Sandboxie/Eraser test with Recuva

Discussion in 'privacy problems' started by caspian, Oct 20, 2010.

Thread Status:
Not open for further replies.
  1. caspian

    caspian Registered Member

    Joined:
    Jun 17, 2007
    Posts:
    2,301
    Location:
    Oz
    Inspired by a post from the amazing Clone Ranger (https://www.wilderssecurity.com/showthread.php?t=283335), I decided to test Sandboxie configured with Eraser to see if it actually wiped all of the web surfing remnents. And guess what? It did not.

    I have not tried it with Directory Snoop yet, but I did try it with Recuva.

    The first thing that I did was wipe my hard drive. I then ran Recuva and enabled deep scan. I scanned for images just to verify that there were none there.....at least none that were dectectable by Recuva. None were present.

    I opened my sandboxed web browser, Firefox, and went to Google images. I searched for John Lennon, Frank Zappa, Marilyn Manson, and Sponge Bob. I then closed Sandboxie and deleted the sandbox. I have Sandboxie configured with Eraser and I see the red X in the system tray when I delete the sandbox while Eraser performs its wiping function.

    I then ran Recuva and enabled deep scan, (which takes a long time with a 650 G hard drive that is empty), and the results? Every single image that I searched for was there, plus a whole bunch of images that I did not remember seeing.

    I guess I have misunderstood what Eraser actually wipes when the sandbox is deleted. I was under the impression that it wiped everything. So exactly what does eraser wipe when the sandbox is deleted?
     
  2. caspian

    caspian Registered Member

    Joined:
    Jun 17, 2007
    Posts:
    2,301
    Location:
    Oz
    I'm surprised no one is interested in this. Can anyone here tell exactly what it is that Eraser does wipe in Sandboxie? Does anyone know?

    I am doing similar experiments with Returnil.
     
  3. Scoobs72

    Scoobs72 Registered Member

    Joined:
    Jul 16, 2007
    Posts:
    1,108
    Location:
    Sofa (left side)
    I think people are probably interested but there's not much you can really say about this. Eraser is meant to delete all traces but your test is showing that it isn't for you, on your PC.

    When you say that every image was there after you ran Recuva, do you mean the file name was there or did you actually recover them and open up the images? If you can open up the actual images then I suspect either a bad configuration or some sort of conflict on your PC. I trust you are using Eraser 5 and not one of the later versions?

    If Eraser didn't do what it claims to do then, for such an old and widely used application, you are unlikely to have suddenly stumbled across a major flaw in the program. So look locally on your PC for the answer.
     
  4. caspian

    caspian Registered Member

    Joined:
    Jun 17, 2007
    Posts:
    2,301
    Location:
    Oz
    I could visually see and completely recover every image. And I performed this experiment on both my Vista 64 bit and my XP computer.

    The version of Eraser that I am using is 5.86. To configure Sandboxie with Eraser, I went to Sandboxie settings, delete, command, and then I chose Eraser. I browsed to the Eraser folder and this is what I have:

    "C:\Program Files\Eraser\Eraserl.exe" -folder "%SANDBOX%" -subfolders -method DoD_E -resultsonerror -queue

    1.jpg

    Before I performed this experiment, I wiped my hard drive and ran Recuva deep scan just to verify that there were no images present. There was not so much as an icon. Not one image was visible from the scan.

    I did not recover any of the images that I searched for. I only viewed them from within the sandboxed browser. I then deleted the sandbox. I assume that I did this correctly. I opened up Sandboxie Control, Sandbox, Default box, delete contents, and then delete sandbox

    3.jpg

    And this is the icon in my system tray.

    2.jpg
     
  5. Scoobs72

    Scoobs72 Registered Member

    Joined:
    Jul 16, 2007
    Posts:
    1,108
    Location:
    Sofa (left side)
    Eraserl.exe is normally in the System32 folder, not in Program Files. Double check the location of yours. If it's not in Program Files then there's you answer.
     
