Before a person gives his laptop away and wants to erase all info/data...

[gggg gggg]

Is there a simple command that will wipe out all info/data?

 

[Phil Hobbs]

gggg gggg <ggggg9271@gmail.com> wrote:

Is there a simple command that will wipe out all info/data?

Strictly speaking, no, not nowadays.

Back in the days of magnetic storage, you could boot a Linux live disk,
find the hard disk in /dev (say /dev/sda), and then go “shred /dev/sda” as
root. That would write a random pattern over the whole disk, and then do
it again another two times.

Flash drives don’t present all of their contents to the file system, so a
determined opponent could recover some of your data even after shredding.

Most of us don’t have anything that earthshaking on a disk anyway, and
don’t have anyone who might want to make that much an effort to recover it,
so shred is still an option.

Cheers

Phil Hobbs

 

[Jan Panteltje]

On a sunny day (Fri, 29 Sep 2023 16:27:21 -0700 (PDT)) it happened gggg gggg
<ggggg9271@gmail.com> wrote in
<b8fd4d7f-ee53-4f2d-a410-668c94ec5a8en@googlegroups.com>:

>Is there a simple command that will wipe out all info/data?

In Linux, as root. dd if=/dev/zero of=/dev/sda
if sda is your harddisk.
should write zeros on all sectors.
Works also for USB sticks etc.

 

[John Robertson]

On 2023/09/29 5:30 p.m., Phil Hobbs wrote:

gggg gggg <ggggg9271@gmail.com> wrote:
Is there a simple command that will wipe out all info/data?


Strictly speaking, no, not nowadays.

Back in the days of magnetic storage, you could boot a Linux live disk,
find the hard disk in /dev (say /dev/sda), and then go “shred /dev/sda” as
root. That would write a random pattern over the whole disk, and then do
it again another two times.

Flash drives don’t present all of their contents to the file system, so a
determined opponent could recover some of your data even after shredding.

Most of us don’t have anything that earthshaking on a disk anyway, and
don’t have anyone who might want to make that much an effort to recover it,
so shred is still an option.

Cheers

Phil Hobbs

One can always use the hammer data erase - I did that for a friend\'s
company - they had forty odd drives they wanted to be unreadable - a
sledge hammer did that quite quickly...I could have used the drill press
as well, but the hammer was more satisfying.

USB sticks and SSDs also respond well to the hammer data clearing treatment.

John :-#)#
--
(Please post followups or tech inquiries to the USENET newsgroup)
John\'s Jukes Ltd.
#7 - 3979 Marine Way, Burnaby, BC, Canada V5J 5E3
(604)872-5757 (Pinballs, Jukes, Video Games)
www.flippers.com
\"Old pinballers never die, they just flip out.\"

 

[John Robertson]

On 2023/09/29 5:30 p.m., Phil Hobbs wrote:

gggg gggg <ggggg9271@gmail.com> wrote:
Is there a simple command that will wipe out all info/data?


Strictly speaking, no, not nowadays.

Back in the days of magnetic storage, you could boot a Linux live disk,
find the hard disk in /dev (say /dev/sda), and then go “shred /dev/sda” as
root. That would write a random pattern over the whole disk, and then do
it again another two times.

Flash drives don’t present all of their contents to the file system, so a
determined opponent could recover some of your data even after shredding.

Most of us don’t have anything that earthshaking on a disk anyway, and
don’t have anyone who might want to make that much an effort to recover it,
so shred is still an option.

Cheers

Phil Hobbs

One can always use the hammer data erase - I did that for a friend\'s
software development company - they had forty odd drives they wanted to
be unreadable - a sledge hammer did that quite quickly...I could have
used the drill press as well, but the hammer was more satisfying.

USB sticks and SSDs also respond well to the hammer data clearing treatment.

