Monday, June 18, 2007

Deleting computer files doesn't really erase them

Documents, e-mails, photos linger in system

Looking to erase files, images and other information from a computer?
It takes more than tapping the delete key and emptying the recycle bin. In fact, the only way to completely eliminate data with any certainty is to use specialized software created for just that purpose, experts say.

"You have to be very savvy in order to wipe the information off a hard drive by yourself," said Greg Beckemeier, a project manager at St. Louis-based United Forensics, which provides computer and technology forensics services. "Even when you've cleared the cache, erased cookies and deleted files, they are still there and can be recovered."

Computers essentially store copies of almost everything a user views. That includes e-mails, downloaded documents and photos on Web sites, even if the user didn't click on the images.

"Every time you go to a Web site, all the pictures and graphics, even if you didn't click on them, are downloaded to temporary Internet files on the computer," said Catherine O'Keefe, forensics service manager at Centennial- based Computer Forensic Labs.

"Each one of these has a date and time stamp, a creation date, the date they were modified and the date they were last accessed."

So photos and videos are still on a hard drive even if someone didn't specifically download and save them, let alone view them.

Computers store files and data in various places on a hard drive, making it hard to completely erase everything. They also record the date and time that files were accessed and certain programs were used, which likely is how investigators in former District Judge Larry Manzanares case discovered that someone recently deleted pornography and emptied the recycle bin.

Deleting a file is akin to simply removing a card from the card catalogue in a library, said Brady Essman, founder of Arapahoe County-based DigitalMedix.

"If you remove the card, the book is still on the shelf," Essman said. "Somebody who knows how to look for it can still find it."

In more technical terms, deleting a file essentially tells the computer it can write over that space if it needs to, experts said. But the file is still there until that happens, which can take years.

Some software products, though, can completely eliminate files, either for a fee or for free over the Internet.

Where do deleted files go?

When you delete a file, depending on your operating system and your settings, it may be transferred to your trash or recycle bin. This "holding area" protects you from yourself - if you accidentally delete a file, you can easily restore it.

However, you may have experienced the panic that results from emptying the trash bin prematurely or having a file seem to disappear on its own.

The good news is that even though it may be difficult to locate, the file is probably still somewhere on your machine.

The bad news is that even though you think you've deleted a file, an attacker or other unauthorized person may be able to retrieve it.Source: U.S. Department Of Homeland Security

No comments: