Free PC Cleaners

2012Coleman wrote:
This is by far the most goofy advice I have ever come across. :H :H :H

Yes, but it will work and is simple.

1492 wrote:
Is Guttman(35 pass?) any more effective than a single or three pass wipe with modern high density HDs? My understanding is that Guttman is "theory" based on 90's era technology involving early low density HDs that was never really proven. So for the most part, a waist of time.

The important point is to overwrite the drive space. There are academic papers that show 1-2 passes are all that is necessary to make file recovery virtually impossible for all practical purposes with modern HD.

As mentioned, SSD by design do not require to be over written with OS support for TRIM. In fact, doing so reduces their useful life.

With the way newer hard drives store data, the Guttman pass is more of a psychological assurance than a realistic need. I also use it as a way to make sure the HDD is able to read/write everything, so if there are SMART pre-fail errors triggered by the relocation table filling up, they will go off during the large writes as opposed to later on.

HDD makers are all about density, so if a drive could have bits remaining after a few wipes, HDD makers would be trying to figure out how to use the same sector to store multiple bits for more space.

Is Guttman(35 pass?) any more effective than a single or three pass wipe with modern high density HDs? My understanding is that Guttman is "theory" based on 90's era technology involving early low density HDs that was never really proven. So for the most part, a waist of time.

The important point is to over write the drive space. There are academic papers that show 1-2 passes are all that is necessary to make file recovery virtually impossible for all practical purposes with modern HD.

As mentioned, SSD by design do not require to be over written with OS support for TRIM. In fact, doing so reduces their useful life.

I encrypt all data (main reason for this is that breakins are common, so might as well not let a thief have your data to extort/blackmail you by when they take your disks), so in theory, a simple format command will zero out the volume encryption key sections and ensure that the data is completely unrecoverable. Sensitive data goes on a Truecrypt volume with keyfiles stored on a USB flash drive. No keyfile, no data, period.

If I want to hand a machine over, I use DBAN (Derik's Boot & Nuke), which is a burnable ISO. I boot the machine with it, select "autonuke", and let the utility wipe all the drives on the box. If really worried, I use the "Guttman" wipe and let that run for a few days.

Of course, things are different with SSDs made within the past couple years. Delete files, and the TRIM utility will completely zero the deleted stuff out. No way to use a recovery utility like Recuva when TRIM does its job.

If someone is able to get data from a multi-pass DBAN wipe, and is able to decrypt it (I use BitLocker on Windows, LUKS on Linux, FileVault 2 on the Mac, and TrueCrypt on all platforms), the person deserves to have the recovered data.

Here's another example, and should serve as a warning!

I picked up a Western Digital external USB HD from Goodwill for $8. I actually wanted the PATA IDE drive case and power supply for use with my own old IDE drives, but it did come with a 160G WD hard drive(HD) already installed.

Out of curiosity, I checked the HD which contained no files. However, after reformatting the drive, WIN 7 recognized it but indicated that the drive was not formatted? This generally indicates drive errors.

I deleted the partition, created a new one, and reformatted the HD but with no success. WIN 7 still indicated the drive needed to be formatted before use. So, deleted the partition once again, and created a smaller partition this time, leaving the remaining space as unallocated which finally did work. However, resulted in slow drive speeds ~6Mbps average, which is pretty much useless for my purposes.

Notwithstanding, I deleted and created new partitions of varying sizes about 5 times, settling on 120G which appeared the best I could do to avoid the bad surface areas of the drive. Then ran a Windows surface scan/repair, and now the drive is averaging 96.5Mbsp average speed with no errors. It has less than 5,000 total hours.

Now the interesting part? I ran Recuva utility using deep scan on this HD to see if it could detect any files. And if so, recover any of them? Here's the surprising results:





Recuva was able to identify 2,558 files. Most of which appeared to be old browser cache files. But also contained personal photos and PDF documents. Including many identifiable by file name, which could give an idea of the activities of the previous owner.

Keep in mind that this is what a freeware file recover utility was able to locate/recover. Even after the HD partition had been deleted, recreated, and the drive reformatted at least 5 separate times!