John :-#)#
--
(Please post followups or tech inquiries to the USENET newsgroup)
John\'s Jukes Ltd.
#7 - 3979 Marine Way, Burnaby, BC, Canada V5J 5E3
(604)872-5757 (Pinballs, Jukes, Video Games)
www.flippers.com
\"Old pinballers never die, they just flip out.\"

 

[Don Y]

On 9/29/2023 5:30 PM, Phil Hobbs wrote:

gggg gggg <ggggg9271@gmail.com> wrote:
Is there a simple command that will wipe out all info/data?

Strictly speaking, no, not nowadays.

Actually, not even in recent history -- if you truly want to *wipe*
the drive... the ENTIRE drive!

Back in the days of magnetic storage, you could boot a Linux live disk,
find the hard disk in /dev (say /dev/sda), and then go “shred /dev/sda” as
root. That would write a random pattern over the whole disk, and then do
it again another two times.

That only addresses that partition; there can be multiple.

And, that also ignores the HPA and DSO -- either or both of
which can be present on a particular medium.

We \"wipe\" thousands of disks each year. And, *contractually*,
must guarantee that they ARE actually wiped of all donor data.
Many places that claim to recycle your kit don\'t provide that
guarantee; I\'ve watched folks rummaging around on donated
machines \"out of curiosity\". Used kit that I *purchase* I
have no compunction about doing the same as it should have been
the seller\'s responsibility to protect what he felt worth
protecting.

(I\'ve found tax returns -- corporate and individual -- lists
of employees WITH THEIR SSNs AND BIRTHDATES, drafts of graduate
theses, all sorts of \"interesting\" photos, etc.)

I built an appliance that wipes disks (60 at a time). It
resets the DCO and/or HPA (if present), then overwrites the
entire medium with a series of patterns, based on the agreement
we have with the donor (some are happy with a simple overwrite
of constant data, some prefer random data, other want multiple
passes and/or verification passes -- hence the need for a
dedicated appliance that can just grind away on disks, all day
long).

[This also gives us a way to determine which disks are worth
reusing; a slow disk or one that throws lots of errors is
scrap -- so, it may be more expeditious to simply shred it
NOW instead of waiting for the \"wipe\" to complete]

Depending on the pickiness of the donor, even a bad sector
causes the \"wipe\" to be considered incomplete. In which case
the drive is LITERALLY shredded (think of a wood chipper for metal).

And, a log of each of the \"processed\" drives is returned to the
donor -- along with a sworn statement of their (data) destruction.

Flash drives don’t present all of their contents to the file system, so a
determined opponent could recover some of your data even after shredding.

Also true with SSDs (whether in \"disk\" form or as M.2\'s, DOMs, etc.

And, the DCO and HPA can intentionally hide information that one might
not want a knowledgeable adversary to trivially recover.

(e.g., when building a new system, my appliance creates a hidden
\"restore\" partition in the HPA so all of the original contents of
the disk are there even if you were to overwrite the \"exposed\"
partitions, completely. This allows us to limit our \"customer
support\" to \"Press F9 at the boot prompt to restore your computer
to its original condition (any new files will be lost)\")

Some disks claim to support the \"Secure Erase\" ATA option. But,
there have been reports of this being buggy in some cases. And,
there is the issue of *issuing* that command (e.g., how do you
secure erase the \"system\" disk if the utility to invoke the
secure erase runs under that OS?).

Some BIOSs will have a hook to invoke Secure Erase. But, it may
only work with a particular disk, supplied WITH the machine in
its original configuration (e.g., if you\'ve updated the disk,
all bets are off).

Some manufacturers have free-standing \"Secure Erase\" utilities...
but, you may find they only work on \"disks\" and not on DoMs, etc.
And, they likely won\'t work on some OTHER manufacturer\'s storage
devices.

Most of us don’t have anything that earthshaking on a disk anyway, and
don’t have anyone who might want to make that much an effort to recover it,
so shred is still an option.

That largely depends on who will be downstream of your \"discard\".

