Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If I delete files on a NTFS partition I can recover them shortly with a very high probability of success. When a file is deleted, only the file system entry is deleted, thus the content of the file will still remain intact for a periode of time, depending on the disk activity afterwards.

How can I make sure that the files will be unrecoverable and what is the best tool to do the job?

share|improve this question

closed as off-topic by masegaloeh, 84104, MadHatter, kasperd, Ward Apr 18 '15 at 6:13

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

you want to make them unrecoverable? might want to edit the question title, its kind of unclear – HannesFostie Jul 24 '09 at 13:13
It's done. Thanks. – cmserv Jul 24 '09 at 13:20

10 Answers 10

up vote 3 down vote accepted

Any tool that overwrites the data is ultimately going to stop casual attackers (and, very likely, even well budgeted attackers). Recovering data from an overwrite on modern hard disk drives is extremely difficult. You can use as fancy a tool as you want (overwrites data with a cryptographically sound random number generator, etc), but in the end even a simple overwrite with zeros will protect you from all but the most sophisticated attackers.

Beware of SSDs and attempting to overwrite data. SSDs do "wear leveling" and tools that simply overwrite files without any awareness to the underlying storage technology may not actually overwrite the data.

share|improve this answer
A complete free-space wipe could address the SSD wear-leveling issue. – Chris W. Rea Jul 24 '09 at 17:27
@cwrea: Ever heard of "reserved cells" or "reserved blocks" on a flash device? – Evan Anderson Jul 24 '09 at 17:46
Magnetic media sometimes also contain spare cylinders that get pressed into use at times that are out of your control. – Brian Knoblauch Jul 24 '09 at 17:50
@Brian: Absolutely true. The only sure way to make data unrecoverable is to destroy the media completely. – Evan Anderson Jul 24 '09 at 18:23

Non-Home editions of Windows come with a command-line tool called cipher.exe. In addition to letting you encrypt files with NTFS encryption, it also has a free-space wiping mechanism. e.g.

C:\> cipher /W:C:\

It will then wipe all free space on the designated drive. Other tools can do one-off file wipes, but I like cipher.exe because it is built-in on most Windows editions.

share|improve this answer
Bear in mind that, if you're trying to cover your nefarious tracks, that cipher and sdelete both don't wipe slack space (the space between the logical end of a file and the end of the allocation unit it was stored in). – Evan Anderson Jul 24 '09 at 17:48
@Evan Anderson: Good point. How about: Copy the files, delete originals, then run cipher's free space wipe? Assumes the file copy operation wouldn't preserve the slack space. – Chris W. Rea Jul 25 '09 at 16:14

I use SDelete from sysinternals to securely delete files from our PCI environment.

share|improve this answer
Note that SDelete securely deletes file data, but not file names located in free disk space. Any idea how to also make the names unrecoverable? – cmserv Jul 24 '09 at 13:45
I don't think there's any documented API in NTFS to do that (to put a new file in a chosen MFT slot). You're going to have to resort to something that plays fast and loose with the rules. I don't think I'd trust production data to such a utility. If you're going to be into nuking filesystem metadata then even wiping all free allocation units isn't going to be good enough since there could be data leakage within the "slack" space inside allocation units used to track filesystem metadata. At that point, you're better off overwriting the entire filesystem with zeros. – Evan Anderson Jul 24 '09 at 16:54

I've used SDelete in windows with success.

share|improve this answer

On a workstation by workstation case you could use a piece of software designed to remove files from the disk, I've used one known as FileShredder.

If you're trying to do something on a corporate scale I would look at companies like Symantec - the name escapes me but I know they had a product which would do what you are looking for.

share|improve this answer

I've used bcwipe, which has the convenient feature of installing itself in the context menu in windows explorer, giving the option to delete or "delete with wiping" by a right click. It also wipes file slack, unused file space and directory entries.

share|improve this answer

You could also, if you're worried about the recoverability of file names in that slack space, use a filesystem container, like one from TrueCrypt.

share|improve this answer
But then I wouldn't solve the problem of how to dispose of the original copies. – cmserv Jul 24 '09 at 19:42
You could switch methodologies, and save all sensitive things to the contained system in the FIRST place. Then either write zeros or destroy the original medium. – mpbloch Jul 24 '09 at 22:11

Here are a couple other utilities that you can try:

I've used killdisk before and like it, but haven't tried Eraser

share|improve this answer

In the days of FAT, the disk defragmentation utilities were able to wipe all free space, what is IMHO very good measure to protect deleted files (even when considering "reserved" sectors - there is only few of them, so only very little data is possibly left) .. but is it available for NTFS as well? I can't find such option.

share|improve this answer

Any Directory Opus user will have a built-in "secure wipe" feature that does about the same thing every other tool does:

This uses algorithms similar to those recommended by the US NSA and US Department of Defense for securely destroying the contents of a file to make recovery by forensic analysis of the magnetic medium of the disk extremely difficult if not unlikely. The number of passes for each file can be configured in Preferences.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.