Exactly what does PES 8.0 wipe?

Hello mark7,

Thank you for your investigation. I have forwarded your results to our Development Team and they will fix the problem as soon as possible.

Thank you.
--
Ilya Toytman

 

No, this is not the case, because any file that was deleted by any process other than manual erase specifically with PE (ie: potentially any number of unknown files) may be written over at any time by any other process unpredictably.

As files are being created and destroyed all the time, some of which you have no direct control over, you can't assume that a free space wipe has been done in time to prevent sensitive data being caught in a cluster tip of the new file. Leaving the cluster tips unerased is effectively playing roulette with people's security.

Most of us prefer knowing the data has been wiped, rather than 'there's a good chance it was wiped'.

Of course, this is not a new problem - I've been waiting a long time for this one to be fixed, along with other bugs. I am disappointed that people are still reporting it and the question is still being avoided.

 

Re: Exactly what does PES 8.0 wipe?-will we ever know?

Fortunately (for me) or not, I’ve been watching and testing any software that can successfully touch (and / or delete, change, etc) the MFT the ADS areas, (as well as several other areas) without totally making the pc “puke”… no luck. Which if you ask me……. Is very good. But I will say it doesn’t take much to understand one simple thing – there is a HUGE difference between FILE SYSTEM and OPERATING SYSTEM… That’s where the fence lies. It's as simple as this (and I loved the reference to the fridge) you can clean the dust and mites and dog hair off the carpet all you want - but you'll either have a bag full of evidence, or the vacuum itself as proof!

 

Re: Exactly what does PES 8.0 wipe?-will we ever know?

Have you tried Eraser or Directory Snoop? (both cleaned MFT here). Can't PM this to you if you remain a "guest" ..

 

Re: Exactly what does PES 8.0 wipe?-will we ever know?

Hmm. Well BCWipe does, Terminus does, O&O does. I used BCWipe for 3 or 4 years now, and never had my PC "puke".

Don't get me wrong, I like Acronis. I've used partition expert, and true image for quite some time. Unfortunately, Privacy Expert doesn't live up to the stellar reputation those other two products have.

I find it a little frustrating that Acronis seems either unable, or unwilling to fix the issues with MFT, ADS, and Cluster Tips (file slack). In my mind that puts PES in the snake oil category for now.

 

Re: Exactly what does PES 8.0 wipe?-will we ever know?

Hello Segovia,

Our Development Team is investigating the problem with MFT and free space deletion. We will certainly fix the issue very soon and implement the fix as soon as possible.

Thank you.
--
Ilya Toytman

 

Has there been any progress on adding this essential mfunctionality to PE ?

 

In a nutshell... NO

I performed a clean install of the latest (Sept 15) PE 8 build 788.

Cookies and Temporary Internet files names and file size MFT entries still remain after: 1) Internet Cleanup... still there... followed by... 2) a disk cleanup... still there.

The sectors have been wiped (partial credit to Acronis for at least clearing the sectors!), but entries still remain in the MFT.

As my lil' Pentium 400 is already tasked to the max, something had to go and it was PE. It just does not do the job for me (specifically, the wiping of filenames and file sizes in the MFTs).

I trust I have documented my investigations sufficiently in this thread so that someone else can pick up the torch, but as for me, I am abandoning Acronis PE in favor of other proven methods.

Good Luck

 

So what program(s) do seem to fill the bill for erasing those pesky MFTs? I would like to get something that really does clean things up....

 

Good question : any suggestions for software which does the full job ?

Also, can we hear from ACRONIS again on this issue ?

 

From Terminus' website, a comparison chart of many different file wiping utilities - Acronis PES included.

http://www.e-f-w.com/t6comparison/

(Note: I'm not trying to promote Terminus. I just thought some people might find that chart interesting.)

 

Interesting link... but keep in mind it is not up to date. For example, it only reviewed Acronis PE 2003. Also Tolvanen Eraser 5.7 (freeware) *does* erase all FAT/MFT entries on a partition, or the whole drive, for all deleted files. I noted that Eraser v5.5 was released 08-Dec-2002, why wasn't THIS version reviewed? I could not find a release date for Eraser 5.3, but it was way before 2002...

It appears to me that although *interesting* to some exent, this chart appears to be somewhat arbitrary and I would interpret its results with a large cube of salt. Since this is from Terminus, I'd be wary of any non-independent reviews...

 

Similarly this might be of interest even though it might be out of date given that it references PES 7 rather than 8

Direct link to the paper
http://www.dfrws.org/2005/proceedings/geiger_couterforensics.pdf

Other papers from the 2005 Digital Forensic Research Workshop can be found at http://www.dfrws.org/2005/proceedings/index.html

 

First link: great report!

I was able to recover internet gif's and temp IE files with earlier build of PE 8 (build 714). This has been fixed to some extent in latest build (starting with PE 8 build 734), file content and slack space is wiped, but deleted MFT filename & size entries for IE temp files remain... (edit to add build numbers for reference)

 

That was interesting reading. Thanks for the link.

 

Any idea how PE9 relates to this thread ?

 

Does anyone know exactly what does PES 9.0 wipe ?

 

Anyone got any info to contribute ?

 

Hello BROWSER,

Thank you for your interest in Acronis Internet Privacy and Antispyware Software.

Please accept my apologies for the delay with the response.

I have forwarded this question to our Development Team and let you know the answer as soon as it's provided.

Thank you.
--
Kirill Omelchenko

 

"toptenreviews" post/link removed. here you can see some of the main reasons.

 

Message for "dingebre" - I don't know how to link or cross-refer threads, but this thread seems highly relevant to your recent query

 

This was posted January 29th, 2006. Possibly Kirill you could let us know the preliminary results of the development team?

 

No response ... Humm, this is really out of character!

 

Actually 16 Jul 2005 ( Ilya Toytman) is the earliest date that the development team was forwarded the thesis of this thread. Possibly we could hear from them how it is going? Or isn't going. Thanks.