Best Free Secure Erase Utility

Data Recovery Risk

We've all heard the horror stories about someone buying a used hard drive at a flea market or garage sale and then finding tons of personal data left on the drive by the previous owner. Or even worse, people getting their credit trashed by ID thieves that make their living by taking that information and using it to wipe you out financially. "That would never happen to me," you say. "I'll delete all the files first" or "I'll re-format the drive before I trade it in or sell it." Not so fast there Scooter! That data you think you erased is still stored on the drive.

When you delete a file it isn't really removed from the disk. The operating system (OS) only removes the reference to the file from the file allocation table. This is like going into a book or magazine and removing a chapter reference from the table of contents. The actual chapter is still in the book. The only thing removed was the page number reference in the table of contents. With the file location reference removed the OS now sees that disk space as being available for use. However, the file content remains on the disk until another file is written over it. Basically the same thing happens when you re-format a hard drive. Most of the data remains; the space on the drive is just made available to be written over.

The DOS and Windows file systems use groups of disk sectors, known as clusters, to store data. These clusters are of a fixed size which is normally determined by the size and number of partitions of the disk volume itself and the file system being used. If the data you're storing requires less space than a full cluster, the entire cluster is still reserved. For example, you've saved a file that required 15.5 clusters of drive space. Because the OS can't reserve a half cluster, the allocation table had to reserve 16 whole clusters for the file. That remaining half cluster that was not used may still contain data from a previous file. That unused half cluster is known as "slack space". Data recovery programs can read slack space and retrieve the data stored there. Even worse, let's say the file system places your 15.5 cluster file over the "unused" area of a deleted file that originally took up 35 clusters. More than half of the previous file would still be retrievable! You could have thousands of clusters on your hard drive (a.k.a free space) that contain data you thought was deleted! Scary thought, huh?

Secure Deletion: Dealing with the Risk

The only true and permanent way to make data irretrievable is to completely and utterly destroy the hard drive (especially if a government sends your hard drive to a multi-million dollar forensic laboratory for a full microscopic analysis!). Except for cheap flash drives, destruction is probably a little more severe than you or I need. We really only need to make sure we are protected from data recovery programs and the like. That's where the programs in this category come into play.

To be as safe as possible, you must overwrite (erase) both slack space and free space. Also, the Windows swap file (a.k.a page file) could contain private data that you wouldn't want to have fall into the wrong hands.

In the epilogue to Peter Gutmann's secure deletion paper, he notes the importance of huge hard drive sizes and the use of perpendicular recording on modern computers.

In the time since this paper was published, some people have treated the 35-pass overwrite technique described in it more as a kind of voodoo incantation to banish evil spirits than the result of a technical analysis of drive encoding techniques... It will have no more effect than a simple scrubbing with random data. In fact performing the full 35-pass overwrite is pointless for any drive... If you're using a drive which uses encoding technology X, you only need to perform the passes specific to X, and you never need to perform all 35 passes. For any modern PRML/EPRML drive, a few passes of random scrubbing is the best you can do. As the paper says, "A good scrubbing with random data will do about as well as can be expected". This was true in 1996, and is still true now.

Looking at this from the other point of view, with the ever-increasing data density on disk platters..., it's unlikely that anything can be recovered from any recent drive except perhaps a single level via basic error-canceling techniques. In particular the drives in use at the time that this paper was originally written have mostly fallen out of use, so the methods that applied specifically to the older, lower-density technology don't apply any more. Conversely, with modern high-density drives, even if you've got 10KB of sensitive data on a drive and can't erase it with 100% certainty, the chances of an adversary being able to find the erased traces of that 10KB in 80GB of other erased traces are close to zero.

Recommendations

Thus for wiping of free space, a single pass of random data should be sufficient on large hard drives (and it's all that is really practical time wise anyways, but if you're very concerned about wiping your data, you could use 2-3 passes of random data if you're particularly paranoid) (NIST Guidelines, CMRR, Wright -- all cited for easy reference at Wikipedia).

For individual files and folders, note that the files can't "hide" as easily with an entire drive of erased free space. Some erasers try to counter this problem by using high erase patterns for individual files/folders, such as a Gutmann 35 pass, but I've found it quite easy to recover at least some individual files even after using several different high pass erasing programs in succession. To test any erase task, use a data recovery utility and see if it recovers the file. Some files get nicely erased down to 0 bytes or to nonsense information, but some are more difficult and require free space wiping. In the short term, you could scan for recoverable files and erase any leftover files with Recuva (right-click on the file to get its erasing feature).

But the best policy is to wipe the free space regularly, or on-demand when you really get in an erasing mood. I find almost nothing after a full free space wipe on a sizable drive. With just a single pass of random data (using Eraser), PC Inspector File Recovery only finds 0 byte nonsense files for me.

Eraser now suggests that erasing the Page File needs to be done by Windows with a configuration setting. This may be done with the Ultimate Windows Tweaker (in "Additional Tweaks") or with these suggestions:

See the MICROSOFT KNOWLEDGE BASE (http://support.microsoft.com/kb/314834/) for deletion instructions.

