Problem - Kevin Tafuro

actual data is stored is then marked free and will be reclaimed whenever the filesystem
needs that space.
The result is that to truly erase the data, you need to overwrite it with nonsense
before the filesystem delete operation is performed. Many times, this overwriting is
implemented by simply zeroing all the bytes in the file. While this will certainly erase
the file from the perspective of most conventional utilities, the fact that most data is
stored on magnetic media makes this more complicated.
More sophisticated tools can analyze the actual media and reveal the data that was
previously stored on it. This type of data recovery has a limit, however. If the data is
sufficiently overwritten on the media, it does become unrecoverable, masked by the
new data that has overwritten it. A variety of factors, such as the type of data written
and the characteristics of the media, determine the point at which the interesting
data becomes unrecoverable.
A technique developed by Peter Gutmann provides an algorithm involving multiple
passes of data written to the disk to delete a file securely. The passes involve both
specific patterns and random data written to the disk. The paper detailing this technique
is available from http://www.cs.auckland.ac.nz/~pgut001/pubs/secure_del.html.
Unfortunately, many factors also work to thwart the feasibility of securely wiping the
contents of a file. Many modern operating systems employ complex filesystems that
may cause several copies of any given file to exist in some form at various different
locations on the media. Other modern operating system features such as virtual memory
often work to defeat the goal of securely obliterating any traces of sensitive data.
One of the worst things that can happen is that filesystem caching will turn multiple
writes into a single write operation. On some platforms, calling fsync( ) on the file
after one pass will generally cause the filesystem to flush the contents of the file to
disk. But on some platforms that’s not necessarily sufficient. Doing a better job
requires knowing about the operating system on which your code is running. For
example, you might be able to wait 10 minutes between passes, and ensure that the
cached file has been written to disk at least once in that time frame. Below, we provide
an implementation of Peter Gutmann’s secure file-wiping algorithm, assuming
fsync( ) is enough.
48 | Chapter 2: Access Control
On Windows XP and Windows Server 2003, you can use the cipher
command with the /w flag to securely wipe unused portions of NTFS
filesystems.
We provide three functions:
spc_fd_wipe( )
Overwrites the contents of a file identified by the specified file descriptor in accordance
with Gutmann’s algorithm. If an error occurs while performing the wipe
operation, the return value is –1; otherwise, a successful operation returns zero.
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.