how storage works

[Conan Wolf]

so i know that if you delete something it just shrinks down then is just overwritten after a while but, what about say if i moved it over to a removable drive/disk, is there any information that can be traced back to my computer and one more thing, when you reformat removable disk, does the files delete on the removable disk or does it move over to your device (for me my computer) then "delete"?

[emosun]

files are mearly made invisible to the os , they are mostly still there in their entirety until overwritten , they dont shrink down at all.

Same with a removable disk , the file is just made to look like empty space but until it's overwritten it's still pretty much there entirely , even reformatting will mostly just mark space as being empty but the files are still there,

[emosun]

oh , as far as tracing information back to your machine. the file would have to be something specific to you or your machine

specific to you in that it's a picture or file that mentions you , or specific to your machine in that it's a file that mentions your machine like a bsod dump file that contains your pc configuration and someone could put two and two together that it's probably your machine. ect...

[Conan Wolf]

2 minutes ago, emosun said:

files are mearly made invisible to the os , they are mostly still there in their entirety until overwritten , they they dont shrink down at all.

i was always told that they shrink down... but ok thats also understandable the main question i wanted answered was the removable drive one, so the "delete" data on the flash drive stays on the flash drive (i am not doing anything illegal just things i dont want people to know about) the 2ed main question is "is there a trace on oh program A was moved to a new drive"

[Conan Wolf]

Just now, emosun said:

oh , as far as tracing information back to your machine. the file would have to be something specific to you or your machine

specific to you in that it's a picture or file that mentions you , or specific to your machine in that it's a file that mentions your machine like a bsod dump file that contains your pc configuration and someone could put two and two together that it's probably your machine. ect...

is there a way to get around that?

[emosun]

4 minutes ago, Conan Wolf said:

is there a way to get around that?

so long as the file that is being moved/deleted has nothing to do with you specifically or mentions the pc being used to do it specifically then it could essentially be a file that was moved by any machine. 

essentially the only thing that can be recovered from a drive that wasn't securely formated or deleted is the files themselves and the time they were moved or changed/accessed last.

[Enderman]

The only way to completely remove traces from a file is to overwrite free space with 0s with a tool like ccleaner or something else.

Moving or deleting files just removes the location, doesn't remove the actual data.

[Conan Wolf]

ok

 

[Pickles von Brine]

6 hours ago, Enderman said:

The only way to completely remove traces from a file is to overwrite free space with 0s with a tool like ccleaner or something else.

Moving or deleting files just removes the location, doesn't remove the actual data.

Or overwrite with 0s then random data afterword. Best practice is a 7 pass with 0s then junk data and repeat. Even if I had the best possible software and technology available it would be almost impossible to recover data after being overwritten 7 times with 0s then junk data. 

[Conan Wolf]

13 minutes ago, Lord Xeb said:

Or overwrite with 0s then random data afterword. Best practice is a 7 pass with 0s then junk data and repeat. Even if I had the best possible software and technology available it would be almost impossible to recover data after being overwritten 7 times with 0s then junk data. 

this may be a dumb question... when you say 0s do you mean operating system?

[Pickles von Brine]

11 minutes ago, Conan Wolf said:

this may be a dumb question... when you say 0s do you mean operating system?

I am not. If you where to look at a drive in a hex editor the raw values would all be "0"

 

Unlike this one which has data on it:

 

This one has no data and has been zeroed out:

 

[Conan Wolf]

2 minutes ago, Lord Xeb said:

I am not. If you where to look at a drive in a hex editor the raw values would all be "0"

 

Unlike this one which has data on it:

 

This one has no data and has been zeroed out:

 

oh dang i never really play with raw data before, other then learning about it in my computer science class

 

31 minutes ago, Lord Xeb said:

Or overwrite with 0s then random data afterword. Best practice is a 7 pass with 0s then junk data and repeat. Even if I had the best possible software and technology available it would be almost impossible to recover data after being overwritten 7 times with 0s then junk data. 

so is there any tutorials on how to do this?

[Pickles von Brine]

Pretty easy really. Get a program that can do a data erase. HDD Tune can do it. Mini Partition Wizard can as well. Then you can just use a hex editor to confirm the data is erased. There are a few free ones out there.

 

Hell, if you used dd in linux you can set it to do a zero pass on a drive and have it write zeros. There are many many many ways to do it. 

 

 

BTW, best hex editor I have ever used was WinHex. However, it is complex and not easy to use. You kinda have to know how to use it. It also offers the ability to erase data too. 

[Conan Wolf]

1 minute ago, Lord Xeb said:

Pretty easy really. Get a program that can do a data erase. HDD Tune can do it. Mini Partition Wizard can as well. Then you can just use a hex editor to confirm the data is erased. There are a few free ones out there.

 

Hell, if you used dd in linux you can set it to do a zero pass on a drive and have it write zeros. There are many many many ways to do it. 

 

cool thanks

 

[Pickles von Brine]

Just now, Conan Wolf said:

cool thanks

 

Anyime. If you got a question and I can answer I will gladly supply it to you. 

[moderategamer]

7 hours ago, emosun said:

files are mearly made invisible to the os , they are mostly still there in their entirety until overwritten , they dont shrink down at all.

Same with a removable disk , the file is just made to look like empty space but until it's overwritten it's still pretty much there entirely , even reformatting will mostly just mark space as being empty but the files are still there,

Agreed I'd just add the file simply has a piece of information like a key or a code that marks it as deleted to the OS. This is done as it greatly speeds up the process of deleting a file as to actually delete a file from disk takes quite a bit of time. 

[Pickles von Brine]

That it does. Better to mark it for overwrite then spend 20 minutes deleting the file especailly if it is several gigabytes in size. 

[moderategamer]

If you're really serious about keeping your data safe from prying eyes it's wise to power down your PC when you're not around as RAM contains a whole bunch of sensitive information such as users logged in along with the times they logged in, emails, and even crazy stuff like plaintext files along with their private encryption keys if your doing anything that is encrypted. Luckily RAM is volatile so when you remove power all the info is lost, if people can gain physical access to your computer they can create disk images of both your system memory and storage then techniques such as file carving can be used to hunt for personal or sensitive data. Obviously this would never happen to you unless you're secretly running an online drug market or something crazy like that which I'm sure you're not... right?