Note that this does not mean that all files can be recovered intact. There could be individual file errors introduced, which could cause some files to be only partially usable. But should be a warning in any case, that reformatting a HD, or even deleting a partition even multiple times, does not guaranty that previously store files on a HD cannot be recovered.

Here's a quick test of the free version of the data recovery utility Recuva, maker of the popular CCleaner.



10 random photos where placed in a separate partition on a hard drive. Then deleted, and the Recycle Bin cleared. So now part of the drive's free space. No surprise, Recuva was easily able to restore all 10 photos.





The 10 photos were once again deleted, and the hard drive partition was re-formatted. Recuva was still able to restore 8 of the 10 photos from the unused space on the hard drive.


And finally, the remaining 8 photos were deleted, and the free space was then wiped "1" time using the free CCleaner. The result, Recuva couldn't recover any files under deep scan. All data was random scambled characters filling the entire partition.

I was going to compare Recuva, a consumer user recover app, against a forensic data recovery utility, but doubt the results would be much different if at all.

Notwithstanding, simply reinstalling the OS and/or formatting the hard drive, does little to prevent data recover from unused space. The hard drive needs to be written over completely. Though multiple passes are unnecessary with modern drives.

hermandutchman wrote:

K Charles wrote:
Take out the hard drive and smash it with a hammer.

Our local TV just did a program about this. They purchased a PC at a garage sale, that was supposed to have been cleaned out.
A computer expert took out the hard drive and was able to tell almost everything that had been on computer. He said the only way was to use large hammer on hard drive.

The seller likely just deleted files or may have even reformatted the hard drive, but this does not eliminate the possibility of recovering data. Info about users activities can also found in the registry, temp files, and browser history/cache. You must over write the the hard drive space to make deleted files impossible to recover for all practical purposes. But really only need to over write the space on hard drives only once. Multiple write passes is not necessary in modern hard drives, and largely an urban myth that doing so decreases the chance of data recovery in any way. Not to mention, wasting time. In fact, you'll find published research on this myth on the net.

i still like the idea of
cleaning the drive
migrating to new drive
installing new drive
wipe old drive and use it as an external backup of pictures etc..
the grandson gets a clean new drive, complete system with all updates and service packs
with NO personal data
even if lost or stolen there is nothing there to be recovered

2012Coleman wrote:
This is good advice, but you could also just reinstall the operating system which will completly wipe the HD.

For the purposes of giving the laptop to grandchildren, this would do the trick. For donating or selling the laptop to a third party, I would not do this without first wiping over the drive data. Though re-installation of the OS generally involves re-formatting the drive, that does not guarantee that data cannot be extracted. There are many tools for recovering data from formatted discs.

Plus, besides reinstalling the OS, one must also apply all service packs, updates, and security patches. And reinstall any appropriate software. Time consuming to say the least.

DAWg134 wrote:
One method I've used when absolute security is not a concern is to overwrite all of the free space on the disk, after the personal data has been deleted and the trash emptied.

1) Delete all personal data
2) Defragment the hard drive (to throw off the file pointers)
3) Load an innocuous random file onto a "data" folder on the hard drive - a high-reolution photo of your grandson should do.
4) Copy-and-paste the photo - Windows should automatically rename the new photo
5) Press CTRL-A to select all photos, then conduct the copy-and-paste process once again.
6) Repeat step 5) until you have created approximately 100 or so copies of the photo
7) Conduct a copy-and-paste operation on the "data" folder containing the 100 photos
8) Press CTRL-A to select all folders, then conduct the copy-and-paste process once again.
9) Repeat step 8) until you have filled up the hard drive with folders containing nothing but photos of your grandson. You'll be surprised how quickly this happens, even if it isn't exactly an exponentially increasing function.
10) Finally, delete ALL "data" folders you have created - now, if someone attempts to recover data from your "erased" hard drive, all that they will find are photos of your grandson.

Admittedly, this is the "cheapskate" version of the DoD-approved program that conducts multiple passes of writing random patterns of ones and zeros across all blank portions of the drive, but the method has come in handy when the program was not available.

This is by far the most goofy advice I have ever come across. :H :H :H