Hi, Jeff.
Yes. My apologies to you - and to both Pauls. My Reply referred to posts
from both of them and I was confused.
You first asked the OP, "What would be the point of deleting...?" I agreed
with you, and with "Paul", who said, "You do not need to ["erase" the
pagefile]", and then he pointed to a web page that tells how to change the
Registry to "clear" the pagefile at shutdown - by writing zeroes there.
Then, a few messages down, "Paul in Houston TX" made the comment I partially
quoted:
Erasing the pagefile may make you feel better but wont do a thing for
security. I imagine that many of us on this NG could easily restore most
of your erased pagefile and find out all about you. To do it properly,
get a mil spec file eraser.
I overlooked that last "mil spec" remark when I agreed and said that "Even I
could do it".
Then we got into the semantics of "erase" versus "delete". My point is that
there is always SOMETHING in every sector of a working hard disk, even a
virgin, unused disk with "nothing" on it. It may be all zeroes or it may be
gibberish or it may be last month's financial statement or a love letter,
but there is SOMETHING there. And there are many applications that can read
that, no matter what it is. I've done it myself, thousands of times, and
often been surprised and sometimes dismayed by what I've found on my own
hard disk. So I'll amend what I said before:
...any of us with just moderate computer skills could resurrect your
"erased" data without too much difficulty. (Unless it had been done with "a
mil spec file eraser", even I could do it. <g>)
Thanks for the references to the differences between "erase" and "delete";
I'll check those out when I can.
RC
--
R. C. White, CPA
San Marcos, TX
(e-mail address removed)
Microsoft Windows MVP (2002-2010)
Windows Live Mail 2011 (Build 15.4.3555.0308) in Win7 Ultimate x64 SP1
"Jeff Layman" wrote in message
Hi, Jeff.
Yes, as Paul points out a few messages down, "Erasing the pagefile may
make
you feel better but wont do a thing for security." On a hard disk,
nothing
ever really gets erased. The best we can do, short of physical
destruction,
is overwrite the disk space with zeroes, gibberish or some other
characters.
And, as he also says, any of us with just moderate computer skills could
resurrect your "erased" data without too much difficulty. (Even I could
do
it. <g>)
Note that the pagefile gets re-created each time the computer is
restarted.
For those of us who shut down and restart daily, pagefile.sys always has
the
timestamp for when we booted the machine this morning. So, the entire
contents of the page file are effectively "erased" automatically each day.
The data is still there, but unless we resort to WinHex or some other disk
editor, it is inaccessible. ("Delete" = "erase". In fact, in MSDOS the
"DEL" and "ERASE" commands are interchangeable.)
My comments might not be technically correct; I'm an accountant, not a
techie of any kind. But I think they are close enough for the current
discussion.
RC
I was a bit confused by your reference to "Paul", but I see you mean
"Paul in Houston TX"!
Unfortunately, the terms "delete" and "erase" are still used
interchangeably much of the time. It's quite an education to Google
"unerase files". Most of the (often expensive) utilities offered to do
just that commonly refer to "unerasing deleted files". I don't know if
that obfuscation is deliberate or not, but anything more expensive(!)
than "Recuva" isn't really necessary.
As for a general treatise on erasing and recovering data, I doubt you
could do any better than read Peter Gutmann's (updated) article here:
http://www.cs.auckland.ac.nz/~pgut001/pubs/secure_del.html
You might also like to look at :
http://en.wikipedia.org/wiki/Data_remanence#Feasibility_of_recovering_overwritten_data
And Feenberg's response to Gutmann here:
http://www.nber.org/sys-admin/overwritten-data-gutmann.html