  6. caspian

    caspian Registered Member

    Joined:
    Jun 17, 2007
    Posts:
    2,301
    Location:
    Oz
    I am embarrassed to say that I do ot even understand what a system 32 folder is for. And the screeshot in the above post is from a computer that I did not use in my experiment. I was wiping that computer for my next Returnil test.

    However, here is a screenshot of Eraser on the computer that I used to test Sandboxie.. Please tell me if this looks correct.

    1.jpg
     
  7. Scoobs72

    Scoobs72 Registered Member

    Joined:
    Jul 16, 2007
    Posts:
    1,108
    Location:
    Sofa (left side)
    Yes, Eraserl.exe is in the right place, but make sure your Sandboxie config (Sandboxie settings, delete, command) is pointing to the correct location. .
     
  8. caspian

    caspian Registered Member

    Joined:
    Jun 17, 2007
    Posts:
    2,301
    Location:
    Oz
    That is how I foundn the location. I went to Sandboxie settings and clicked on the Eraser-5 button to make that folder pop up. I would not know how to find it any other way.

    I just don't think that Eraser wipes images.
     
  9. CloneRanger

    CloneRanger Registered Member

    Joined:
    Jan 4, 2006
    Posts:
    4,833
    @ caspian

    Thanks for your Very kind words :) don't know about amazing though, maybe crazy sometimes ;) lots more people on here are more skilled than i am :thumb:

    Don't be embarrassed to make mistakes etc, i have & still do :(

    I'm looking forward to hearing more about your tests with SB & RVS :)
     
  10. caspian

    caspian Registered Member

    Joined:
    Jun 17, 2007
    Posts:
    2,301
    Location:
    Oz
    I have given up on Sandboxie. I have done several test on 3 computers now and it has failed them all as far as pictures are concerned. I think maybe it just wipes dat files or something. Returnil has also failed. I am really disappointed. I guess there are no products that you can count on to securely wipe *all* data automatically.
     
  11. pegr

    pegr Registered Member

    Joined:
    Apr 8, 2008
    Posts:
    2,279
    Location:
    UK
    I don't have time to try this myself but I did consider one possibility. Is Firefox set to clear all history on exit?

    If so, I wonder if the files are being marked as logically deleted within the Windows file system before Eraser has had a chance to overwrite them. In order to test whether this might be the case, make sure the option within Firefox to clear history on exit is disabled before performing the test to see if it makes any difference.
     
  12. uptonlark

    uptonlark Registered Member

    Joined:
    Oct 22, 2010
    Posts:
    1
    Hi Caspian,

    You have stumbled across some interesting problems with Eraser and Returnil. I will follow the thread with interest.

    Would you possibly have the time to test the Wondershare Time Freeze. Just curious as to whether the same scenario applies there also.
    Thanks
     
  13. Scoobs72

    Scoobs72 Registered Member

    Joined:
    Jul 16, 2007
    Posts:
    1,108
    Location:
    Sofa (left side)
    It's not Sandboxie that deletes the files, it's Eraser. Personally I don't user Eraser, I use SDelete (the 2nd secure delete option in Sandboxie), which has never let me down. I really think you should look for a problem local to your computer before you start claiming a product which a large number of people use is fatally flawed. If it was fatally flawed then smarter people than you or I would have discovered that long long ago.
     
  14. hugsy

    hugsy Registered Member

    Joined:
    May 22, 2010
    Posts:
    167
    Perhaps you could try to wipe sandbox folder with eraserl manually and not with sandbox settings. I guess that would work.
     
  15. Scoobs72

    Scoobs72 Registered Member

    Joined:
    Jul 16, 2007
    Posts:
    1,108
    Location:
    Sofa (left side)
    Hmmm...time to partially eat my words.... I've run some tests with both Eraser 5.8 and SDelete 1.51 (both on default Sandboxie settings) and had strange results.

    On first run of Recuva both applications are failing to delete 100% of the images. Both are deleting about 90%. Of the ones that are missed Eraser appears to completely fail to delete the image, SDelete is doing a partial delete (the image is corrupted). Eraser is failing to delete most of the file names; SDelete is deleting most (of the file names) but not all.

