Problem deleating things on hard drive

[AnthonyG]

last week i was having some problems with my machine so i needed to take it to PC world to be analysed and repaired.

However as i browse and download a lot of pornography i thought it was best i would save it to CD and deleate it all from my hard drive before i took it into the shop. (i had quite a bit on there originally consisting of movie files i had downloaded from three sites im a member. I definitely deleated it all and emptied the recycle bin.

However after i went to get the machine back the technician chose to bring up the fact that i had far too much adult material on my hard dive and that would be what had caused the problem in the first place (they tried to claim going to reputable pornography sites and downloading the mpegs there would cause damage to my machine).

However as i had deleated it all i said there is no pornography on the machine what so ever but he said there was. And i was with my girlfriend at the time so it was very humiliating in the extreme!.

So can i ask how did they know i had pornographic mpegs/windows media files on my machine if i had deleated them all. They said they were all still there on my machine but that is untrue as i emptied my recycle bin. But if he knew about them they must have still been there somehow or else how would he have known. So can i ask if there were still there what can i do to make sure they are gone next time as i definitley do not want a reocurrence the next time i get my machine repaired (you would think pc world would have been a bit more descrete considering i wasnt by myself).

Thanks
Anthony

Originally Posted by Anthony1uk

.....reputable pornography sites ....

Now theres a contradiction in terms!!!!

You may have deleted it but it is still on your HDD.

Google for and d/l Eraser, then next time you can overwrite it all.

Bet your girl friend was happy.

[gerardwil]

Anthony,

If you delete a file you only delete a small piece of information where the files are located. The file itself is still there. So you have to overwrite the file itself to make sure it's gone. Hope this helps.

Gerard

[AnthonyG]

Are there any good programs (hopefull free) that you would recommend that will definitely get rid of it all to a high standard.

Thanks

[BlueZannetti]

I'll tackle this since it's really a very general issue, regardless of content, so we'll just skip that aspect.

There are lots of places where things will either still appear or leave telltale traces. This includes:

• Pertinent MRU (most recently used) lists associated with an application or simply the Recent Documents folder.
• Temporary Internet Files and Temp folders under the Local Settings folder associated with a given logon user (hidden by default)
• Recycle bin if it has not been emptied
• Stored cookies indicating the site visited
• Browser history list
• Download manager history

This is just a first-pass list. I'm sure others can add additional locations. I would guess that one or a couple of the standard "privacy" applications would
work. I use WindowWasher, not sure if it is comprehensive enough for your objective.

Blue

Originally Posted by wellwell

Now theres a contradiction in terms!!!!

You may have deleted it but it is still on your HDD.

Google for and d/l Eraser, then next time you can overwrite it all.

Bet your girl friend was happy.

Enough with the cheezy moralizing. The guy asked a reasonable question. Anthony, if you deleted it all and emptied your recycle bin then I would be back to PC World tomorrow asking tough questions. After castigating them for talking about the porn in front of a woman, ask how and where they found all this porn. Possibly, they found only references in the index.dat file which you should begin cleaning. But, as the moralizer said, they can still recover things even if it was deleted. But why? Why would they have been doing what amounts to forensics on your computer? I'd have questions for PC World and don't hesitate telling them that their diagnosis, in front of a lady, was in poor taste and not appreciated.

[nick s]

Hi Anthony1uk,

I've been using Restoration for a few years. You can use it to both view/restore or wipe the remnants of deleted files.

Nick

[zarzenz]

This is a good reminder to all those folks that think that by hitting the delete key and doing an empty of the recycle bin, they have then removed the files from the hard drive.

No... magnetics don't work that easy.

To be honest... a few years ago I actually thought the same, whilst I was learning about all this computer stuff, and one day, I bought a PC magazine and on the cover was a CD full of free programs. One of these was a program that could recover deleted files from a hard drive, providing that part of the drive had not been over-written. I was doubtful this was possible, believing that delete meant delete.

Wow... what an eye opener was in store for me.

I ran it out of interest, and found hundreds of recovered files... all perfect and ready to be used again. What an amazing day that was for me... a real turning point in my understanding of what a hard drive actually does.

