What is the best way to wipe the free space.

Security software can wipe the free space of a drive, but this takes
time and the wipe is never complete.

Is it better to take an image of the drive to and external one, and
then wipe all of the original drive completely, and then restore the
image?

(Assuming the imaging procedure backs up only undeleted material.).
Peter

On 12/8/2015 7:41 PM, Peter Jason wrote:
Security software can wipe the free space of a drive, but this takes
time and the wipe is never complete.

Is it better to take an image of the drive to and external one, and
then wipe all of the original drive completely, and then restore the
image?

(Assuming the imaging procedure backs up only undeleted material.).
Peter

The devil is in the details.
Exactly what are you trying to accomplish???

I've been using DataEraser.
http://www.ss-tools.com/data-eraser/
It optionally wipes the free space and/or the stuff left over
between the end of the file and the end of the cluster.

IIRC, the free version only overwrites once, while the paid
version can do multiple writes.

My assumption is that you can't recover much without
disassembling the drive. Oughta be plenty good for casual users.

Peter Jason wrote:
Security software can wipe the free space of a drive, but this takes
time and the wipe is never complete.

Is it better to take an image of the drive to and external one, and
then wipe all of the original drive completely, and then restore the
image?

(Assuming the imaging procedure backs up only undeleted material.).
Peter

I would think that the free space should be wiped BEFORE making a drive image.

On Wed, 09 Dec 2015 14:41:34 +1100, Peter Jason wrote:

Security software can wipe the free space of a drive, but this takes
time and the wipe is never complete.

Is it better to take an image of the drive to and external one, and then
wipe all of the original drive completely, and then restore the image?

(Assuming the imaging procedure backs up only undeleted material.).
Peter

I'm a little confused as to what you are doing. If you restore the image
what exactly is it you seek to protect.
If you are keeping the machine why do you care about erased clusters.
If you are disposing of the drive, then physical destruction is quicker
and safer. In lieu of that, there are many free utilities that will wipe
the whole drive.
Despite the plethora of folks in this and other groups that can readily
recover overwritten data I will believe it when I see it.
If we are talking about folks in the NSA or FBI then you are posting in
the wrong group.

On Wed, 09 Dec 2015 14:41:34 +1100, Peter Jason wrote:

Security software can wipe the free space of a drive, but this takes
time and the wipe is never complete.

Is it better to take an image of the drive to and external one, and
then wipe all of the original drive completely, and then restore the
image?
Modern drives typically have an erase operation to do its best
job of erasing (which might not work perfectly, even though they
give an error message it they think things didn't work. This


Before cloning/imaging/copying the data back, you might want
to set it to use drive based encryption. That way you won't have
to worry when ultimately disposing of the drive later,

(Assuming the imaging procedure backs up only undeleted material.).

For cloning and imaging copying only the undeleted only
it the typical goal, but cloning often gets extra stuff in the
metadata since it is trying to preserve everything that is needed.
Imaging probably doesn't get extra meta data, but probably doesn't
work correctly when file by file copying wouldn't work in the
first place.

The problem is that some cloning programs copy complete clusters,
even though they are not fully used in the current file.
Therefore I would run www.briggsoft.com Puffer to Wipe "Slack..." or
other program after cloning back the data.
This will get rid of stuff at the end; I'm
not sure that you can get partial clusters in the middle of files,
but perhaps you can with sparse files, in which case I don't know
of a program to fix things.

Also, I don't know what happens to stuff in unused metadata
areas ($MFT, $MFTMirr). There might be stuff there,
so you might have to use EAST Technologies East-Tec Eraser or similar
program to get rid of that stuff, but I don't know if any of those
programs actually work completely.

If a partition is data only, you may get better results by
using a file copy program to get things back to the original
disk. I use Syncovery.


Peter

(OOPS - hit send before finishing. Look for "{insert here}"
in 2 places below.)
On Wed, 09 Dec 2015 18:20:36 -0500, Mark F
wrote:

On Wed, 09 Dec 2015 14:41:34 +1100, Peter Jason wrote:

Security software can wipe the free space of a drive, but this takes
time and the wipe is never complete.

Is it better to take an image of the drive to and external one, and
then wipe all of the original drive completely, and then restore the
image?
{insert here} First make the clone/image/copy. Then use
the erase everything including spares/overprovisioning
command.

Modern drives typically have an erase operation to do its best
job of erasing (which might not work perfectly, even though they
give an error message it they think things didn't work. This
{insert here}
takes about as long as it takes to write the entire disk.

Many modern drives have a cryptographic erase, which
trashes the encryption key, so a cryptographically
secure erase is very fast. Often, if the drive supports
encryption it is always encrypted, even though key entry
isn't needed. The problem is that if there is a back door,
then things might not really be gone.

There is also the issue of data in the cache chips
on the board and data on hidden blocks of the disk
for firmware and such. Perhaps there is leftover
data there from the old contents of the drive that
hangs around. {SSDs also typically have a cryptographic
erase and an erase everything [including the overprovisioning/spares]
operations. Again, firmware and cache is not included
in "everything including overprovisioning/spares", so there
could possibly be data that lingers for spinning and non-spinning.}


Before cloning/imaging/copying the data back, you might want
to set it to use drive based encryption. That way you won't have
to worry when ultimately disposing of the drive later,

(Assuming the imaging procedure backs up only undeleted material.).

For cloning and imaging copying only the undeleted only
it the typical goal, but cloning often gets extra stuff in the
metadata since it is trying to preserve everything that is needed.
Imaging probably doesn't get extra meta data, but probably doesn't
work correctly when file by file copying wouldn't work in the
first place.

The problem is that some cloning programs copy complete clusters,
even though they are not fully used in the current file.
Therefore I would run www.briggsoft.com Puffer to Wipe "Slack..." or
other program after cloning back the data.
This will get rid of stuff at the end; I'm
not sure that you can get partial clusters in the middle of files,
but perhaps you can with sparse files, in which case I don't know
of a program to fix things.

Also, I don't know what happens to stuff in unused metadata
areas ($MFT, $MFTMirr). There might be stuff there,
so you might have to use EAST Technologies East-Tec Eraser or similar
program to get rid of that stuff, but I don't know if any of those
programs actually work completely.

If a partition is data only, you may get better results by
using a file copy program to get things back to the original
disk. I use Syncovery.


Peter