In a normal week, I probably try somewhere between 5 and 10 different programs for one reason or another. Once of the programs I tried this week is Eraser, mostly because it is GPL (Open Source Software) and is totally free. Recently I was called upon to recover sales data from a ex staff members laptop as said staff member decided that the company in question really didn’t need their sales data and deleted the lot (along with about 2500 emails) before returning the laptop.

What led me to Eraser, was the ease with which I recovered all the data. Sure it was time consuming, but in one evening, I’d recovered nearly all the data, and all the deleted emails from Thunderbird. (I’d have gotten all the data, but the laptop had been used for a couple of days and rebooted about a dozen times, so some of it had been overwritten).

Anyway, onto the theory. When data is deleted and emptied from the recycle bin, it isn’t really deleted at all, only its index is removed, the data itself is not changed. Think of it like a map book, the pages of maps themselves are the data and the index is the list of what data is in what place. Removing an entry from the index doesn’t remove the map, you just can’t find it anymore. Same with deleted data. The big difference is that once an area is cleaned from the index of a hard drive, the area in question is allocated as free space meaning it can be over written the next time some free space is need. As long as the data hasn’t been overwritten, it is usually recoverable. Anyway, the ease with which the data was recovered made me think about ways of making it harder, cheap ways at that. 30 seconds of Googling later and I was looking at Eraser. As a test, I put a heap of files between 20 and 700 mb onto a 120 gig hard drive. Then I completely deleted the lot and used Freeundelete (another great little free program) to recover the lot. I was not using this drive as my main system drive and had not added any new data so the recovery was 100% successful. Following that, I deleted the lot again, and ran Eraser on that drive to delete (overwrite) the deleted files and tried to recover them again. this time I was completely unsuccessful, I got nothing usable from the recovery at all. That is to say that Eraser did exactly that it was written for, it made recovering the data next to impossible. It is possible that some experts using much lower level tools could recover small parts of the deleted data, but for all intents and purposes, it’s gone for good.

Eraser is surprisingly easy to use for an OSS program. It works in a schedule type arrangement where you create tasks and then “run” them. So I created a new task, (in this case to erase all free space on drive D), then I right clicked on the task and selected run and off it went. About 4.5 hours later it told me my drives free space was clean. This probably wouldn’t be the NSA’s chosen program for covering their tacks, but for the vast majority, it’s more than enough (wouldn’t hurt to defrag the drive afterwards either).
It never hurts to cover your tracks, even if you are not doing anything questionable, if you don’t like the idea of someone going though your machine, make it harder. Besides, the price of Eraser is right (free), and it takes next to no space or time to use so why not? I give it at 9 out of 10 for doing perfectly, exactly what it is supposed to and nothing more. Small, fast and tidy.

This article was posted on Wednesday, June 13th, 2007 at 3:40 pm