Guarding Against Undelete

A Backup Article Contributed by Ashley Lister

Guarding Against Undelete

Undelete is not always a required function.

Sometimes Undelete Can Be the Last Thing a User Wants.

Occasionally files will be erased by accident, sometimes files will be deleted in the process of a virus attack, and there are times when hard drive catastrophes can render files lost and inaccessible. But there are also times when a user hits the delete button and means it. Most computer users will be able to recall a time when they were faced with a file - whether it was a photograph, a word document or a spreadsheet - and remember that it begged to be destroyed.

In circumstances like those, no one wants to think that a simple undelete utility might be able to retrieve data that they wanted eradicating for ever. In circumstances like those it is far more comforting to know that there was an operation you could use that would render an undelete utility useless.

Undelete Rendered Useless.

Perversely, a lot of undelete utilities come supplied with software that can "shred" files when you do want them deleting. Shredding" refers to the traditional method of passing paper copies of files through a shredding machine that cuts each page into strips or confetti. In computer parlance "shredding" is the process whereby a cluster of sectors aren't simply marked for delete in the File Allocation Tables.

In the process of shredding the sectors and clusters that previously contained the data marked for deletion are wiped clean of information and written over repeatedly. Depending on the security style of the software involved, and the level of thoroughness being employed, this write over process can be performed a dozen times or more, making it impossible to retrieve the deleted data.

This sort of feature would almost certainly make it impossible for an undelete utility to retrieve the lost information.

Undelete utilities work on an understanding of the indexes in the File Allocation Tables. If a file has been recently deleted (without any special utility) there is a strong chance of it being recovered from the hard drive. The undelete utility will be able to see where the file was previously located and it will know which clusters to restore to finalize the undelete. But, in situations where the information has been shredded repeatedly, there is a strong chance that undelete might not be effective.

A Final Word on Behalf of Undelete.

These applications can help to keep confidential data absolutely confidential. Once a file has been "shredded" by one of these applications there are few undelete utilities that would be able to retrieve or restore the deleted information.

But it should not be considered a failsafe way of removing illegal material from a computer, because computer forensics teams have utilities that go way beyond the capacity of the average undelete software.

And it should be remembered,one of the greatest dangers of disabling undelete facilities in this way is, once a file has gone, it could very well be gone for good.