X-Ways Security: Permanent Erasure

1
X-Ways Security Permanent Erasure

• Supervised By Dr. Loai Tawalbeh
• Prepared By Murad M. Ali

2
Permanent Erasure (Shredding)

• File Shredding or File Wiping is the act of
  deleting a computer file securely, so that it
  cannot be restored by any means.
• This is done either using file shredder software,
  or by issuing a "secure delete" command, as
  opposed to a "delete" command from the operating
  system.
• File shredding usually involves overwriting a
  file multiple times.

3
Deleting

• When most computers delete a file, they do not
  actually remove the contents of the file.
  Instead, they simply unlink the file from the
  file directory system, leaving the contents of
  the file in the disk sectors.
• These data will remain there until the operating
  system reuses those sectors to write new data.
  Until the old data are overwritten (and this may
  take months or longer), it can be recovered by
  programs that read disk sectors directly, such as
  forensic software (so called because it is used
  to obtain evidence in criminal investigations and
  also in legal discovery).

4
Purpose of Deleting Data

• The reasons for deleting data
• Need more disk space
• Removing duplicate or unnecessary data
• Removing sensitive information from others

5
Storing Data

• To delete data safely from a disk, it helps to
  understand how it gets there in the first place.
  The heart of a hard-disk is the platter, a set of
  highly polished plates, split into smaller parts
  called sectors.
• Data is stored on the disk magnetically, so you
  don't lose everything when you shut down the
  power. A read/write head, which looks like the
  arm of a record player, moves over the disk and
  writes information onto each platter. Every time
  data is written to the disk, a record is kept of
  the part of the platter on which it has been
  stored.

6
Storing Data
7
Recycle Bin

• provides a safety net when deleting files or
  folders. When you delete any of these items from
  your hard disk, Windows places it in the Recycle
  Bin and the Recycle Bin icon changes from empty
  to full.
• Items in the Recycle Bin remain there until you
  decide to permanently delete them from your
  computer. These items still take up hard disk
  space and can be undeleted or restored back to
  their original location. When it fills up,
  Windows automatically cleans out enough space in
  the Recycle Bin to accommodate the most recently
  deleted files and folders.

8
Recycle Bin

• If you're running low on hard disk space, always
  remember to empty the Recycle Bin. You can also
  restrict the size of the Recycle Bin to limit the
  amount of hard disk space it takes up.
• Windows allocates one Recycle Bin for each
  partition or hard disk. If your hard disk is
  partitioned, or if you have more than one hard
  disk in your computer, you can specify a
  different size for each Recycle Bin.

9
Accidental Removing

• The common problem with deleting files is
  accidental removal of information that later
  proves to be important. One way to deal with this
  is to backup files regularly.
• Another strategy is to move files to a temporary
  place where they are kept until one is really low
  on free space. This is how the "recycle bin" in
  Microsoft Windows and the "trash folder" in Mac
  OS work.
• Under Unix in order to delete a file, you must
  usually have write permission to the parent
  directory of that file.

10
Reasons of Use

• File wiping is useful for confidentiality,
  because files are not entirely deleted using the
  operating system's default delete function.
  Typically, standard delete functions consist of
  marking the space occupied by the file as free
  and updating file system metadata structures,
  leaving the actual file contents intact on the
  physical medium. If the file system continues to
  be used, eventually this space will be assigned
  to other files and overwritten. However, if the
  file system has not been used intensively since
  the file was deleted, recovery or forensic tools
  have a good likelihood of retrieving deleted data
  in part or in whole by accessing the medium.

11
Reasons of Use

• Some research in the field of magnetic storage
  media has indicated that it is theoretically
  possible to recover information from magnetic
  disks even after an overwrite, using hardware
  methods. File wiping with multiple overwrite
  passes was devised as an attempt to defeat such
  methods.

12
How It Work

• File Wipe programs work not only by unlinking a
  file but also specifically overwriting them with
  garbage data. For very high security
  installations, overwriting the file several times
  is advised. Many government institutions have
  specific protocols for file deletion. For
  instance, the U.S. Department of Defense (DoD)
  specification 5220.22 standard says a file must
  be overwritten three times.
• Wiping a file takes a considerably longer amount
  of time than just deleting it.

13
How It Work

• Besides destroying file's contents, some file
  wiping software also makes an attempt to ensure
  that, once wiping has been performed, no
  information about the file is left in the file
  system's metadata, such as directory entries.
• FAT file system, for example, only replaces the
  first character of the filename in the
  corresponding directory entry, when a file is
  removed. This may be a problem if the user
  doesn't want to leave traces, such as partial
  file name and, possibly, creation and
  modification dates on the physical medium.
• The solution to this problem is to wipe deleted
  entries in the directory containing the file
  after wiping the file itself.

14
Permanente Erasing Tools

• If you wants to be absolutely sure that the file
  is not recoverable by any means, a suggested
  approach is to burn the hard drive.
• Another approach is to destroy the media with
  acid.
• Although using file shredder software is
  sufficient to ensure that the data can't be
  recovered using commercially available tools by
  either the next owner of the computer, or by
  someone who has stolen the computer or the hard
  disk.

15
Software Tools

• X-Ways Security.
• File Shredder.
• East-Tec Eraser.
• Permanent Data Wiper.
• Blancco.

16
X-Ways Security

• X-Ways Security is a hard drive cleansing
  solution.
• To maximize security, X-Ways Security offers up
  to 9 fully configurable overwrite passes and the
  U.S. Department of Defense (DoD) standard for
  hard drive sanitization as specified in the
  5220.22-M operating manual.

17
X-Ways Security

• Delete selected confidential files securely, such
  that they are not recoverable.
• Wipe free drive space and clear slack space, to
  get rid of sensitive data from deleted files.
  temporary files.
• Clean formerly used NTFS file records, which
  contain filenames and other data
• Erase logical drives or entire physical disks
  completely and irreversibly, e.g. to produce
  forensically clean target media or to sanitize
  media before re-use in a different environment of
  before donating.

18
References

• http//en.wikipedia.org
• http//www.x-way.net
• http//www.microsoft.com
• http//www.tech-faq.com

19
THE END