A security question

[onebigdog]

I understand that when you delete a file from your computer, it isn't really deleted. The 1st letter of the file is changed so that it is no longer visible, but any undelete tool can find it for you.
My question is this, what if a file is moved (not deleted) from the harddrive, to lets say, a floppy drive. As you know when you grab a file in Explorer, it asked if you want to copy or move the file to the new location. Isn't the file actually removed from the current location so that it is no longer on the drive (assuming you moved it to a removable disk)? Isn't it no longer on the harddrive at all? If this is true, then wouldn't it be just a simple matter of moving sensitive files to a different drive. Wouldn't this be a very safe way to make sure that sensitive files are not available to others who may not have the best intensions, when you sell your old computer or change harddrives?
What do you think?
obg

 

[metafox]

I dont know man

 

[Xaqte]

Not a safe way.

From:

http://www.computer-investigations.com/reports/case02.html

When a file is moved, paradoxically the file itself is not moved. The actual content of the file remains in the same place. What the operating system does is to duplicate the original directory entry in the new directory, including the pointers. So that the new directory entry - everything remains the same except that the index is moved to a different position, the old index is deleted.

You may want to post this in:
forum1117

X

 

[jimp56]

good question. I did some informal testing out of curiosity. i created a test TXT file and moved it to a network share. And using a trial undelete software, I was actually able to see the moved file on the original pc after doing an advanced scan (not a quick scan). so to answer the question, it appears as if moving/deleting are treated as the same. files are still accessible.

There are some programs most commonly referred to as "shredders" that promise to foil the undelete programs. However, as you may have already heard, using advanced forensic techniques, even that isnt good enough (though few would ever bother to do so).

 

[onebigdog]

Well it was a thought....
Thanks to all who replied.
obd