Secure Delete Free Space

Discussion in 'Other Ghost Security Software' started by Dazed_and_Confused, Sep 3, 2004.

Thread Status:
Not open for further replies.
  1. Dazed_and_Confused

    Dazed_and_Confused Registered Member

    Joined:
    Mar 4, 2004
    Posts:
    1,831
    Location:
    USA
    Tonight I did a secure delete of the free space on my hard drive. When it was nearing completion I say something strange in the progress box. The number of bytes cleaned was GREATER than the total number of free bytes. What's up with this? o_O
     

    Attached Files:

  2. Pilli

    Pilli Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    6,217
    Location:
    Hampshire UK
    Hi Daisie, This is normal, as you will also find that your restore points will also have gone.

    It is documented in the help file.

    System Restore Points
    On Windows operating systems with "Restore Points", securely cleaning free disk space may indirectly cause windows to remove your "Restore Points". This is because "Restore Points" are based on the amount of free disk space you have, and due to the way cleaning free disk space works by creating a very large file, Windows may remove your "Restore Points" to get more disk space.

    This will only occur if you clean free disk space on the drive which contains the "System Restore Points", this is typically the drive you installed Windows on. If you want to SECURELY clean free disk space on your Windows drive you will have to deal with Windows removing your "System Restore Points" as there is no current work around for this issue.
     
  3. Pilli

    Pilli Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    6,217
    Location:
    Hampshire UK
    Hi Daisie, This is normal, you will also find that your restore points have gone.

    It is documented in the help file.

    System Restore Points
    On Windows operating systems with "Restore Points", securely cleaning free disk space may indirectly cause windows to remove your "Restore Points". This is because "Restore Points" are based on the amount of free disk space you have, and due to the way cleaning free disk space works by creating a very large file, Windows may remove your "Restore Points" to get more disk space.

    This will only occur if you clean free disk space on the drive which contains the "System Restore Points", this is typically the drive you installed Windows on. If you want to SECURELY clean free disk space on your Windows drive you will have to deal with Windows removing your "System Restore Points" as there is no current work around for this issue.
     
  4. Dazed_and_Confused

    Dazed_and_Confused Registered Member

    Joined:
    Mar 4, 2004
    Posts:
    1,831
    Location:
    USA
    Thanks, Pilli. :)


    I did notice just before the CS dialog box disappeared that I received a message saying my hard drive space was running very low, which I didn't understand since I'm only using about 10% of it. o_O

    By the way, is CS supposed to give me a post operations report? After cleaning, the cleaning dialog box just disappaered. No "Completed" message, or anything telling me task was successful. :(

    Maybe an enhancement for next release. ;)
     
  5. Pilli

    Pilli Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    6,217
    Location:
    Hampshire UK
    Daisie, As far as I know when you clear free space it creates a massive file the size of your hard disk - so windows obviously pops up that you have low disk space, this is normal.
    Having a clean up report sounds like a good idea :D
     
  6. Dazed_and_Confused

    Dazed_and_Confused Registered Member

    Joined:
    Mar 4, 2004
    Posts:
    1,831
    Location:
    USA
    Thanks, Pilli. :) By the way, regarding the MASSIVE file created, any idea why this is done? Just curious. o_O
     
  7. stalker

    stalker Registered Member

    Joined:
    Jan 19, 2004
    Posts:
    152
    Location:
    Ljubljana, Slovenia

    For clearing (rewritting) HD's free space, I suggest you to try very straightforward, compact (that's why it is command-line, using only Windows APIs) application, again from Sysinternals.


    http://www.sysinternals.com


    It is called sdelete, and it's only 60 KB. It offers actually two things. Secure deleting files, as many times you want, and it rewrites file content (as "schredders" other software), as well as file name and extension (and you can nicely see/check that with Filemon GUI application, guess what, also from Sysinternals.

    Then second Contig, it is also command-line, and it offers to first analyze file-defragmentation, then allows to defragment single file (first app, I've seen to offer that), multiple files, it is directory recursive, etc, it also can make "pre-contiguous" files ("empty", defragmented files/defragmented before used, and containing any data), as far as I know with unlimited lenght.



    P.S., And for better computer performance in general, I suggest those who use NT-systems (NT4, 2k, XP, 2003-server), to try also Sysinternals's Pagedfrg, somehow GUI application, but it does the main job after booting, right after scandisk window (still in that blue Before Login screen).
    It simply defragment also files with "NT-exclusive access", like your pagefile (pagefile.sys), registry hives (System.log, Sam.log, Default.log, Security.log, Software.log) and event logs (SecEvent.evt, AppEvent.evt, SysEvent.evt)


    ___________________


    Look at screenshot of Pagedfrg below:
     

    Attached Files:

  8. Dazed_and_Confused

    Dazed_and_Confused Registered Member

    Joined:
    Mar 4, 2004
    Posts:
    1,831
    Location:
    USA
    Thanks, Stalker. :) I use their Process Explorer and RegMon. I'll give these others a try.
     
