Last year (November archive) I asked about shredding a file after deletion and promised to report back on my efforts to trace the remains of deleted and shredded files.
I installed PC Inspector File Recovery (http://www.pcinspector.de/Sites/file_recovery/info.htm?language=1 , Freeware) and Directory Snoop 5.03 (http://www.briggsoft.com/ , Free trial gives 25 trial runs). (BTW I liked both these items of software - both very easy to use.) Then I did the following: - created a text file on the C:\ drive (NTFS) filled with distinctive character strings that I didn't think would occur anywhere else on the disk; - searched the drive using Directory Snoop for the distinctive string in the test file (and surprised myself by finding several instances in unexpected places such as a Mozilla Dictionary); found the strings OK; - used a Delphi app. with the methods I inserted in my first post about shredding. The key one is: procedure OverWriteandDelete(FileName: string; N: integer); // Overwrite a file N times then delete it // File2String and String2File are taken from "ExeMod" written by G.A. Carpenter // and read/write a file into a string variable byte by byte var TempString: string; k: integer; C: char; begin TempString := File2String(FileName); // overwrite the file N times, saving to disk each time for k := 1 to N do begin C := chr(65 + random(50)); String2File(StringOfChar(C, length(TempString)), FileName); end; // empty the string in memory ZeroMemory(@TempString, SizeOf(TempString)); // delete the file from disk // this line commented out the first time through DeleteFile(FileName); end; - in fact I repeated the test, first time with the DeleteFile command (penultimate line) commented out. - searched the drive using Directory Snoop for the distinctive string in the test file and failed to find any trace of it; - searched the drive using PC Inspector File Recovery and failed to find any trace of the file itself. - repeated the whole thing on a USB key (FAT32) with the same results. So on the face of it, it seems that overwriting the file byte-by-byte then using DeleteFile to delete it will at least make it more difficult to recover data from the file. But - and this is a big but - during the course of trying all this out I realised how many variations there are, how many ways I might have missed something and how little I know about this whole business, so I cannot report back with certainty about how difficult it would be to retrieve the data if I knew what I was doing. Hence this is at best a partial report ... but time and, alas, patience have run out. Rob _______________________________________________ Delphi mailing list -> [email protected] http://lists.elists.org/cgi-bin/mailman/listinfo/delphi
