Scared and impressed!

AdamR

I had a bit of a panic this morning when I discovered that a small number of Excel and other type documents saved to "My Documents" on the C:\ of my work PC had disappeared. They weren't very important as anything vital is saved to the network but I was confused as to how they'd come to be deleted.

Eventually I figured out that Sage Line 50 had kindly wiped them for me while I was in the process of deleting an old company on an invalid directory path. So I was happy that I knew the cause, although I was resigned to the fact I'd lost them.

However, after a phone call to our off-site technical help, I was sent a program that basically found all the documents that had been wiped and restored them to their original state. 90 minutes later, it was as if nothing had ever happened.

So that made me think: how does something you've removed get saved so that it can be recovered at a later date by someone in the know? Where does it save it to and how come it doesn't eat up all your HDD?

Little wonder all these people with child pornography on their PC get caught - you just cannot remove it! You don't think it's possible until you've seen it done but I have and it's impressive. And very scary!

rachy1975

AdamR wrote: »

I had a bit of a panic this morning when I discovered that a small number of Excel and other type documents saved to "My Documents" on the C:\ of my work PC had disappeared. They weren't very important as anything vital is saved to the network but I was confused as to how they'd come to be deleted.

Eventually I figured out that Sage Line 50 had kindly wiped them for me while I was in the process of deleting an old company on an invalid directory path. So I was happy that I knew the cause, although I was resigned to the fact I'd lost them.

However, after a phone call to our off-site technical help, I was sent a program that basically found all the documents that had been wiped and restored them to their original state. 90 minutes later, it was as if nothing had ever happened.

So that made me think: how does something you've removed get saved so that it can be recovered at a later date by someone in the know? Where does it save it to and how come it doesn't eat up all your HDD?

Little wonder all these people with child pornography on their PC get caught - you just cannot remove it! You don't think it's possible until you've seen it done but I have and it's impressive. And very scary!

There are so many places the computer saves it to...i delete all my files whilst using the internet (tempory internet files, downloads etc etc) but my boyfriend, who is a computer geek, can go online and bring up the whole history of what i have done and what time on my lap top....suppose that is also how the police etc (CSI lol) can track down individuals.....
Also when i was a lecturer if my students were looking at something risque...the IT dept would get flagged and they would e mail me letting me know what student on what computer what time etc etc...it was also a good way of threatening the students not to look at anything!!!! lol

AdamR

I know of all the online traces that are left but as you say it's the software that the police and others use to delve a little deeper. History is a lot easier to log than actual files though - you can configure process logs and all manner of tiny notepad documents will get produced as a result of each keystroke, but log files are only bits or a few bytes in size and therefore take up little space and are hard to identify.

For example, one of the files I recovered was a 1Mb excel document with all manner of complex formula, formatting and macros and it's been restored, brand new. Surely that 1Mb must've been sat aroung in a corner of the hard disk, using up space, to enable it to be restored? And imagine what room a few deleted pictures/videos would take up?

I can only think that there is a second, hidden HDD somewhere in the machines that can pool all the deleted files safely out the way. This particular recovery program can restore from reformatted and deleted volumes - to me, that should be impossible! A second, "Recycle Bin" Drive is the only way I can explain it.

Computers - amazing! And if you're a criminal, it's probably better to use a typewriter!

blobbyh

Emptying the recycle bin only tells Windows to forget where the data is stored. It's still there sitting on your hard drive until it's overwritten by other data which is unlikely when we now have 300gb to 500gb drives fitted as standard.

There are a number of programs given away on magazine covers that promise permanent 'shredding' capabilities though their definition of permanent is open to conjecture. It's unlikely they offer data removal so permanent that even government software can't retrieve it since such a program would probably be declared illegal and against national security. Why do you think criminals burn their hardware if discovered and even that's not guaranteed to be 100% safe?

AdamR

To destroy a hard drive that contained stuff I didn't want found, I'd want to:
1. Microwave it
2. Burn it
3. Chuck it in the river
4. Before it dries, microwave it again
5. Attack it with a slegehammer
6. Burn it
7. Microwave it

Then I might consider putting it in a car that's to be crushed, chucking it into the melt pot of a steelworks and finally wrapping loads of coils of cable round it, turning on the juice and creating a nice electromagnet.

