Completely delete a file
-
Hello all, I got a new question for you today :) I've been playing around with the concept of wiping files from a thumbdrive and it seems to be working pretty well. I have the code below and the file seems to be overwritten as they should. I have tested Ontrack EasyRecovery and PC Inspector File Recovery and I wasn't able to get any viewable data back. The only annoying thing is that booth recovery-applications were able to bring back the filename of the overwritten file which I don't want of course. If I don't rename the file before overwriting it, all that is recovered is a zero-byte file with the correct filename. If I rename it first, I can recover a file with the correct filename and size but the data is destroyed. So what I'm asking for is, is there a way to completely delete a file or change the name of the file permanently so it can't be recovered.
private void WipeFile(string filename, int timesToWrite)
{
if(File.Exists(filename))
{
// Rename the file
string newFileName = Path.GetDirectoryName(filename) + GetRandomFileName();
File.Move(filename, newFileName);
filename = newFileName;// Create a buffer for the dummy-data byte\[\] dummyBuffer = new byte\[new FileInfo(filename).Length\]; RNGCryptoServiceProvider rng = new RNGCryptoServiceProvider(); // Fill the buffer with random data rng.GetBytes(dummyBuffer); // Write to the file n times for (int timesWritten = 0; timesWritten < timesToWrite; timesWritten++) { FileStream inputStream = new FileStream(filename, FileMode.Create); inputStream.Write(dummyBuffer, 0, dummyBuffer.Length); // Get some new dummy-data rng.GetBytes(dummyBuffer); inputStream.Close(); } // Create a zero-byte file FileStream tmpStream = new FileStream(filename, FileMode.Create); tmpStream.Close(); File.Delete(filename); }}
http://johanmartensson.se - Home of MPEG4Watcher
Oh, and... in the file eraser I wrote for myself (in C) last June wipes the entire last sector (512 bytes), not just the part that was used by the file. This can help disguise the original length of the file. Unless you know you'll only wipe small files I wouldn't allocate a buffer the size of the file; why not a fixed buffer size of 512 bytes?
-
Oh, and... in the file eraser I wrote for myself (in C) last June wipes the entire last sector (512 bytes), not just the part that was used by the file. This can help disguise the original length of the file. Unless you know you'll only wipe small files I wouldn't allocate a buffer the size of the file; why not a fixed buffer size of 512 bytes?
Wiping the last sector might help, but I'm not sure how I would implement such a thing. I have only worked with filestreams and I have no idea how to read/write directly to the sectors, so could you point me in a direction of how to do that? I guess what I'm looking for now is a way to get the exact sectors that a file occupies and write to those. From what I understand I should probably look at the W32 API functions ReadFile/WriteFile but I havent been able to find any C# examples.
http://johanmartensson.se - Home of MPEG4Watcher
-
Wiping the last sector might help, but I'm not sure how I would implement such a thing. I have only worked with filestreams and I have no idea how to read/write directly to the sectors, so could you point me in a direction of how to do that? I guess what I'm looking for now is a way to get the exact sectors that a file occupies and write to those. From what I understand I should probably look at the W32 API functions ReadFile/WriteFile but I havent been able to find any C# examples.
http://johanmartensson.se - Home of MPEG4Watcher
double sectors = System.Math.Ceiling ( filelength / 512 ) ;ought to work. Whoops, I mean 512.0modified on Friday, January 04, 2008 12:17:33 PM
-
double sectors = System.Math.Ceiling ( filelength / 512 ) ;ought to work. Whoops, I mean 512.0modified on Friday, January 04, 2008 12:17:33 PM
That gives me the total number of sectors a file occupies, right? So I should still find a way to figure out which sectors the file occupies and find out how to write some random data do those specific sectors?
http://johanmartensson.se - Home of MPEG4Watcher
-
That gives me the total number of sectors a file occupies, right? So I should still find a way to figure out which sectors the file occupies and find out how to write some random data do those specific sectors?
http://johanmartensson.se - Home of MPEG4Watcher
No, the operating system knows them.
-
No, the operating system knows them.
So I have cleaned up the code a bit and created a fixed buffer instead (which I should have done from the start :)) The wiping of the entire last sector works fine, a text-file that was 18 bytes showed up as 512 bytes when recovered, with garbage data in it of course, so thanks for that one. But then again, having the lines below before deleting the file, it shows up as 0 bytes when recovered.
