The simplest way to destroy data that requires no special knowledge is to save a file with different data. This only works with file systems that change data in situ. The method used here betrays the existence of some data overwritten. A more rigorous attempt would involve overwriting all the original data.

Initialize partition using the option to overwrite all data with NULLs (0x00). Create text-only file containing the string “Text file #n”, where n is a number incremented to discern between the different versions of the file. Save, close, and reopen the file, and replace some of its text with to cover part of the original text. View file changes with a partition hex editor.

Windows created the file and re-saved it to the same location. As shown in Fig. 1.2, some of the original text remains.

Fig. 1.1: File and sector view before change (NTFS).

Fig. 1.2: File and sector view after change (NTFS).

Created the same text file on either FS. After changing and resaving, the file was saved to a different block — leaving the original file intact in the first block.