Someone purchased an Apple tablet that had been donated to us
some years ago. The folks who processed the donation didn\'t know
how to get at the internal disk so it never visited my \"sanitizer\".

A week or so later, we received an irate call from the donor.
Apparently, the purchaser had TELEPHONED HER asking for the
password to \"her old Apple\".

Ooops!

In addition to threatening to call the police (what crime was committed?),
she was likely to contact the local media, which would have seen an
\"easy SENSATIONAL story\" just ripe for picking.

We ended up buying the device back and then filming our *physical*
destruction of it to reassure the donor that none of her data was
ever compromised.

I\'m *sure* she wasn\'t completely mollified...

Thereafter, any device that folks were uncertain of had to
be \"blessed\" by me before being made available for resale.

I physically destroy SSDs as I can see no RELIABLE way to wipe
AND VERIFY that they have been \"processed\". They\'re just not worth
trying to reuse/resell, if you have any concern for their contents.
Ironically, the \"better\" the SSD (i.e., the more overprovisioned),
the more of a nuisance!

 

[Don Y]

On 9/29/2023 10:57 PM, Don Y wrote:

And, that also ignores the HPA and DSO -- either or both of
which can be present on a particular medium.

Ugh! s.b. DCO.

 

[Martin Brown]

On 30/09/2023 00:27, gggg gggg wrote:
> Is there a simple command that will wipe out all info/data?

There are various tools that will fill the disk with random data several
times over. That won\'t quite work against a forensic specialist if the
data was valuable but should be good enough for all practical purposes.

They tend to be called something like shred. This advice looks OK

https://uk.crucial.com/articles/pc-builders/how-to-wipe-a-hard-drive

SSD\'s present a bit more of a challenge there can be orphaned blocks
with faults that contain your data frozen and inaccessible by normal
means but which could be retrieved by a forensic specialist with the
appropriate tools (basically hidden in bad blocks or by wear levelling).

--
Martin Brown

 

[Don Y]

On 9/30/2023 3:51 AM, Martin Brown wrote:

On 30/09/2023 00:27, gggg gggg wrote:
Is there a simple command that will wipe out all info/data?

There are various tools that will fill the disk with random data several times
over. That won\'t quite work against a forensic specialist if the data was
valuable but should be good enough for all practical purposes.

It\'s actually possible to get \"residual data\" from SSDs (and,
likely, rust). We think of magnetic/electrical domains as
binary things but they really are analog and can be probed
to reveal more of their history.

For the skeptics:
<https://www.usenix.org/system/files/sec20_slides_hasan.pdf>

And, of course, \"broken\" drives (of any type) are relatively easy
to snoop.

They tend to be called something like shred. This advice looks OK

https://uk.crucial.com/articles/pc-builders/how-to-wipe-a-hard-drive

SSD\'s present a bit more of a challenge there can be orphaned blocks with
faults that contain your data frozen and inaccessible by normal means but which
could be retrieved by a forensic specialist with the appropriate tools
(basically hidden in bad blocks or by wear levelling).

The same is true with spinning rust; you don\'t know *when* a sector
was marked as bad so you don\'t know what it might \"partially\" contain.

For picky customers, the presence of *any* bad blocks on a drive
at the beginning (or end!) of our \"sanitizing\" procedure requires
the drive to be physically destroyed -- because there is no way
for us to coax the drive to scribble on/over that \"bad\" sector, to
obfuscate its contents.

[Disks are cheap. If you have concerns over your data being exposed,
they are considerably cheaper than the cost of potentially losing
control over that data!]

 

[Fred Bloggs]

On Friday, September 29, 2023 at 7:27:27 PM UTC-4, gggg gggg wrote:
> Is there a simple command that will wipe out all info/data?

There are powerful degaussers made for this purpose. You need to find a business that offers this as a service.

https://www.pitneybowes.com/in/shipping-and-mailing/degaussers.html

That very highly credentialed device won\'t be cheap.

Or maybe someone on SED has a DIY project for same. Jan?

