Disk and File Shredders: A Comparison

Contents

• Overview
• Feature Summary
• Recommendations
• General Notes and Observations
• Defragmenting and Shredding Free Space
• Securely Deleting Registry Entries
• Windows 9x/Me
• Windows NT
• Windows 2000
• Test Methods

Overview

The comparison currently covers the following software packages:

• BCWipe (v2.25)
• BCWipe (v2.27.2)
• BCWipe (v2.28)
• Burn-it! (v1.0.1)
• Clean Disk Security (v4.1)
• Disk CleanUp (v3.5)
• East-Tec Eraser (v2.0, build 2.0.0.154)
• Eraser (v3.00.2308)
• Eraser (v3.60.3339)
• Eraser (v4.00.3543)
• File Destroyer (v1.00)
• File Shredder 98 (v3.3.0)
• Invincible Shred (v1.0.0.1)
• Kremlin (v2.21)
• McAfee Shredder (Nuts'n'Bolts 98)
• Mutilate File Wiper (v2.33)
• PeekBoo (v2.01a)
• PGP Wipe (v6.0.2i)
• Puffer (v3.0c)
• Reflex Data Shredder (v1.2 Ref (120))
• SAFE Erase (v1.01)
• Scorch (v1.01)
• Scorch (v1.02) and Scour (v1.00)
• ScramDisk (v2.02h)
• SecureShred (v1.0 (SR-2))
• Shiva, Destroyer of Files (v2.05)
• Shredder95 (v1.16)
• Shredder Lite (v2.0)
• Skratchit Secure Delete (v1.0)
• Terminus (v4.0, build 39)
• WipeClean (v2.0)
• WipeInfo (Norton Utilities v8.0)
• WipeInfo (Norton Utilities 2000 v4.5)

Feature Summary

Recommendations

With respect to the Windows swap file, I would recommend not using one! Memory is continuously coming down in price, and I would highly recommend buying a couple of hundred MB or so, such that you do not need a swapfile; this would also lead to performance improvements. However, for those who do not wish to do this for any reason, and since "Eraser" does not have adequate provision for overwriting the Windows swap file (at least, not under Windows 95/98), it is therefore necessary to recommend another package for this purpose. "Clean Disk Security" by Kevin Solway looks like the candidate for this operation, with multiple pass options and operation from DOS. At $25 this is pretty expensive, and users may prefer to opt for "Scorch" combined with "Swap File Overwriter"

"Eraser" and "Clean Disk Security" allow the use of Gutmann overwriting.

For those who are really paranoid, it is also suggested that you overwrite sensitive data, not only using the maximum security settings provided by a shredder, but to also use several different shredders. This is for the same reasons that it is recommended when using anonymous remailers, you chain more than one of them together to ensure that any weaknesses in system are compensated for in the others.
 

