Print

Welcome to Smokey's Security Forums.

Guests have only limited access to the board and it's features, please consider registering to gain full access!

Registration is free and it only takes a few moments to complete.

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[Jetico]

Yes, sometimes BCWipe cannot wipe a file slack, because the file is locked by system.
The only way to wipe such slack is to wipe the whole file.
Some of the files you listed in your post can be just wiped.

Sometimes Windows does not allow to open a file for writing, but allows renaming the file.
In that case, BCWipe will report the message "do you want to wipe the file at system startup?".
If you say "yes", BCWipe will rename the file into "~BCWipe.stu" folder and will wipe the folder just after reboot.

I performed the test with "ntuser.dat.LOG" and Windows allowed me to wipe the file.

BCWipe is designed as a standard Windows application - i.e. it does what Windows allows it to do.
BCWipe does not contain any low-level drivers or services in order to delude Windows in some way.

So, if you run "Delete with wiping" and wipe or rename a file, you will rely on reliability of Windows system.

[bulatek]

I ran BCWipe through its Task Manager on c:\ (Windows XP (SP2)) with Wipe Free Space, Swap Space, Directory Entries, and File Slacks. I skipped the Windows and Program folders. After running, the log file showed that wiping slack space on some files failed. Some of the files included UsrClass.dat.LOG and  ntuser.dat.LOG at several locations. To my understanding, there files store registry data and are therefore locked by the OS when running. Will the slack in these files ever contain user data that will need to be wiped? If so, how do I wipe slack in these files? (Can the OS grab disk clusters that were previously used for user data?)

There were a couple of other files that failed also.
     reginfo.xml (which also appears to be inaccessible while running
     tml2.tmp (which I couldn't find in the path after wiping)
Hod do I wipe slack in there files?

I attached the log file from my run.

Thanks,
Dave...