 

[whit3rd]

On Friday, September 29, 2023 at 4:27:27 PM UTC-7, gggg gggg wrote:
> Is there a simple command that will wipe out all info/data?

Yes, but it\'ll cost ya. There are disk drives that secure the data by
encrypting on-the-fly all the time, and decrypt on-the-fly so it all
happens transparently. They\'re \'enterprise\' models, sometimes
with odd (SAS, fibre channel, whatever-it-is-this-decade) connection
requirements.

Those drives store an internal key that can be overwritten when you want
to lose the data. Even \'bad blocks\' are encrypted, so the loss of the
key makes every bit of the data on the drive into... semi-random bits.

 

[whit3rd]

On Friday, September 29, 2023 at 4:27:27 PM UTC-7, gggg gggg wrote:
> Is there a simple command that will wipe out all info/data?

Absolutely all data is hard because the hard drive may have blocks set aside that
are \'bad\' but not empty, which aren\'t addressable with normal read/write commands.

For a MacBook, you can wipe out your personal data by making a new user
account, giving it admin privileges, and using it to delete your user account.
When the deed is done, the user folder is accessible for \'secure delete\'
with the privileges of the new user.

A cloud copy can exist, for some items, of course. Chasing THAT data down is
more confusing.

 

[Jan Panteltje]

On a sunny day (Sat, 30 Sep 2023 18:13:06 -0700 (PDT)) it happened whit3rd
<whit3rd@gmail.com> wrote in
<58394583-8e8d-4452-b8a3-c5bac1dba4bcn@googlegroups.com>:

On Friday, September 29, 2023 at 4:27:27 PM UTC-7, gggg gggg wrote:
Is there a simple command that will wipe out all info/data?

Yes, but it\'ll cost ya. There are disk drives that secure the data by
encrypting on-the-fly all the time, and decrypt on-the-fly so it all
happens transparently. They\'re \'enterprise\' models, sometimes
with odd (SAS, fibre channel, whatever-it-is-this-decade) connection
requirements.

Those drives store an internal key that can be overwritten when you want
to lose the data. Even \'bad blocks\' are encrypted, so the loss of the
key makes every bit of the data on the drive into... semi-random bits.

I have read once that -- maybe it was on floppies and perhaps hardddiscs --,
you could read deleted data sometimes by changing track position a bit outside the newly
erased track as those areas could still be magnetized with the old data.
But high tech places like government labs likely have more ways.
As they already now almost everything about me, it makes no difference
that bomb under the white house they likely found out about that too.
So dd if=/dev/zero of=/dev/sda
is good enough for humans, like if hufter buythen had just done that,
then that repair shop would not have exposed his commi-nukations.,

 

[John Larkin]

On Sat, 30 Sep 2023 18:13:06 -0700 (PDT), whit3rd <whit3rd@gmail.com>
wrote:

On Friday, September 29, 2023 at 4:27:27?PM UTC-7, gggg gggg wrote:
Is there a simple command that will wipe out all info/data?

Yes, but it\'ll cost ya. There are disk drives that secure the data by
encrypting on-the-fly all the time, and decrypt on-the-fly so it all
happens transparently. They\'re \'enterprise\' models, sometimes
with odd (SAS, fibre channel, whatever-it-is-this-decade) connection
requirements.

Those drives store an internal key that can be overwritten when you want
to lose the data. Even \'bad blocks\' are encrypted, so the loss of the
key makes every bit of the data on the drive into... semi-random bits.

Just delete the embarassing stuff and write a giant random file until
the drive is full. Nobody but maybe the CIA has a chance to recover
anything after that.

 

[Don Y]

On 9/30/2023 6:40 PM, whit3rd wrote:

On Friday, September 29, 2023 at 4:27:27 PM UTC-7, gggg gggg wrote:
Is there a simple command that will wipe out all info/data?

Absolutely all data is hard because the hard drive may have blocks set aside that
are \'bad\' but not empty, which aren\'t addressable with normal read/write commands.