General Notes and Observations

1. In all packages that were able to purge free space and overwrite previously deleted filenames, it was still possible in some cases to recover the full directory path in which deleted files were previously stored.
2. If you would like shell support for a package that does not support this directly, but does support operation from the command line, you can simply add a shortcut in your "SendTo" directory for the shredder. This directory can be found in your Windows directory (Windows 95/98) or in your profile directory (Windows NT)
3. Performance in terms of speed was not measured during testing due to the large number of different overwrite algorithms in use; this cannot easily be measured fairly
4. Some of the entries in the table above read "Yes - see WARNING in notes below", in many of these cases the word "Yes" reports only what the developers claim, which is not necessarily true - the notes at the bottom of the relevant column to get a better picture of the software
5. Write caching has the potential to reduce the effectiveness of shredder software, unless the disk buffers are specificly flushed regularly while shredding is in progress. (For example, if the overwriting package creates a temporary file, overwrites it, and then deletes it while it is still in the cache, Windows may well try to be "smart" and delete the file in the cache, meaning that it will never actually be written to the disk.) AFAIR, Windows 95/98 have write caching enabled by default on desktop configurations. If you do use one of these OS's, and have disk caching enabled, it's probably a good idea to disable it. This can be achieved by carrying out the following steps:
• To disable write-behind cache:
1. Open Control Panel and doubleclick on the "System" icon.
2. Select the "Performance" tab, and then "File System"
3. Select the "Removable Disk" tab and ensure that the "Disable write-behind caching for all drives" checkbox is checked
• To disable write-behind caching for removable disk drives
1. Open Control Panel and doubleclick on the "System" icon.
2. Select the "Performance" tab, and then "File System"
3. Select the "Removable Disk" tab and ensure that the "Enable write-behind caching on all removable disk drives" checkbox is not checked.
Due to the poor reliability of Windows 95/98, this is recommended anyway since you are more than a little likely to experience a system crash sooner or later (most probably sooner). In which case, any data that has not been flushed to disk will be lost as you reboot. Secondly, write-behind caching apparently sometimes causes problems with real-time processes.
Having said which, turning off caching as described above can have a decremental effect on your computers performance and additionally, it is possible for sensitive information to be written to disk that would not written to it. For example, if you have a Word document you are working on, Word may well create a temporary file with some (or all) of your documents contents. With disk write caching disabled, this file will be written directly to your HDD, but with disk write caching enabled, this file may not ever be written to disk provided Word deletes it's temporary file before the cache is flushed to disk.
6. The documentation supplied with PGP (PGP Wipe) claims that commercial companies have been known to recover data that has been overwritten up to 9 times. The author of "Scorch" appears to think that just one pass will suffice. The Gutmann paper (see link below) concludes that that it is not possible to eradicate 100% of your data, regardless of how many times it is overwritten, but it is possible to make it prohibitively expensivve to recover it.
7. DoD 5220.22-M is sometimes referred to as "NIS" or "NISPOM" shredding
8. For a description of DoD 5220.22-M shredding, see the DoD 5220.22-M National Industrial Security Program Operating Manual (NISPOM), and in particular, chapter 8; "Automated Information System Security"
9. Gutmann shredding is the most secure (35 passes of certain specific characters) and is designed to prevent both software and hardware based data recovery methods). For a full description of Gutmann shredding, see Peter Gutmann's paper, "Secure Deletion of Data from Magnetic and Solid-State Memory"
10. BCWipe uses DoD 5200.28-STD; an older (December 1985) version of DoD 5220.22-M
11. For a description of DoD 5200.28-STD, see the DoD Trusted Computer System Evaluation Criteria (also available in text, postscript, gzipped postscript and Adobe Acrobat (pdf) formats)
