Since 2000 every version of Windows uses object reuse protection. When you create a file, the space on the hard drive for that file will be zeroed out.

Another way of looking at this is when a file is created, Windows will make it impossible to see what was there before.

But what about right after you delete a file? Nothing has been written to that space yet. What is on the physical hard drive? The entire file of course. Not good if the file is highly confidential.

What if you wanted to delete a file securely?

There are plenty of tools out there that can do this, and most of them cost quite a bit of money. But there is a free alternative.

It is called SDelete and it is from Microsoft:

http://download.sysinternals.com/Files/SDelete.zip

How does it work?

Simply download the program and run it from the command line. By default it will only complete 1 pass when erasing a file. I would suggest overriding that with a higher number – the higher the better, but it will be slower.

Lets delete a file with it, using 25 passes:

sdelete.exe -p 25 FileToDelete.zip

This will securely delete FileToDelete.zip

SDelete implements the Department of Defense clearing and sanitizing standard DOD 5220.22-M. This will give you confidence that once deleted with this tool, your file is gone forever. Note that it does delete the file, but the file name is still recoverable from the file system (Make sure the file name itself does not have any revealing information).

The full list of possible commands for SDelete are:

usage: sdelete [-p passes] [-s] [-q]
sdelete [-p passes] [-z|-c] [drive letter]
-c Zero free space (good for virtual disk optimization)
-p passes Specifies number of overwrite passes (default is 1)
-q Don’t print errors (Quiet)
-s Recurse subdirectories
-z Clean free space

It supports wildcards too. So if you wanted to securely delete an entire folder you can call it like this:

C:\>sdelete c:\temp\*.*

SDelete is set for 1 pass.
c:\temp\Eula.txt…deleted.
c:\temp\Import.csv…deleted.
c:\temp\readme.txt…deleted.
c:\temp\sdelete.exe…deleted.
c:\temp\VCdControlTool.exe…deleted.
c:\temp\VCdRom.sys…deleted.

If you have files that need to remain secure, SDelete is a great way to make sure they are removed from your hard drive.

If you have not used their tools before, I highly recommend taking a stroll over to www.sysinternals.com

They have just released updates to Process Monitor, Autoruns, Disk Usage, and Process Explorer

Here are some of the highlights:

Process Monitor v2.03: This update to Process Monitor, a real-time file, registry, process and network monitor, adds the ability to import and export configuration settings, shows an icon in the operations column depicting the event class of the operation, and fixes a symbol configuration bug on Windows XP.

Autoruns v9.36: Autoruns changes the Hide Microsoft Entries to only hide Windows entries, fixes a bug in the Find behavior, allows enabling and disabling entries using the space bar, and fixes a number of minor bugs

Disk Usage v1.33: Du adds a new option, -u, that has it exclude duplicate hard-linked files from its summary.

Process Explorer v11.31: This update works around a bug in the latest Debugging Tools for Windows debug engine DLL and fixes a bug that could cause objects to show up as when Process Explorer was run without administrative rights.

My personal favorite is ProcessMonitor. It has so many uses I find myself running it at least once a week. Want to see what files a program has open? ProcessMonitor can do it. See what DLLs a program uses…again a job for ProcessMonitor. Like I said, check it out, you won’t be disappointed.

On a side note, I will be posting information soon about a beta for Remote Control 3.1 soon. Keep an eye on the blog for details