On SCSI drives, one can reset the GDT and, as the PDT existed before
you started to populate the drive, it shouldn\'t be of concern.
Withthe GDT reset, I suspect even a casual adversary could coax the
drive to reveal the contents of those sectors (possibly with the
assistance of some thermal \"enhancement\")

For a MacBook, you can wipe out your personal data by making a new user
account, giving it admin privileges, and using it to delete your user account.
When the deed is done, the user folder is accessible for \'secure delete\'
with the privileges of the new user.

Are you sure it (any of its apps) never create temporary files
elsewhere, that reveal portions of the originals\' contents?

A cloud copy can exist, for some items, of course. Chasing THAT data down is
more confusing.

A \"paging/swap\" file can also have copies of some or all of the
data in question. How long it survives, there, depends on the
paging policy and how much activity the VMM sees.

 

[whit3rd]

On Sunday, October 1, 2023 at 1:22:15 PM UTC-7, Don Y wrote:

On 9/30/2023 6:40 PM, whit3rd wrote:
On Friday, September 29, 2023 at 4:27:27 PM UTC-7, gggg gggg wrote:
Is there a simple command that will wipe out all info/data?

Absolutely all data is hard because the hard drive may have blocks set aside that
are \'bad\' but not empty, which aren\'t addressable with normal read/write commands.
On SCSI drives, one can reset the GDT and, as the PDT existed before
you started to populate the drive, it shouldn\'t be of concern.
Withthe GDT reset, I suspect even a casual adversary could coax the
drive to reveal the contents of those sectors (possibly with the
assistance of some thermal \"enhancement\")
For a MacBook, you can wipe out your personal data by making a new user
account, giving it admin privileges, and using it to delete your user account.
When the deed is done, the user folder is accessible for \'secure delete\'
with the privileges of the new user.
Are you sure it (any of its apps) never create temporary files
elsewhere, that reveal portions of the originals\' contents?

The \'elsewhere\' question is... no, not generally going to be allowed, even
for a privileged user, to stray outside the user folder. That\'s irritating, because only the
\'shared\' folder is allowable for multiuser read/write items, unless you use
the terminal window and SUDO everything...

A cloud copy can exist, for some items, of course. Chasing THAT data down is
more confusing.

A \"paging/swap\" file can also have copies of some or all of the
data in question. How long it survives, there, depends on the
paging policy and how much activity the VMM sees.

Well, portions of anything in RAM can be swapped out on any OS
that uses virtual memory. It isn\'t coherent files with organized info,
though, and gets overwritten so only recent activity ought to leave traces.
There\'s a journaling system that ought to keep that kind of data corralled even
through hard shutdowns, but I can\'t say how often one REALLY erases anything on SSD
media, because the OS has the load-leveling thing to worry about.

If any disk drive has to be shredded, a small one dedicated to swap operations would be
the candidate.

 

[Don Y]

On 10/1/2023 8:32 PM, whit3rd wrote:

On Sunday, October 1, 2023 at 1:22:15 PM UTC-7, Don Y wrote:
On 9/30/2023 6:40 PM, whit3rd wrote:
On Friday, September 29, 2023 at 4:27:27 PM UTC-7, gggg gggg wrote:
Is there a simple command that will wipe out all info/data?

Absolutely all data is hard because the hard drive may have blocks set aside that
are \'bad\' but not empty, which aren\'t addressable with normal read/write commands.
On SCSI drives, one can reset the GDT and, as the PDT existed before
you started to populate the drive, it shouldn\'t be of concern.
Withthe GDT reset, I suspect even a casual adversary could coax the
drive to reveal the contents of those sectors (possibly with the
assistance of some thermal \"enhancement\")
For a MacBook, you can wipe out your personal data by making a new user
account, giving it admin privileges, and using it to delete your user account.
When the deed is done, the user folder is accessible for \'secure delete\'
with the privileges of the new user.
Are you sure it (any of its apps) never create temporary files
elsewhere, that reveal portions of the originals\' contents?