12. Windows NT has the capability of automatically shredding your swapfile on shutdown; see Microsoft knowledgebase article Q182086: How to Clear the Windows NT Paging File at Shutdown
13. For shredding Windows 95/98 swapfiles, restarting the computer in DOS and running your shredder from DOS is required, even though this can be annoying (less so when using Windows 98), due to the fact that this is the only way that the overwriting of the entire swapfile cannot reliably be achieved otherwise without risking a fatal system crash brought on by overwriting data currently being used by the computer. Some of the shredders reviewed above have the capability of shredding the swapfile from within Windows (for example "BCWipe" and "ScramDisk"), however (AFAIK) the method they use to do so is to simply allocate large amounts of memory, which will automatically be swapped out to disk, overwriting it's previous contents. This does not sound like a particularly secure idea... Writing to the swapfile directly while under Windows is not possible.
14. It you do use a swapfile overwriter, it is recommended that you do not let Windows manage the size of this file. If you were to shred your free diskspace under Windows, and then reboot into DOS to overwrite the swapfile, you could find that while the free space was being shredded, Windows had setup a large swapfile (say 150MB), which it reduced down during shutdown (say to 25MB). In this case, even if you overwrote remaining swapfile, you could potentially have part of what was previously stored in the swapfile (125MB of it, in this example) still held on your HDD. You can change your swapfile settings by going to Control Panel->Performance->Virtual Memory. To work the size of the swapfile needd, I would recommend using flipTech SwapMon over a long period of time.
15. Under NT, renaming a file will cause the old filename to be overwritten, however this trick does not work under Windows 95/98, where renaming a file has the effect of marking the old filename entry as deleted (without overwriting it), and creating a new directory entry with the new filename. However, under Windows 95/98, if the new filename is the same length as the old one, then the new filename should overwrite the old filename.
16. When shredding information on compressed drives; use a shredder that has at least one pass of random characters. Using a shredder that only overwrites with 1's for example, could result in the data that would otherwise overwrite your data being compressed, and not overwriting all your data.
17. Don't forget to empty your recycle bin before overwriting free space!
18. Not directly related to shredders, but: please, do remember that some software packages (for example, MS Word) do not always delete data when you hit the "delete" key. For example, create a document in Word containing one line that consists of the the words "This is a demonstration of MS Word leaking my sensitive information!". Save the file. Delete the line of text. Save the file under the same filename. Launch a hex editor and look for the text previously entered; you'll probably find it. To prevent this, instead of saving the file a second time under the original filename, save it as something else, and delete the original. The file can always be renamed afterwards.
19. For all packages, for "random" read "psyeudorandom"
20. If you are considering defragmenting your HDD, it would be better if you shred the free space on that drive both before and after defragmenting (see explanation below).
21. If you have any kind of "delete protection" or "recycle bin protection" to prevent you from accidently deleting files, it might be a good idea to turn this off before you shred any files. Obvious, I know, but there's always one...
22. Shredding any given file or directory does not necessarily mean that that file/directory is 100% destroyed. It is quite possible that during it's life on your HDD it has been copied, moved around, etc, and fragments, if not all of it/them still exist in the free areas of your HDD. A full freespace-wipe is normally needed to ensure total destruction.
23. As far as I am aware there are currently only two other shredder reviews available on the 'net at present The first being East-Tec Eraser vs. Other File Deletion Programs, which was done by East-Tec (who created "East-Tec Eraser"), and the second is Shredder vs. Other File Deletion Programs (a .PDF file; you'll need Adobe Acrobat to read it) by infraworks (who created "Shredder" and "Shredder Lite"). Please note that these reviews were written by people who are trying to sell you their shredder software. You can probably guess which shredder comes out best in each of these reviews ;)

