Chucklehead A accidentally sent data to internal user Chucky B that this user is not supposed to see. Luckily, Chucky didn't see it. Other than wiping the drive, how can I delete the classified data permanently off a drive such that the file can never be recovered?
What applications exist to do the above? Are they proven to work?
Thanks
According to this paper from the SANS Institute a single overwriting pass is enough to make the data permanently unrecoverable. They started a study in 2007 to fight the common misconceptions about recovering data from single-pass wiped drives and if you are interested you might read their post or the whole paper. I'll just provide an excerpt:
The belief that a tool can be developed to retrieve gigabytes or terabytes of information from a wiped drive is in error. Although there is a good chance of recovery for any individual bit from a drive, the chances of recovery of any amount of data from a drive using an electron microscope are negligible.
So to reply your question, you either wipe the whole drive, or you all-zero the free space after deleting classified content.
There are many tools to do this in Windows, I'd use sdelete -s c: (where c is the drive that had the classified file) or dd in unix-like: cd /home/YourUser; dd if=/dev/zero of=tmp.file bs=1M; rm -rf tmp.file. This should be run as root in a folder mounted on the relevant drive.
Of course, the first option would be better if you are on the paranoid side, but you will have to backup and reinstall the client PC.
Also, remember to take into account that the classified information might be in backups too. And you are not likely to perform such operations over backups, so mind if the actions you are going to plan should be performed elsewhere too, that will depend on the system's design and other details I can't take into account for you.