I then found out how the delete process we use simply marks that part of the drive as available for use once again, and how more sophisticated programs can even recover files that have been over-written, possibly by agencies that need to do this for national security or likewise purposes.

Then I found out about how drives must be over-written maybe hundreds of times to be made fully un-recoverable.

But the point about all this and PC World is this. Does this company now have a policy to run this software on all computers it gets in for repair.

There was a case over here a few years ago about a well known 70's pop star that took his computer to, I believe, this same company, and was then taken to court for all the child porn that was found on his drive. Now he may not even have deleted it... but I now wonder if this has become the policy of PC World to try and discover child porn etc, in the name of duty to society.

Very interesting all this, and has raised some important questions.

[Bubba]

Even after emptying Recycle bin....the files are still there.

"When a file is actually deleted by EMPTYING the Recycle Bin, the File Allocation Table replaces the first character of the file name with a (?) character indicating that this space is now available; however, the file still remains on the drive until it is overwritten by another file."

Are Deleted Files Completely Erased?

Everybody keeps talking about how after deleting the Recycle Bin that the files are still there. The point is, this guy took his PC into a computer shop and they supposedly found all these deleted photos. YES, you can recover deleted files - but WHY was this shop doing what amounts to forensics on this guy's computer? I would be asking lots of questions!

[gerardwil]

Originally Posted by securenhappy

Everybody keeps talking about how after deleting the Recycle Bin that the files are still there. The point is, this guy took his PC into a computer shop and they supposedly found all these deleted photos. YES, you can recover deleted files - but WHY was this shop doing what amounts to forensics on this guy's computer? I would be asking lots of questions!

Those answers you will never get on this forum

[Bubba]

Originally Posted by securenhappy

The point is, this guy took his PC into a computer shop and they supposedly found all these deleted photos.

Actually....the thread topic is what Anthony posted about. If however....Anthony wishes to discuss the point you have raised....no harm....but right now the thread topic is....Problem deleting things on hard drive

Originally Posted by gerardwil

Those answers you will never get on this forum

Sure you can....all one has to do is start a thread in the proper forum and it can be discussed. There have been topics of discussion much deeper than this at Wilders

It IS what he posted about. He needs to know that a shop couldn't get at what he deleted and emptied without doing FILE RECOVERY. Just saying they CAN do that doesn't give him answers. It isn't like these were left on his drive with easy access. Again, they had to really WORK to find them. It IS ON TOPIC.

[bigbuck]

Maybe it's how this got on your machine?

[Bubba]

Originally Posted by secureuser

It IS ON TOPIC.

lol....putting it in capitals does not make things so....but if it makes your day....go for it

I'll simply refer you to Anthony's last paragraph....where the question portion of his thread starts IMO.

So can i ask how did they know i had pornographic mpegs/windows media files on my machine if i had deleated them all. They said they were all still there on my machine but that is untrue as i emptied my recycle bin.

[bigbuck]

Here's a little question that's 'sort of' on topic;
I have a little tweak which adds 'copy to' and 'move to folder' on my right-click menu. I have occasionally 'moved' files to my USB stick to take to work. Is there a residue (or copy) of these left behind? I use it to 'move' photos from my dig camera to my hard drive and it clears all photos from my camera!
Edit: I could 'move' a pile of files to my CD drive and they did not go through the recycle bin?

[bigbuck]

Originally Posted by bigbuck

Here's a little question that's 'sort of' on topic;
I have a little tweak which adds 'copy to' and 'move to folder' on my right-click menu. I have occasionally 'moved' files to my USB stick to take to work. Is there a residue (or copy) of these left behind? I use it to 'move' photos from my dig camera to my hard drive and it clears all photos from my camera!
Edit: I could 'move' a pile of files to my CD drive and they did not go through the recycle bin?

I'm really quite keen to see if someone has an answer to this one. The files aren't deleted....they are 'moved'....

Originally Posted by Bubba

lol....putting it in capitals does not make things so....but if it makes your day....go for it

I'll simply refer you to Anthony's last paragraph....where the question portion of his thread starts IMO.

You are a rude man Bubba. How can you treat guests that way and stay a moderator? I was just trying to explain why I thought it was on topic. I am also sad that a mod at Wilders wouldn't see a computer shop finding things through forensics, a gross invasion of privacy, worth mentioning to this chap in a thread where he is asking how they found this stuff.