FileStream tmpStream = new FileStream(filename, FileMode.Create);
tmpStream.Close();Now I only have to get rid of the filename that shows up when trying to recover the file. I did try to rename it but that didn't work, I think it has to do with the fact that it's moved, is there really no other way of renaming files in C#? Current code:
private void WipeFile(string filename, int timesToWrite)
{
if(File.Exists(filename))
{
byte[] dummyBuffer = new byte[512];
RNGCryptoServiceProvider rng = new RNGCryptoServiceProvider();
rng.GetBytes(dummyBuffer);double filelength = new FileInfo(filename).Length; double sectors = System.Math.Ceiling(filelength / 512); for (int timesWritten = 0; timesWritten < timesToWrite; timesWritten++) { FileStream inputStream = new FileStream(filename, FileMode.Open, FileAccess.Write, FileShare.None); int sectorsWritten = 0; while (sectorsWritten < sectors) { inputStream.Write(dummyBuffer, 0, dummyBuffer.Length); rng.GetBytes(dummyBuffer); sectorsWritten++; } inputStream.Close(); } FileStream tmpStream = new FileStream(filename, FileMode.Create); tmpStream.Close(); File.Delete(filename); }}
http://johanmartensson.se - Home of MPEG4Watcher
modified on Friday, January 04, 2008 6:33:34 PM
-
So I have cleaned up the code a bit and created a fixed buffer instead (which I should have done from the start :)) The wiping of the entire last sector works fine, a text-file that was 18 bytes showed up as 512 bytes when recovered, with garbage data in it of course, so thanks for that one. But then again, having the lines below before deleting the file, it shows up as 0 bytes when recovered.
FileStream tmpStream = new FileStream(filename, FileMode.Create);
tmpStream.Close();Now I only have to get rid of the filename that shows up when trying to recover the file. I did try to rename it but that didn't work, I think it has to do with the fact that it's moved, is there really no other way of renaming files in C#? Current code:
private void WipeFile(string filename, int timesToWrite)
{
if(File.Exists(filename))
{
byte[] dummyBuffer = new byte[512];
RNGCryptoServiceProvider rng = new RNGCryptoServiceProvider();
rng.GetBytes(dummyBuffer);double filelength = new FileInfo(filename).Length; double sectors = System.Math.Ceiling(filelength / 512); for (int timesWritten = 0; timesWritten < timesToWrite; timesWritten++) { FileStream inputStream = new FileStream(filename, FileMode.Open, FileAccess.Write, FileShare.None); int sectorsWritten = 0; while (sectorsWritten < sectors) { inputStream.Write(dummyBuffer, 0, dummyBuffer.Length); rng.GetBytes(dummyBuffer); sectorsWritten++; } inputStream.Close(); } FileStream tmpStream = new FileStream(filename, FileMode.Create); tmpStream.Close(); File.Delete(filename); }}
http://johanmartensson.se - Home of MPEG4Watcher
modified on Friday, January 04, 2008 6:33:34 PM
Better. Rather than opening and closing the stream each time you could set the Position back to 0. (Flushing might be required.) I'd eliminate the needless local variable
filelength(but maybe that's just me). Shouldn't there be a way to truncate a file? As to the filename; I suspect anyone snooping for data will bypass the FAT (or whatever) and access the disk more directly so I wouldn't be too concerned about it. At one point I wanted to recover some files from a 5.25" floppy with a corrupted FAT. Using DOS 6 and "Function 440Dh Minor Code 61h Read Track on Logical Drive" I was able to do so. That article to which I gave you a link talks about more advanced snooping techniquse than that. -
Better. Rather than opening and closing the stream each time you could set the Position back to 0. (Flushing might be required.) I'd eliminate the needless local variable
filelength(but maybe that's just me). Shouldn't there be a way to truncate a file? As to the filename; I suspect anyone snooping for data will bypass the FAT (or whatever) and access the disk more directly so I wouldn't be too concerned about it. At one point I wanted to recover some files from a 5.25" floppy with a corrupted FAT. Using DOS 6 and "Function 440Dh Minor Code 61h Read Track on Logical Drive" I was able to do so. That article to which I gave you a link talks about more advanced snooping techniquse than that.The filestream has the ability to truncate...
FileStream tmpStream = new FileStream(filename, FileMode.Truncate);
tmpStream.Close();but I get the same result using
FileStream tmpStream = new FileStream(filename, FileMode.Create);
tmpStream.Close();I'm not really sure what the difference is, they booth create a zero-byte file.
http://johanmartensson.se - Home of MPEG4Watcher
-
The filestream has the ability to truncate...
