea of file allocation table and what is file system means look What are File Systems). File Allocation Table has links to data on the disk with files names , attribs ,... So when we have deleted a file , actually its deleted from this FAT table. It's remove the link to the data on the disk from the label of the file. But on the disk the real data (ones and zeros) are exist and they will remain until we over write some data on top of it. The data recovery software is doing , scan for those data on the hard disk. Some times you may have seen when we scan hard / flash drive from a recovery software some file indicate as unrecoverable. Those are files which are over written by other data. When data is over written they cannot be recoverable. There is a phrase "Data cannot be deleted but can be over written".
So now you may feel how we gonna erase a file forever. It's done by over written data on top of the data. Actually IT professionals say data should be over written at least 3 times to be unrecoverable. Here we gonna talk about some tools with different situations.
Erase a particular file forever
So firstly we will look how to delete a particular file which still exists on your file system. You may facing situations like that you've copy a file /some files to some one's pen and shared with another one which are very confidential and you cannot also do a low level format (will talk about it) coz there is no time and it's hard to backup every thing and replace them. So only option is erase your confidential files that can never recoverable way.
There is a tool to achieve this.I think most of you may know about this. It's Eraser. Using "Eraser" you can delete a file which will not able to recover again. Simply download and install it.
This is Eraser. Click on down arrow front to the Erase Schedule and click on New Task. Then it will popup for menu.
In this Task Properties you can schedule to delete files on some folder (Specially in recycle bin). Or you can select "Run Immediately". Then you can select the files you want to delete and remove them by immediately. After select that click on "Add Data'
In this menu you can Select what is the target type (a file , folder or a partition , drive or the recycle bin). After that you can see the "Erasure method". In this software there several erasure methods you can select. This erasure method is the method that the software going to over write the data. For an example there is a selection of Gutmann (35 passes). In this method it writes series of 35 patterns on top of the data. In Schneier 7 pass method it firstly writes ones on the file.and then all with zeros, and then five times in pseudo random way. So like that each method use different ways and algorithms to disappear data. I have seen most are preferred with Schneier 7 pass.Gutmann and DOD also good. Any way using this tool you can delete a particular folder forever. Actually not only a folder. it may be a partition or a external device. and also it facilitates to scheduling the erasing. You can schedule to erase the things on your recycle bin.
How to erase a folder which has been deleted
When you reading this article you may remember some files that you've moved to another disk and deleted. You may think that files could be recover which are very private for you. So how we can erase a file which has already deleted from your hard disk.
Some recovery tools has the function to make the recoverable files into unrecoverable state. It also doing the same thing , over write the data on top of the file. Usually i preferred to use Recuva for recover files. In Recuva you have this function.
This is a scan list in Recuva. Check on the file you want to make unrecoverable (can check multiple files or all files). Then right click on file / files and select "Secure Overwrite Checked". It will over write on the file and file will be unrecoverable. File becomes red which indicates unrecoverable.
How to format entire hard disk for unrecoverable.
This is very important for IT people when they have to return their laps or hard drives,flash drives to office when they are leaving. There are several tools to do this and this is called "Low Level Formatting". When we format hard disk in NTFS , FAT , EXT or any other file system format it's called "High Level Format". In low level formatting it over write data on entire drive. Then the data had in the hard disk / storage drive will be unrecoverable. Here we are going to look at Linux in-built tool dd to make a low level format.
This can be done in two ways.
- plug the hard drive to a machine which runs linux OS
- Boot the machine want to low level format using linux live cd
type this
dd if=/dev/zero of=/dev/<the location of the disk that you've note>
press enter to work it. This may take long time if your hard disk has large size. this command will write zeros (0) on your hard disk until it get the message the hard disk is full. You can make it to write random ones and zeros by type as follows
dd if=/dev/urandom of=/dev/<the location of the disk that you've note>
actually you can get every instructions if you typed dd --help
For full data erase you should do this at least 3 times. But also doing one time you make most of your files unrecoverable.
No comments:
Post a Comment