If I image a hard drive, wipe it clean, and then restore it, are deleted files really gone?

3

Assuming I want to make sure all traces of deleted files are gone from a system, but don't want to do a clean install or lose the current system configuration, will restoring an image of a hard drive essentially restore traces of the deleted files I just wiped (by formatting and zeroing the drive)?

Choy

Posted 2013-04-02T13:57:35.333

Reputation: 497

Wouldn't it be easier to just run SDelete? – Patrick Seymour – 2013-04-02T14:16:23.790

Answers

6

Yes. An image that does a sector by sector copy of your hard drive will (restore traces). But, a backup tool that copies files off your hard drive and restores them back wont (restore traces).

Ali

Posted 2013-04-02T13:57:35.333

Reputation: 1 151

3

As a disk image usually is more than just a backup of the files but as the name says an image of the disk, which is a bit per bit reconstruction of the original. The deleted files will as well be part of the image. If you can reconstruct the files on the original disk you should be able to reconstruct them as well after restoring the image. If you want to permanently delete files you should wipe those files with a tool like Eraser, File Shredder, Darik's Boot and Nuke or CCleaner. Those tools allow the permanent delition of files by overwriting the hard disk where those files are/were stored with a pattern so a recunstruction is unlikely.

Simon

Posted 2013-04-02T13:57:35.333

Reputation: 3 831

Partclone/Clonezilla disk images skips unused space. However I understand it works at the block level, so it would restore the smaller than 512 byte fragments of deleted files that NTFS can have ( discussed at: https://technet.microsoft.com/en-au/sysinternals/bb897443.aspx )

– gmatht – 2015-09-10T02:10:29.393

0

Yes, they can be restored and easily. You would need to low level format, or zero the drive first.

Austin T French

Posted 2013-04-02T13:57:35.333

Reputation: 9 766

Sorry, I wasn't clear in my question. That's what I meant by wipe clean after taking an image (edited question above). – Choy – 2013-04-02T14:06:14.473

In that case, I upvoted the answers for your modified question. – Austin T French – 2013-04-02T14:12:35.060