Encrypt the Page File
1. Start a Command Prompt, elevating it in Vista or later
2. Key in "fsutil behavior set EncryptPagingFile 1"
3. Restart your computer

Eraser will securely erase selected files and folders, or even whole disks, located on your hard drive (it works with any drive, including IDE, SCSI and RAID, and CD-RWs). Eraser can overwrite the data area with your choice of a variety of random data patterns (14 default patterns and a custom pattern creator), and can also wipe data in the Internet cache, temporary files, Internet cookies, unused disk space, and a number of other places where data can secretly lurk.

It can handle FAT16, FAT32, and NTFS partitions.  Erasing files with a high level of security will always be a difficult and time consuming task, and absolute 100% safety cannot be guaranteed. However, Eraser makes the task about as easy as it can be, at a security level that exceeds most conceivable requirements.

Both Eraser and File Shredder have explorer and context menu extensions, so you can right click on a file and send it to the erasing/shredding programs.

File Shredder - Despite its name, it has both free space wiping and file shredding capabilities. File Shredder has a small download size, simple interface, and it's very easy to use. It's a lot lighter than Eraser on active memory resources, but higher in CPU usage on my system. It lacks scheduling or a built-in help, and has very limited online help.

It uses a DoD (5220-22.M 3 pass) erase pattern by default, but it has four other patterns to choose from (versus the 14 patterns of Eraser). The default may be way too slow for free space wiping, so you may want to change it to one or two passes. The free space wipe works a little differently than Eraser, leaving behind more temp files of nonsense information (whereas Eraser doesn't usually allow recovery programs to read any bytes as recoverable). But I wasn't able to view anything of use from File Shredder's full wipe leftovers.

Related Cleaners for Both File Shredding & Full Free Space Wiping

For low resource alternatives that work similar to File Shredder try these:

• CCleaner erases junk files that it finds, wipes the free space, and shreds custom files/folders. First set it to erase what it deletes and set it to wipe the free space (Options > Settings > Secure Deletion), temporarily set it to clean the free space (Cleaner > Wipe Free Space), and click Run Cleaner. Product reviews: BF File Cleaner / BF Browser Scrubber.
   
• Revo Uninstaller has an "Unrecoverable Delete" tool to shred files and an "Evidence Remover" tool to wipe the free space. Product review: BF Program Un-installer.
   
• SDelete: A command line utility that securely erases using a default DOD 5220.22-M pattern at a specified number of passes. It can erase files/folders, or the free space of a drive. Like other erasers, it doesn't erase file names (instead it renames them 26 times) and has no interface. After you download it, open a command window (click Start > Run > type "CMD"), and then, for example, enter "sdelete -p 2 -z c:" (without quotes) to wipe the free space of C drive with two passes. Supports XP and higher, or Server 2003 and higher. See its download site and Bright Hub for guides. To quibble, I found it a bit less effective on a 1 pass wipe of free space than others above (some data was recognizable in PC Inspector's hex view, but not much of importance).

Related Cleaners for Individual Files/Folders Shredding Only

• Recuva: A recovery program that can erase individual files it finds. Product review: BF Data Recovery / File Un-delete Utility.
• UltraShredder: It's small, easy to use, and will work from a USB flash drive. Supports Windows XP/2000/98/98SE.

A somewhat different alternative is Darik's Boot and Nuke (DBAN). It's used to construct a floppy disk or CD that will automatically wipe the hard drives of any PC that's booted from the disk. It's great for bulk disk cleaning of PCs, and is also useful as an emergency tool for quickly removing sensitive information. However, the power of this app makes it a dangerous tool in the hands of beginners.

General Sources and Information

• Peter Gutmann's Secure Deletion Paper: Inspired the Gutmann 35-pass erase pattern
• Wikipedia - Data Remanence
• Why Information Must Be Destroyed (Part 2) - Ben Rothke

Other TSA Articles Mentioning Secure Erasers

• Best Free PC Tune-up Utility: Ashampoo WinOptimizer, Glary Utilities, Comodo System Cleaner
• Best Free CD / DVD Burning Software: These are sufficient for erasing rewritable CDs/DVDs
• Best Free Browser Protection Utility: You can erase the contents of a sandbox (Eraserl, SDelete)
• Probably the Best Security List in the World: File Shredders & Hard Disk Cleaning
• Best Free Windows 7 / Vista 64 bit Software: Eraser
• Best Free Portable Applications: Eraser Portable, EraserDrop Portable
• Best Free Software for Linux: DBAN
   

Find more free software at The Editors' Choice List: Our Selection of the Best PC Freeware!

You are invited to share and discuss your views in our freeware forum. To post in the forum you need to register first but that's quick and immediate. Alternatively, anyone can leave a comment at the bottom of this page. You can also help us by rating this review at the end of the article.

eraser, secure erase utility, data erase, erase/wipe hard drive, erase sensitive data, secure delete, erase deleted files, securely erase data, eraser review, eraser 6, Darik's Boot and Nuke, File Shredder