Data Recovery News - Recovering The Deleted File
In the growing story about text messages here in the City of Detroit, there has been a lot of focus on the issue of “Deleted Files” and if deleted files can be recovered. Yesterday (April 29, 2008) we did an interview for “Ruth to the Rescue report on Local 4 News/WDIV-TV, Detroit, MI” .
Ruth Spencer is a Consumer Reporter and her story line focused on how the consumer needs to be aware that merely deleting a file from the computer does not erase the file. In her interview with Ives Potrafka, a Senior Forensic Examiner for the Center for Computer Forensics, she learned that deleted files can be recovered fairly easily if you have the correct tools. She also learned that the Data Recovery Group has an extensive business recovering lost files.
At the close of the interview Mr. Potrafka suggested that if consumers want to protect themselves from people recovering deleted files, then the consumer should research wiping utilities on the web. Ruth closed the segment with a warning to consumers that they needed to diligent when getting rid of their old computers to make sure that their sensitive information, is in fact, unrecoverable.
As a follow on, Mike Wendland, the Technology Editor for the Detroit Free Press, wrote an article today (April 30, 2008) entitled “More proof that deleting a file doesn’t kill it”
The article said, in part:
Here’s a computer secret most people don’t know: The delete key doesn’t really delete. A deleted computer file can usually be recovered, even if it seems to have been removed from your hard drive.
As the latest chapter in Detroit’s ongoing saga of the mayor and his text messages unfolds, we once again learn a valuable technology lesson: Computers seldom forget.
The latest round of messages, further illuminating Mayor Kwame Kilpatrick’s affair with then chief of staff Christine Beatty, was released Tuesday by Wayne County Circuit Judge Robert Colombo Jr.
A forensic expert recovered the document that contained the messages from the computer of Mike Stefani, the attorney for three former Detroit police officers who sued Kilpatrick.
What the article does not say is that the file was reported to have been deleted by Mike Stefani from his computer in late 2007 as part of a law suit settlement. The file was recovered in late April 2008 by a computer expert. The use of the computer for several months did not overwrite the file that was recovered.
What the consumer needs to understand is that the delete key in a Windows environment does not erase a file. In windows, deleting a file puts the file into the recycle bin. In essence all the user has done is move the file to a different folder on the hard drive and modified the file name. When you empty the recycle bin, the user has told the computer that the space is available for the computer to store another file. Given the size of hard drives today, that file may not be overwritten for a long time.
The analogy I like to use is the manual card file at the library:
- The delete key removes the index card form the catalog. The book is still on the shelf and the Librarian can put the card back in the catalog.
- Emptying the recycle bin is the Librarian throwing the card away. The book is still on the shelf and will remain there until another book needs the space.
- A wipe utility overwrites the space where the file was stored and effectively removes the file from the hard drive.
To ensure that the data has been fully erased we recommend that the data utility used overwrite the physical areas of the hard drive multiple times with varying patterns. To learn more Google “wiping utilities” or “data eraser”. I have used Webroots Window washer in the past and it seems to work fairly quickly.
Comments
Got something to say?
You must be logged in to post a comment.