Many utilities exist in all OSs that overwrite the contents of a file. This is commonly called wiping, shredding, or scrubbing a file. There are several methods used for this, from simply nullifying the data to repeatedly writing random data or patterns of data designed to thwart even the most determined software-based forensics tool.

Initialize partition using the option to overwrite all data with NULLs. Create text-only file containing the string “Text file #n”, where n is a number incremented to discern between the different versions of the file. Use a secure file deleter compatible with the file system in question. Since this research focuses on thwarting basic forensics tools, there is no need to take drastic measures (e.g. multiple write passes or random data).

A simple text file in a FAT file system is easily obliterated using a file shredder. The only parts of a disc that contain information about the file are the FAT and the file itself.

Fig. 2.1: Before and after securely deleting a file using HxD (FAT).

Under NTFS, a considerable amount of information is stored in the sectors where a file exists. This includes the file’s creation, change, and access dates and times as well as its attributes. There are many utilities for securely deleting files on an NTFS partition, though the degree to which these programs do the job needs attention. This investigator found none that would completely wipe the test file’s sector; Microsoft’s own SDelete would not even overwrite the filename (Fig. 2.2). There were also pieces of the file’s contents in other places in the partition, probably from temp files created by the OS. While it would be difficult using standard techniques to recover a specific shredded file’s contents, it is easy to see that a file did exist, and may be possible to glean some meta-information about the file depending on the program used.

Fig. 2.2: The original file (left column), the file after secure deletion with SDelete [MR1] (center column), and after deletion with Eraser [JL1] (NTFS).

Copyright © 2004-2025 Nathan Larson. All product names are registered trademarks of their respective trademark holders. Usage here is not intended as an infringement or endorsement.