Wipe Disk Concepts
Wiping Unoccupied Disk's Space
You may have confidential data on your hard drive in spaces where data may have been stored temporarily.
You may also have deleted files by using the Windows Recycle Bin and then emptying it. While you are still using your local hard drive, there may be confidential information available in these unoccupied spaces.
Wiping the logical drive's deleted data does not delete existing files and folders. It processes all unoccupied drive space so that recovery of previously deleted files becomes impossible.
Installed applications and existing data are not touched by this process. When you wipe unoccupied drive space, the process is run from the bootable CD/DVD operating system. As a result, the wipe or erase process uses an operating system that is outside the local hard drive and is not impeded by Windows system caching. This means that deleted Windows system records can be wiped clean.
KillDisk wipes unused data residue from file slack space, unused sectors, and unused space in MTF records or directory records.
Wiping drive space can take a long time, so do this when the system is not being otherwise utilized. For example, this can be done overnight.
Wipe Algorithms
The process of deleting files does not eliminate them from the hard drive. Unwanted information may still be left available for recovery on the computer. A majority of software that advertises itself as performing reliable deletions simply wipes out free clusters. Deleted information may be kept in additional areas of a drive. KillDisk therefore offers different wipe algorithms to ensure secure deletion: overwriting with zeros, overwriting with random values, overwriting with multiple passes using different patterns and much more. KillDisk supports more than 20 international data sanitizing standards, including US DoD 5220.22M and the most secure Gutmann's method overwriting with 35 passes.
Wiping File Slack Space
This relates to any regular files located on any file system. Free space to be wiped is found in the "tail" end of a file because disk space is usually allocated in 4 Kb clusters. Most files have sizes that are not 4 Kb increments and thus have slack space at their end.
Specifics of Wiping Microsoft NTFS File System
NTFS Compressed Files
Wiping free space inside a file: The algorithm NTFS uses to "compress" a file operates by separating the file into compressed blocks (usually 64 Kb long). After it is processed, each of these blocks has been allocated a certain amount of space on the volume. If the compressed information takes up less space than the source file, then the rest of the space is labeled as sparse space and no space on the volume is allocated to it. Because the compressed data often doesn't have a size exactly that of the cluster, the end of each of these blocks stays as unusable space of significant size. Our algorithm goes through each of these blocks in a compressed file and wipes the unusable space, erasing previously deleted information that was kept in those areas.
The MFT (Master File Table) Area
Wiping the system information:
The MFT file contains records, describing every file on the volume. During the deletion of these files, the records of their deletion are left untouched - they are simply recorded as "deleted". Therefore file recovery software can use this information to recover anything from the name of the file and the structure of the deleted directories down to files smaller than 1Kb that are able to be saved in the MFT directly. The algorithm used by KillDisk wipes all of the unused information out of the MFT records and wipes the unusable space, making a recovery process impossible.
Specifics of Wiping Microsoft FAT File System
Wiping Directory Areas
Each directory on a FAT/FAT32 or an exFAT volume can be considered as a specific file, describing the contents of the directory. Inside this descriptor there are many 32-byte records, describing every file and other inner folders.
When you delete files this data is not being fully erased. It is just marked as deleted (hex symbol 0xE5). That's why data recovery software can detect and use these records to restore file names and full directory structures.
In some cases dependent on whether a space where item located has been overwritten yet or not, files and folders can be fully or partially recovered..
KillDisk makes data recovery impossible by using an algorithm that wipes out all unused information from directory descriptors. KillDisk not only removes unused information, but also defragments Directory Areas, thus speeding up directory access.
In this example red rectangles display deleted records.
In this example all deleted records removed and root folder defragmented.
Specifics of Wiping Apple HFS+ File System
HFS+ B-tree
A B-tree file is divided up into fixed-size nodes, each of which contains records consisting of a key and some data.
In the event of the deletion of a file or folder, there is a possibility of recovering the metadata of the file, (such as its name and attributes), as well as the actual data that the file consists of. KillDisk's Wipe method clears out all of this free space in the system files.
Specifics of Wiping Linux Ext2/Ext3/Ext4 File Systems
A Linux Ext file system (Ext2/Ext3/Ext4) volume has a global descriptors table. Descriptors table records are called group descriptors and describe each blocks group. Each blocks group has an equal number of data blocks.
A data block is the smallest allocation unit: size vary from 1024 bytes to 4096 bytes. Each group descriptor has a blocks allocation bitmap. Each bit of the bitmap shows whether the block is allocated (1) or available (0). KillDisk software enumerates all groups, and for each and every block within the group on the volume checks the related bitmap to define its availability. If the Block is available, KillDisk wipes it using the method supplied by the user.