Defragmenting and Shredding Free Space

You delete file2, and your FAT looks something like this:
 

You now defrag.
 

file3 overwrites the area where file2 (containing sensitive information) was. Since it is possible to recover data that has been overwritten (this is why many shredders have the ability to overwrite many times), it is theoretically possible for file2 to be recovered from under file3, since it was only overwritten once.

OK, now having said this, let's think about the downside of wiping free space before you defrag.

We'll take a slightly different scenario here. This time, we delete our sensitive file after we have defragged the drive.

To begin with, we have:
 

as before.

Then we defrag. But! The defrag program decides that the optimum order for your files is: file1, file3, file2 (in this example, the defrag software positions your files on your HDD in order of size)
 

However, while defragging the drive, the defrag software needs to move file2 out of the way somewhere, so that it wouldn't get overwritten by file3:
 

As a result of this, as well as having a copy of file2 between clusters 300-499, you also have a copy of this file's contents on the disk between clusters 3000-3199.

If you then decide to shred file2, using even the most secure shredder available, you will still have that 2nd copy of file2 on clusters 3000+!

Best solution: Wipe your free space both before and after defragging.

Securely Deleting Registry Entries

Windows 9x/Me

1. Take a backup of your SYSTEM.DAT and USER.DAT files in case anything goes wrong (these files make up your registry)
2. Run

REGEDIT.EXE

and export your whole registry to a file (export everything)
3. Boot to DOS
4. Run:

REGEDIT /c <filename of exported registry>

(this can take awhile; about 20mins on my test system)

This is just a simple summary of the process; if you would like further information, or more detailed instructions (though it is pretty easy!) on how to rebuild your registry, please check on the WWW.

Windows NT

NT's registry is implemented as a database.

It shares many of the characteristics including fragmentation as items are added, removed, or changed. In particular, when items are removed from the registry, there is no cleanup mechanism to recover the now unused space in the database. Microsoft released RegClean to clean up some of the debris. A alternative to Microsoft's RegClean is the freeware Regcleaner.

Fragmentation can become significant over time on a busy system. Use either tool with caution. There is no tool to compress the registry, to recover lost space and reindex the fundamental database. But there is a method to achieve this result. Backup the registry and be prepared to get back to where you started if things go wrong.

Update the "%systemroot\repair" directory using the command:
 

rdisk /s-

"rdisk" will update repair data including the default, software and system hives. The repair version of the hives is compressed and reorganized. It is not an image copy. Adding the "/s" parameter gets the sam and security hives. The dash ("-") instructs rdisk to not make a floppy disk copy.

Expand the registry hives to a temporary location:
 

expand %systemroot%\repair\default._ C:\temp\reg\default
expand %systemroot%\repair\sam._ C:\temp\reg\sam
expand %systemroot%\repair\security._ C:\temp\reg\security
expand %systemroot%\repair\software._ C:\temp\reg\software
expand %systemroot%\repair\system._ C:\temp\reg\system

A comparison of the files sizes in "%temp%" and "%systemroot%\system32\config" can reveal significant differences in size. If the sizes are close, the hive in question did not have much lost space to recover. Usually the software hive has the greatest space recovery.

Replace the version in %systemroot%\system32\config with the newly reindexed version in %temp%. NT keeps the hives open and locked.

You can not simply copy the new version over the old versions. To get around this problem, you need to make the copy when NT is not loaded. For a FAT-based installation, bootup using DOS and make the copy using the DOS COPY command. For NTFS-based installations, I recommend using a recovery or backdoor copy of NT. Install NT on the PC in a different directory. Boot under the secondary NT and copy the hives for the inactive primary NT installation.

There is some risk in this procedure. But as the hives get large with a high amount of dead space, performance suffers. If your server or
workstations gets slower and slower for no apparent reason, you may get the performance back using this approach.

Do not attempt if you are not in a position to recover back to the starting point.

An alternative is the freeware Regcleaner.

Another alternative is the donationware RegCompact.
 

Windows 2000

The method described above for Windows NT is not possible as Microsoft removed "rdisk" on the basis that the Windows 2000 environment is too large to fit on a floppy disk

However, if you try to create an Emergency Recovery Disk (ERD) by going to "Start|Programs|Accessories|System Tools|Backup|Emergency Repair Disk", the registry hives should be copied to the "%system32%\repair\Regback". From this point it may be possible to continue, as per the Windows NT instructions above.

Test Methods

This MD5 information can be used to verify that the package you download is the same one that was used during testing. The MD5 utility can be obtained from http://www.fourmilab.ch/md5/ (or download direct)

Directory Snoop is a freeware disk examination tool (works with 95/98 and FAT12/FAT16/FAT32, not NT) which is useful for checking the contents of individual clusters on your HDD and can be found at Briggs Softworks. I used v2.1 for running the above tests to ensure that data was being overwritten correctly. v2.1 was used as it was the last freeware version; the latest version, which is shareware, can be downloaded direct from here

File Rescue is a shareware undelete utility, and can be downloaded from http://www.file-rescue.com/. The demo version of this software will only permit you to recover up to 5 files, but even after expiring, will still show you a list of all files that have been deleted and may be recoverable.

Email me at: sdean12@sdean12.org

Return to the main page