The \'elsewhere\' question is... no, not generally going to be allowed, even
for a privileged user, to stray outside the user folder. That\'s irritating, because only the
\'shared\' folder is allowable for multiuser read/write items, unless you use
the terminal window and SUDO everything...

No notion of a \"tmp\" filesystem?

A cloud copy can exist, for some items, of course. Chasing THAT data down is
more confusing.

A \"paging/swap\" file can also have copies of some or all of the
data in question. How long it survives, there, depends on the
paging policy and how much activity the VMM sees.

Well, portions of anything in RAM can be swapped out on any OS
that uses virtual memory.

Of course. So, either live without swap (have gobs of physical
memory -- I have 144G on my workstations) or plan on wiping it,
as well. That usually requires some level of \"privilege\", though.

> It isn\'t coherent files with organized info,

That depends on what happens to be in RAM when those pages
get swapped out. E.g., if editing a document, spreadsheet,
etc. it\'s likely that page-sized, contiguous chunks will
exist in swap. And, if you can take a snapshot of that image
(i.e., by stopping the processor/system), then it\'s trivial to
grep the data looking for common patterns. Much like
string(1) helps find bits of text amidst executable code.

[E.g., a SSN has a distinctive format -- as do (birth)dates,
phone numbers, monetary amounts, bank routing numbers, etc.]

though, and gets overwritten so only recent activity ought to leave traces.
There\'s a journaling system that ought to keep that kind of data corralled even
through hard shutdowns, but I can\'t say how often one REALLY erases anything on SSD
media, because the OS has the load-leveling thing to worry about.

I can\'t see any *reliable*, robust strategy for sanitizing SSDs
(or any other solid state equivalent) -- unless you have access to
the FTL. And, given how buggy \"the big guys\" have been in THEIR
implementations (slow learners?), it\'s hard to imagine anyone
else being much more proficient.

If any disk drive has to be shredded, a small one dedicated to swap operations would be
the candidate.

The problem is that the file store, OS, etc. are all reasonably opaque;
their contractual guarantees only indicate that the data will persist...
they don\'t disclose WHERE it might travel along the way! And, people tend
to *assume* that whatever the OS does solves the access problem EVEN WHEN
THE OS ISN\'T RUNNING! (oops)

In my current product, my \"persistent store\" is implemented as an RDBMS.
All temporary tables (e.g., \"query results\") manifest in a tablespace
that is backed by RAM to minimize the chance of data leaking to an
adversary (assuming the RDBMS is robust in its own storage mechanisms).

If you want to dispose of old media, repurpose it in something else
OF YOUR OWN so you still retain it (i.e., defer the issue of dealing with
the data). And, if you can defer it long enough, then the value of
the *media* will be so insignificant that you can afford to just destroy it.

[How big is the disk in a laptop likely to be when you\'ve decided that
it (the drive) can be discarded?]

 

[Don Y]

On 10/1/2023 10:52 PM, Don Y wrote:

I can\'t see any *reliable*, robust strategy for sanitizing SSDs
(or any other solid state equivalent) -- unless you have access to
the FTL.  And, given how buggy \"the big guys\" have been in THEIR
implementations (slow learners?), it\'s hard to imagine anyone
else being much more proficient.

<https://www.stellarinfo.com/blog/sandisk-ssd-40000-hour-death-bug-2022/>

<https://arstechnica.com/gadgets/2023/05/sandisk-extreme-ssds-keep-abruptly-failing-firmware-fix-for-only-some-promised/>

<https://www.hpe.com/us/en/services/sas-ssd-advisory.html>

<https://www.tomshardware.com/news/samsung-980-pro-ssd-failures-firmware-update>

<https://www.reddit.com/r/unRAID/comments/110jpt2/warning_crucial_mx500_ssd_firmware_bug_can/?rdt=63988>

Can you spell \"not-ready-for-primetime\"?