    However, running Recuva again several minutes later fails to recover anything. I cannot explain this.

    I'm going to run some more tests later when I get a chance.
     
  16. CloneRanger

    CloneRanger Registered Member

    Joined:
    Jan 4, 2006
    Posts:
    4,833
    Following all this with great interest, keep it up guys :thumb:
     
  17. caspian

    caspian Registered Member

    Joined:
    Jun 17, 2007
    Posts:
    2,301
    Location:
    Oz
    That is a good point. Because I do have Firefox set to delete everything on exit. I will try unchecking that option to see if it makes a difference.
     
  18. caspian

    caspian Registered Member

    Joined:
    Jun 17, 2007
    Posts:
    2,301
    Location:
    Oz
    Yeah my tests with Recuva have never shown 100% of the images, as far as I know, but I had always assumed that it wiped every single image, dat file or whatever.

    I am trying another software that wipes all traces in real time....kind of a "wipe as you go"....and so far it is wiping all of the browsing images. But I don't want to get too excited yet until I try it a few more times with some heavier gifs and images. But so far it is working.
     
  19. caspian

    caspian Registered Member

    Joined:
    Jun 17, 2007
    Posts:
    2,301
    Location:
    Oz
    Do you know which folder to wipe and how to find i? Do you think that it would directly locate the deleted images that are saved on the hard drive?
     
  20. Scoobs72

    Scoobs72 Registered Member

    Joined:
    Jul 16, 2007
    Posts:
    1,108
    Location:
    Sofa (left side)
    Look under C: root. You can't miss it.
     
  21. Scoobs72

    Scoobs72 Registered Member

    Joined:
    Jul 16, 2007
    Posts:
    1,108
    Location:
    Sofa (left side)
    Results with CCleaner (secure delete method) are no better. 3 images from 11 recoverable after running a delete. Even after reboot and running Recuva again they are still recoverable. A dismal failure for CCleaner.

    All this testing is taking place on a clean Win XP VM.
     
  22. tobacco

    tobacco Frequent Poster

    Joined:
    Nov 7, 2005
    Posts:
    1,497
    Location:
    British Columbia
    Can you test File Shredder - http://www.fileshredder.org/ o_O

    It has passed my tests - only thing i don't like is it leaves the file size.

    BTY, Eraser on my system(vista32) has always been buggy. Just ran some tests with Recuva and Eraser didn't work properly again - "completed but with errors" Same old, Same old! :rolleyes:
     
  23. Scoobs72

    Scoobs72 Registered Member

    Joined:
    Jul 16, 2007
    Posts:
    1,108
    Location:
    Sofa (left side)
    Several reboots later and Recuva is picking up nothing recoverable that was deleted by Eraser, SDelete or CCleaner. I also tested with East-tec Eraser (aka Cyberscrub) and the images were gone immediately - no recovery possible.

    From what I have seen however there is no doubt that Eraser, SDelete and CCleaner are failing to wipe all the files from the Sandboxie folder. Why 90%+ are getting wiped but the odd one is falling through the gaps is unclear.

    Edit: I forgot to add, a direct wipe of the Sandbox folder using Eraser (right click context menu) does appear to wipe all the images, but leaves the file names intact. After a reboot there is no trace of the file names.
     
  24. Scoobs72

    Scoobs72 Registered Member

    Joined:
    Jul 16, 2007
    Posts:
    1,108
    Location:
    Sofa (left side)
    A direct wipe of the directory using Fileshredder was successful, although it failed to wipe the file name on one image. Nothing was recoverable however.
     
  25. SafetyFirst

    SafetyFirst Registered Member

    Joined:
    Jan 26, 2007
    Posts:
    462
    I have Sandboxie configured to invoke Eraser to wipe the sandbox when the last sandboxed program is closed. I have never checked if everything is erased properly though. Just in case, before shutting down my PC I run R-Wipe&Clean.
    Yes, this should be the right location.
     

    Attached Files:

Thread Status:
Not open for further replies.