[Bubba]

Originally Posted by securenhappy

You are a rude man Bubba. How can you treat guests that way and stay a moderator? I was just trying to explain why I thought it was on topic. I am also sad that a mod at Wilders wouldn't see a computer shop finding things through forensics, a gross invasion of privacy, worth mentioning to this chap in a thread where he is asking how they found this stuff.

First and foremost....if by my posts you felt I was rude....I will appologize....but whether it's a guest sign-in or member....it's no matter to me....it's simply an individual that either wishes not to register or a member that wishes not to sign in.

We can ramble on all day if you wish about what you feel the topic should be....but I'll leave that with you and the other members.

I am also sad that a mod at Wilders wouldn't see a computer shop finding things through forensics, a gross invasion of privacy, worth mentioning to this chap in a thread where he is asking how they found this stuff.

You can assume that all you want....I posted above about "the files are still there". At that point....that was probably going to be the last involvement I had with this thread until I felt the need to respond to one of your posts...."Everybody keeps talking about how after deleting the Recycle Bin that the files are still there. The point is"

In any case....I'll repeat what I said earlier...."First and foremost....if by my posts you felt I was rude....I will appologize"

[BlueZannetti]

Originally Posted by securenhappy

I am also sad that a mod at Wilders wouldn't see a computer shop finding things through forensics, a gross invasion of privacy, worth mentioning to this chap in a thread where he is asking how they found this stuff.

We know some things for sure here, and are missing a whole lot more. At this point I wouldn't assume that these chaps did any forensic work. There's plenty of opportunity for files to being available without even starting down that route.

Lots and lots of stuff can exist in various temp folders, just waiting for someone to take a peek. Emptying the recycle bin is only the first step even if you're not about to go to the next level.

The only thing that is obvious to me at this point is that the store technician in this case is socially inept to say the least.

Blue

[bigbuck]

Hey Guys,
Any chance of an answer to #16-#17? Please!

[nick s]

Originally Posted by bigbuck

Hey Guys,
Any chance of an answer to #16-#17? Please!

Hi bigbuck,

I have noticed the same thing with cut/paste as well. The files show up when I scan with Restoration. I have not tried restoring them.

Nick

[BlueZannetti]

Originally Posted by bigbuck

Hey Guys,
Any chance of an answer to #16-#17? Please!

I'll take a stab bigbuck.

When a file goes to the recyle bin, it's associated with that folder as an identified file, you just won't see it unless you peek into that bin. The important thing is the disk space isn't released for use while the file is there. When you empty the recycle bin, the clusters that the files occupy are now marked as released (i.e. these clusters are now available for something to overwrite that space), but if nothing overwrites those clusters, the file is basically still intact and is readily recoverable. It's not until an overwrite occurs that recovery difficulties start to arise (and even then, the information is recoverable to some degree).

If I recall correctly, a move is basically a copy then delete, but skip the recycle bin - so the file is still recoverable until those clusters are actively overwritten (and even then the additional qualifiers above that if someone really really wants to recover it, that may be possible).

Blue

[bigbuck]

Thanks Blue! I'd guessed as much.
Cheers,
Brad.

[Alec]

Originally Posted by bigbuck

Hey Guys,
Any chance of an answer to #16-#17? Please!

Yep, a move can be thought of as just a copy and delete. It will leave the file largely intact on the harddrive as well. A situation that is even worse, that most people don't think about, is when you actively attempt to encrypt a file with EFS. Yes, a new encrypted file will be created, but the harddrive clusters dedicated to the old, unencrypted file will remain and be marked as available for reuse; so the info is basically still around until those disk clusters get reused. Also, as someone else noted, sophisticated tools can detect prior data even after the harddrive clusters have been overwritten once or twice. But, then, from what I understand you are talking pretty serious harddrive forensic tools as opposed to just simple file undelete utilities. If you want to make sure a file is deleted and/or "free" harddrive space is truly cleared then you need a tool like Sysinternals' SDelete. There are plenty of other similar utilities to be found, I just happen to really trust the Sysinternals guys and I usually like their simple, direct approach to utility programs.