At that point I'd rest slightly easier!:laugh:

CJC

When you delete a file it doesn't go anywhere, it's just that all links to it are removed. It will get overwritten at some point so that's why your HD doesn't get full up and why you should recover any mistaken deleted files ASAP.

If you have files that you really want to delete permanently - eg confidential or personal information - there are programs that will do that for you. I also lke to make sure the detritus that browsing the internet leaves behind, partly for privacy but mainly just because it clutters up the computer.

CJC

blobbyh wrote: »

There are a number of programs given away on magazine covers that promise permanent 'shredding' capabilities though their definition of permanent is open to conjecture. It's unlikely they offer data removal so permanent that even government software can't retrieve it since such a program would probably be declared illegal and against national security.

I'm not so sure, look at the mess the US government got into when it tried to ban PGP encryption software - and indeed I would feel that there's serious civil liberty issues involved with not letting people permanently erase there own files. Making files hard to recover is pretty easy,you just overwrite the file a few times with rubbish. Making them impossible to recover is, well, nigh on impossible but the cost involved in recovering well wiped data is high and unless national security is involved is unlikely to be thought worth it.

AdamR

But as Robert points out, with hard disks the size they are these days, how do you ever load enough crap to successfully overwrite anything?:confused1:

CJC

In the normal course of things your OS won't necessarily write to blank space first but to any free space so stuff may get overwritten even when the disc isn't full. Of course, the larger the disc, the less likely that any disc segment will get written to and thus less likely that parts of any given file will get overwritten. This is why you'd use a shredder program to provide at least some measure of privacy/security.

But ultimately, you're right in that really making anything completely unrecoverable requires nuking the disc.

AdamR

RE nuking - would you agree with my method or did I miss a step or two?!:001_unsure:

Bluewednesday

AdamR wrote: »

Eventually I figured out that Sage Line 50 had kindly wiped them for me while I was in the process of deleting an old company on an invalid directory path. So I was happy that I knew the cause, although I was resigned to the fact I'd lost them.

Calling tech support AdamR

Help me on this one? I've got an old company on an invalid directory path and I can't work out how to get rid of it?

AdamR

BE VERY CAREFUL!:laugh:

When I did it, it wiped every single file type in the immediate directory. Items in folders were untouched. So make sure it's clear before you do anything and you have a backup of things if at all possible.

You need to open a company different to the one you wish to delete and then I think it's File/Delete Company. Then select the one you want rid of.

Some of the folders remain (Archive is one I think) but the rest get cleaned and the name no longer appears in the open company box.

PS: I am not a bookkeeper and very rarely use Line 50 and so therefore I cannot be held liable if in following my advice, you start a nuclear war.:thumbup1:

AK002

Wanted to know how to do this for a while, nice one!

AdamR

Right, now about my fee...

AK002

A haggis?

AdamR

As long as it's a live one! Always wanted a pet haggis...:001_smile:

AK002

They're all at the races ATM!

AdamR

Are they? Darn it!:mad:

Deep fried mars bar it is then!

Bluewednesday

AdamR wrote: »

BE VERY CAREFUL!:laugh:

When I did it, it wiped every single file type in the immediate directory. Items in folders were untouched. So make sure it's clear before you do anything and you have a backup of things if at all possible.

You need to open a company different to the one you wish to delete and then I think it's File/Delete Company. Then select the one you want rid of.

Some of the folders remain (Archive is one I think) but the rest get cleaned and the name no longer appears in the open company box.

PS: I am not a bookkeeper and very rarely use Line 50 and so therefore I cannot be held liable if in following my advice, you start a nuclear war.:thumbup1:

It's okay, I have it in writing - you accept full responsibility for anything that goes wrong on my pc - thanks!

When you say immediate directory, what has happened is that someone's Sage was loaded on my machine from a flash drive so the path is showing to the E drive which is no longer there. Does this mean it won't cause a problem?

AdamR

I wouldn't like to bet my house on it but yes, it should be safer if the drive is currently not in use.