FileStream tmpStream = new FileStream(filename, FileMode.Truncate);
tmpStream.Close();but I get the same result using
FileStream tmpStream = new FileStream(filename, FileMode.Create);
tmpStream.Close();I'm not really sure what the difference is, they booth create a zero-byte file.
http://johanmartensson.se - Home of MPEG4Watcher
I was hoping it could be truncated after it's been opened. That second one will (may?) create the new file in a different spot on the disk.
-
I was hoping it could be truncated after it's been opened. That second one will (may?) create the new file in a different spot on the disk.
After a little digging I found the FileStream.SetLength Method which truncates the file if the given value is less than the current length. After using the code below, when trying to recover the file, I end up with a zero-byte file with the dates set to January 2037 and the space on the disc where the file used to be is filled with garbage. So what's accomplished now is, the file is overwritten with garbage data n times, the original filesize and dates removed. Even though the filename will keep haunting me and I'll keep looking for a solution, I believe the file is pretty much wiped out and can't be recovered with any standard methods.
private void WipeFile(string filename, int timesToWrite)
{
if(File.Exists(filename))
{
File.SetAttributes(filename, FileAttributes.Normal);double sectors = System.Math.Ceiling(new FileInfo(filename).Length / 512.0); byte\[\] dummyBuffer = new byte\[512\]; RNGCryptoServiceProvider rng = new RNGCryptoServiceProvider(); rng.GetBytes(dummyBuffer); FileStream inputStream = new FileStream(filename, FileMode.Open); for (int timesWritten = 0; timesWritten < timesToWrite; timesWritten++) { inputStream.Position = 0; int sectorsWritten = 0; while (sectorsWritten < sectors) { inputStream.Write(dummyBuffer, 0, dummyBuffer.Length); rng.GetBytes(dummyBuffer); sectorsWritten++; } } inputStream.SetLength(0); inputStream.Close(); DateTime dt = new DateTime(2037, 1, 1, 0, 0, 0); File.SetCreationTime(filename, dt); File.SetLastAccessTime(filename, dt); File.SetLastWriteTime(filename, dt); File.Delete(filename); }}
http://johanmartensson.se - Home of MPEG4Watcher
-
After a little digging I found the FileStream.SetLength Method which truncates the file if the given value is less than the current length. After using the code below, when trying to recover the file, I end up with a zero-byte file with the dates set to January 2037 and the space on the disc where the file used to be is filled with garbage. So what's accomplished now is, the file is overwritten with garbage data n times, the original filesize and dates removed. Even though the filename will keep haunting me and I'll keep looking for a solution, I believe the file is pretty much wiped out and can't be recovered with any standard methods.
private void WipeFile(string filename, int timesToWrite)
{
if(File.Exists(filename))
{
File.SetAttributes(filename, FileAttributes.Normal);double sectors = System.Math.Ceiling(new FileInfo(filename).Length / 512.0); byte\[\] dummyBuffer = new byte\[512\]; RNGCryptoServiceProvider rng = new RNGCryptoServiceProvider(); rng.GetBytes(dummyBuffer); FileStream inputStream = new FileStream(filename, FileMode.Open); for (int timesWritten = 0; timesWritten < timesToWrite; timesWritten++) { inputStream.Position = 0; int sectorsWritten = 0; while (sectorsWritten < sectors) { inputStream.Write(dummyBuffer, 0, dummyBuffer.Length); rng.GetBytes(dummyBuffer); sectorsWritten++; } } inputStream.SetLength(0); inputStream.Close(); DateTime dt = new DateTime(2037, 1, 1, 0, 0, 0); File.SetCreationTime(filename, dt); File.SetLastAccessTime(filename, dt); File.SetLastWriteTime(filename, dt); File.Delete(filename); }}
http://johanmartensson.se - Home of MPEG4Watcher
Excellent! Now I've learned something too. :-D Now, remove the first
rng.GetBytes(dummyBuffer);and swap the lines:inputStream.Write(dummyBuffer, 0, dummyBuffer.Length); rng.GetBytes(dummyBuffer);Perhaps use aforloop rather than awhileloop (both loops might as well be the same type as they do similar things). -
Excellent! Now I've learned something too. :-D Now, remove the first
rng.GetBytes(dummyBuffer);and swap the lines:inputStream.Write(dummyBuffer, 0, dummyBuffer.Length); rng.GetBytes(dummyBuffer);Perhaps use aforloop rather than awhileloop (both loops might as well be the same type as they do similar things).I just wanted to say thanks for your help... I have put together an article in case someone else have any use for this function. http://www.codeproject.com/KB/cs/SharpWipe.aspx[^]
http://johanmartensson.se - Home of MPEG4Watcher