1

I refer to the following link:

Deleted files and their traces

I am trying to ensure security of deleted files when copying from one machine to another.

The original poster asked if simply copying and pasting some files using windows explorer and an external hard drive or usb from one machine to another also copied free space. The answer to that was no according to the replies.

My query is along the same lines:

  1. If I right click on the entire C Drive in Windows Explorer and do a simple copy and paste to an external hard drive and then transfer to another computer am I copying previously deleted files sitting in the free space as well as the files in use? Or is it just the files in use that get copied? Note: I copied with windows explorer from my machine (windows vista) to another machine (windows 7) via an external hard drive.
  2. Is copy and paste with windows explorer a "file copy" and in no way copies free space as opposed to a "bitwise" copy which would copy traces of deleted files?
  3. The original replies also stated deleted traces in the free space would only be copied by either hardware or software cloning. What is hardware cloning? Is it creating an "image" of the hard drive and is it bitwise or file based?
  4. Can cloning of a hard drive take place by simply copying and pasting with windows explorer to an external hard drive or does windows explorer just copy undeleted files?
Community
  • 1

1 Answers1

1

If you copy and paste files, you'll only copy files which currently exist. It doesn't matter whether you select them by clicking on the drive, by selecting them individually, or by any other method. You'll only get the files which Windows thinks are there.

In order to copy the remains of deleted files, you'd need to do a bitwise copy, which Windows doesn't offer as a standard feature. You can make such a copy with various bits of software, or by using a hardware drive cloner. Not all hardware cloners perform bitwise copies - it's possible for one to just copy files, although this actually takes more effort. If looking to buy one, look for ones which state "forensic copy" or similar, but most will perform bitwise copies since it allows them to clone any drive, regardless of format.

A bitwise copy is where the drive is accessed as a block device, ignoring any specific format applied by an operating system, and each bit from it is read and written to another drive exactly as found. If there is a "1" on the original drive, they'll be a "1" in the equivalent place on the clone.

If you only care about the files that currently exist, you can "clone" a drive through Windows explorer. If you want an exact clone, including any data marked as free space, or as deleted, you'll need a more specialized tool.

Matthew
  • 27,233
  • 7
  • 87
  • 101
  • Thanks Matthew. One final point if I can - you mentioned that windows don't offer a bitwise copy facility as standard. Is the feature built into windows 7 "create a system image" located under "backup and restore" not such a facility? If not then what does this image facility actually do? –  Jan 27 '17 at 12:59
  • 1
    It creates a system restore image - to reinstall Windows. Not the same kind of image at all. – Matthew Jan 27 '17 at 13:42
  • Sorry Matthew, just to be clear - when I looked up windows 7 help menu under "what is a system image" it says "a system image is an exact copy of a drive" & "this type of backup includes your personal files". I would have thought this would be a bitwise copy including free space. Sorry if I'm missing something! What's imaging so? So in summary & you might confirm these: A) Windows Explorer is file copy of current files and leaves behind deleted traces. B) Cloning on the otherhand is a bitwise copy either via hardware or software means? Hardware cloning would need a "duplicator" of some sort?? –  Jan 27 '17 at 14:30
  • 1
    Hmm, it's a bit of a messy definition, and there are two very similarly named functions, so I got that slightly wrong. "System Restore Image" is as I said, "System Image" appears to be a copy of all files from a given drive, but it's not clear whether it copies blank space or not. Even Microsoft doesn't seem to specifically say. – Matthew Jan 27 '17 at 14:32
  • Matthew, thanks! Finally can you comment on these last 2 issues just to summarise & I have it clear - (A) Windows Explorer is file copy system of current files and never copies deleted traces? I presume windows explorer doesn't copy free or deleted traces (only current files) because otherwise you wouldn't be able to copy/transfer anything from one machine to another as you may be bringing across sensitive data. (B) Cloning on the otherhand is a bitwise copy either via hardware or software means? Hardware cloning would need a "duplicator" of some sort?? Thanks again for your replies on this. –  Jan 27 '17 at 15:02
  • a. Yes. Not so much for that reason, but more because it's quicker not to copy anything which isn't required. b. Yes, although you're probably best specifying "bitwise clone" or "forensic clone" if you want to be sure. – Matthew Jan 27 '17 at 15:06
  • Don't make this harder than it is. Windows will not copy free space, for that you need to stick the drive in a Linux host and use DD. – J.A.K. Jan 27 '17 at 15:13