 

[Martin Brown]

On 01/10/2023 15:24, John Larkin wrote:

On Sat, 30 Sep 2023 18:13:06 -0700 (PDT), whit3rd <whit3rd@gmail.com
wrote:

On Friday, September 29, 2023 at 4:27:27?PM UTC-7, gggg gggg wrote:
Is there a simple command that will wipe out all info/data?

Yes, but it\'ll cost ya. There are disk drives that secure the data by
encrypting on-the-fly all the time, and decrypt on-the-fly so it all
happens transparently. They\'re \'enterprise\' models, sometimes
with odd (SAS, fibre channel, whatever-it-is-this-decade) connection
requirements.

Those drives store an internal key that can be overwritten when you want
to lose the data. Even \'bad blocks\' are encrypted, so the loss of the
key makes every bit of the data on the drive into... semi-random bits.

Just delete the embarassing stuff and write a giant random file until
the drive is full. Nobody but maybe the CIA has a chance to recover
anything after that.

That is about what the standard zappers do except that you have to do it
two or three times over to weaken residual signals. It depends what
technical level of adversary you expect to be going up against.

Most times what you suggest will be good enough. Although you could be
unlucky and find your entire password file in plaintext sat inside a bad
block (if you were daft enough to store it that way).

--
Martin Brown

 

[Don Y]

On 10/2/2023 1:27 AM, Martin Brown wrote:

That is about what the standard zappers do except that you have to do it two or
three times over to weaken residual signals. It depends what technical level of
adversary you expect to be going up against.

Writing a file implies you have a file SYSTEM.

A file system has metadata that is typically not stored in the file
itself. So, a record of the (deleted) files still exists.

You\'re in correspondence with a \"J.Epstein\". Your MUA has thoughtfully
create a J.Epstein folder for your email exchanges. Fearing you may be
implicated in some of J.Epstein\'s nefarious activities, you delete
all of the messages archived, there, overwriting the blocks that they
used with multiple passes of \"random\" data. AND, the folder itself.

But, the fact that a \"J.Epstein\" folder *existed* is still preserved in the
file system\'s metadata.

How much do you know about ALL of the applications that you use?
What if you want to remove all traces of some application from
your system; can you do so? (remember, any folders/subdirectories
that it created must be scrubbed ALONG WITH THE REFERENCES *to* THEM!

Is any record of the websites you visit persistent in the system,
perhaps in a place that you can\'t access (or aren\'t aware of)?

Is there a record of the hosts that have connected to your system?
What else might that record contain? What value having a list of
hostnames (presumably on your subnet)?

If O.BinLaden had a login on your machine, could you remove all
traces of that? Do you know where those crumbs might reside??
Is there value in knowing that \"O.BinLaden\" was (or is) a valid userID?

You *know* that windows stores an identifier of each hardware device
that it has ever encountered (in the Registry). So, could a thumb drive
containing \"something bad\" found SOMEWHERE ELSE be tied to you? How will
you ensure there is no record of that thumb drive having visited your
computer?

Unless you can qualify what you consider to be \"important data\",
you likely have little chance of purging it -- without overwriting
the ENTIRE medium. Chances are, there are more things that leave
crumbs than you can imagine.

Most times what you suggest will be good enough. Although you could be unlucky
and find your entire password file in plaintext sat inside a bad block (if you
were daft enough to store it that way).

Or, a record of your login ID for a ecommerce website. Even if there is
no password stored, knowing your account name/number can be valuable
to someone. Knowing that SomeEmailAddress@SomeDomain is a VALID email
address has value to someone who wants to spam it (as there is no other
way of knowing if an email address is valid in the absence of bounces)

[This is why phone spammers want you to \"press one to opt out\"...
it gives a positive confirmation that their message reached human
ears. So, *another* -- and another -- message will likely also reach
those ears! After all, that is their goal!]