Concept: Persistant Forensic Scrubbing

I had a random idea pop into my head a few days ago, I was thinking about the whole "nothing is really deleted when you hit delete" scenario and came up with a conceptual idea. I'm going to explain it further below, what I want to know from you guys is:

1. Would something like this actually work?
2. Would it be heavily resource consuming to run?
3. Would it be marketable?

I was thinking about overwriting in single bit intervals over time, similar to the way persistent defragging uses low-priority memory to rearrange files constantly in order to keep a harddrive data rapidly accessible. Would it be possible to fill the gaps in the same fashion?

My idea is kind of like defragging in that it would rearrange files for efficiency just like a defrag does, but then afterwards it fills in the old slot with scrub data 1 bit at a time and will even write over the scrub data if there is no "new" data clusters that need the immediate attention. It could turn itself off during installs of new software, or make the gaps needed in advance of installation so you don't get the harddrive full error.

Anyway this is my idea, let me know what you guys think, hell for all I know it may already exist.

 

Actually CCleaner will perform the overwrite on a schedule if wipe free space is included in the dialog. It does take hours on large drives, though.

The biggest problem is the toll on the durability of drives that this would cause. SSDs are better, but they age with writes too. Standard disk drives I don't think are durable enough for this to be done very oftenly. One other thing, Windows does a very good job of defragging already...

 

Oh I know windows does a good job of defragging, and CCleaner is a scheduled event, what I mean by "persistent" is that at all times it is using very little memory or cpu to do this in the background. It doesn't turn off, and it doesn't stop. Not saying it should be built into defrag software. I mean that it should operate like windows defrag software, where it does it at all times very subtly, so much so that you could be power using without noticing a performance drop, similar to how defrag does.

I will say that I did not consider the wear it would have on the platters.

 

Great idea.
And there are software that already do this.

Shred Agent.
http://www.shredagent.com/solutions/background_mode.htm

BCWipe.
http://www.jetico.com/about-jetico/newsroom/212-wipe-free-space-obsolete-with-jetico-s-bcwipe-4-0

 

souredspirit...

You got me thinking, and I think there might be a way to perform the secure wiping without continually wiping free space and using processor and aging drives. If you could come up with a dialog, such as the CCleaner dialog, where a user can select certain types of data to be automatically destroyed when deleted, you could then be allowing users to decide what and how much they want scrubbed. That would then allow them to determine also how much the function would "work" or be running. Also, the process could be run at the lowest priority or at "Below Normal".

Large files, like old backups are hard to get rid of because the process takes so long. However, you could even have a setting that makes certain file types or certain size files (like large backup files) irretrieveable without secure erasing the whole thing...just enough so that it could not be restored. It wouldn't be forensic, but that might mitigate the down sides of large erase functions. With old movies or music, the user could decide, but I don't see why erasure would even be necessary for the most part. On the other hand this same technique might work for them and for large office files. If the file is unretrieveable, the most important purpose for the erase is served, although I guess portions of files can still be forensically lifted and turned into a readable/viewable format.

I think someone could keep a fairly clean drive this way without wearing out the drive or over using the processor. I guess it would be pretty much of a science how to perform the "tactical" erasures for larger files or non-critical files.

Now that I think about it, I would use this function on a business type machine. I have always wanted a scrubber for e-mail clients like Office Outlook, but the ones I have seen are expensive. Too bad MS didn't add this as a feature. My feeling about that kind of sums up my respect for MS' view of security... not exactly the highest of respects...

 

Zer0 already does much better, blazing fast