  9. Dazed_and_Confused

    Dazed_and_Confused Registered Member

    Joined:
    Mar 4, 2004
    Posts:
    1,831
    Location:
    USA
    Nice little appy, stalker. :) But believe it or not, none of my files were fragmented (just as shown in your pic). Strange...
     
  10. Jason_R0

    Jason_R0 Developer

    Joined:
    Feb 16, 2005
    Posts:
    1,038
    Location:
    Australia
    Well CryptoSuite already has a secure delete utility (and one pass of CryptoSuite's secure delete algorithm is better than the one used in sdelete). Not to mention most people find it hard to use command-line tools compared to a GUI version. So I don't really see the point of your post recommending a less secure and harder to use product.

    If you want to post in this forum in the future with recommendations then please make sure you not only understand the product you are talking about, but CryptoSuite also. :)
     
  11. Jason_R0

    Jason_R0 Developer

    Joined:
    Feb 16, 2005
    Posts:
    1,038
    Location:
    Australia
    All this means is that when the process began there was LESS free space than at the end. This is most likely due to what Pilli said, Windows removing files which aren't that important to the system to try and free up space on your hard drive.

    The next version of CryptoSuite has an improved secure delete, mostly in the GUI to show more information.
     
  12. Dazed_and_Confused

    Dazed_and_Confused Registered Member

    Joined:
    Mar 4, 2004
    Posts:
    1,831
    Location:
    USA
    Thanks a bunch, Jason. :)


    I'm sticking with Cryptosuite's secure delete. As you stated, it's much easier to use than command lines (at least for little old me). ;)
     
  13. stalker

    stalker Registered Member

    Joined:
    Jan 19, 2004
    Posts:
    152
    Location:
    Ljubljana, Slovenia


    Yeah, this is quite normal for nowadays computers. Because you probably have enough RAM installed, and Event logs are only max 128 KB by default, and also with right settings, your pagefile doesn't get filled often (or at all, like in my case most of the time)


    For example, settings like:

    1. ConservativeSwapfileUsage=1 in System.ini on 95/98/98SE, dunno for ME

    2. and registry settings on 2k/XP/2003, like "DisablePagingExecutive" dword registry entry, under Memory Management, with value 1 (keeps OS and kernel in RAM, mostly till it's full, and then pages to pagefile, though on NT there is always also other paging going on), probably "LargeSystemCache" and those 1, 2, 3 values under lanmanserver\parameters (all three beeing well-known "tweaks")

    Code:
    Windows Registry Editor Version 5.00
    
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory]
    "DisablePagingExecutive"=dword:00000001
    

    But in some cases (some strange resource-consuming situation, long session, etc.), then it can fill and therefore could get fragmented.

    So, I check occasionally, the "situation", and sometimes few are "splited" on two fragments.


    HTH
     
    Last edited: Sep 7, 2004
  14. stalker

    stalker Registered Member

    Joined:
    Jan 19, 2004
    Posts:
    152
    Location:
    Ljubljana, Slovenia


    Sorry, Jason, belive me or not, but I actually didn't realize it till now (1-2 minutes ago) that it is CryptoSuite related topic, in DiamondCS part of forums and not some part related to computing or security in general.


    The thing is that, I was browsing few forums at the same time, reading topics, replying, copying posts in my "collection", etc., and cause the topic was deleting free space, I assumed, I am in some general topic, and I actually thought today (when searching for this particular post, first in my .doc collection), that I posted it on Winforums, or Computercops, and not on Wilderssecurity, as I did.


    I see now, and I promise will look better next time, where I post. I must confess, it already happened once, when I was writing/posting to fast, that I totaly miss the whole thing (not only software-forum, but also topic), and what a "bad luck" - that forum didn't have "delete post" option.



    Again my apologies ...
     
    Last edited: Sep 7, 2004
  15. Jason_R0

    Jason_R0 Developer

    Joined:
    Feb 16, 2005
    Posts:
    1,038
    Location:
    Australia
    It's no problem, glad to see another helpful person on the forum. :)
     
  16. stalker

    stalker Registered Member

    Joined:
    Jan 19, 2004
    Posts:
    152
    Location:
    Ljubljana, Slovenia


    Yeah, where I see some topic, where I think, I know something "more" about subject, or something that could be helpful, alternative, or whatever, than I just need to say it ...


    But that sure doesn't mean offering/suggesting other software in one software's support forum. I really missed it this time.


    :rolleyes:
     
Thread Status:
Not open for further replies.