SDelete

One of the features of Windows NT and 2000, which ensures that the system meets the C2 class of criteria for evaluating trusted computer systems, is the protection against object reuse. This means that when an application is allocated an area of disk space or virtual memory, the data previously stored in the allocated area is not available for viewing. Before providing the application with the requested resources, Windows NT cleans the allocated memory or disk sectors, filling these areas with null values.

Nevertheless, such protection does not imply clearing the disk area at the moment of file deletion. Cleaning is not performed because Windows NT and 2000 operating systems were developed with the assumption that the operating system controls access to system resources. If the operating system is inactive, you can use disk editors or data recovery tools to view or recover data deleted by the operating system. Even if you encrypt the files using the EFS encrypted file system in Windows 2000, the original, unencrypted data remains on the disk after the encrypted version of the file is created.

The only way to make sure that files deleted or encrypted using EFS cannot be recovered is to use secure file deletion applications. Such applications use the techniques below to overwrite the areas of the disk where the deleted files were located. Thus, even if you use recovery technologies that read data directly from magnetic media, you will not be able to recover deleted files.

One such application is SDelete (Secure Delete). It can be used for deleting existing files, as well as for cleaning data located on free hard drives (including deleted or encrypted files). SDelete is an implementation of the DOD 5220.22-M data cleaning standard developed by the U.S. Department of Defense. You can be sure that a file deleted by SDelete cannot be recovered. Please keep in mind that SDelete will clear the contents but will not delete the names of cleared files located in the free disk space.