Helping people with computers... one answer at a time.

Free space wiping removes the ability to undelete files. Whether or not you need it, or how often, depends on how interesting your data might be.

I read your article about CCleaner's file deletion overwrite, which I tried on my Windows Vista. Mine took about three hours to do. My question is how often should I use this file deletion in general? Once per month? I am really clueless about that. I am referring to the CCleaner's wipe section.

Well, let me put it this way....

I never run it.

With that having been said, let's look at why you might want to run it, and from that, see if we can come up with some ideas for how often it might make sense to run.

Deleted files aren't deleted

By now, I think that most people realize that when you delete a file - even emptying the Recycle Bin, if that was used - the data that was contained in the file remains on the disk. The area that contains the data is marked as free, but the data is not actually overwritten until a new file is written in exactly the same place sometime later.

And later could be milliseconds or it could be months.

Thus, until that overwrite actually happens, we have the ability to "un-delete" a file using tools like Recuva.

Drive wiping utilities

CCleaner's Drive Wiping tool

CCleaner's Drive Wiper is one example of a tool that is meant to remove this ability to undelete.

The concept is simple. The drive wiper just writes data of some sort in all of the spaces on your hard disk where no files are currently stored: all the space that's marked as free. As a result, anything left in that free space that could have been used to recover or un-delete a file is removed.

If you have a lot of free space, that could take some time.

How often?

Now, to your real question: how often should you do this?

It depends.

To me, it depends on three things:

  • It depends on just how sensitive the data that could be recovered might be. In general, with browser caching and temporary files and who knows what else, it's pretty safe to assume that there's some sensitive data in the unused areas of your hard disk.

  • It depends on just how likely it is that your hard disk is to fall into the hands of someone else - either by loss or theft.

  • It depends on just how likely it is that someone who ends up with your hard disk will bother to see what's in the free space.

It's that last one that, for me, reduces the need for free space wiping to near zero for most people.

Face it, folks. We're just not that interesting. Smile

And, perhaps more to the point, there's probably much more interesting stuff in the files that haven't been deleted. If a thief wants to go spelunking for data, they'll probably find plenty in the files and folders that already exist.

Sometimes they are after you

On the other hand, perhaps you are the target of someone's attention. Perhaps you do have a sensitive job or work in a sensitive industry where data theft and espionage are not only possible, but even likely.

There are several additional steps (like encryption) that you should be taking, but when it comes to free-space wiping, then I'd be doing it often.

If it's important, I'd do it nightly.

But, as I said, it's just not that important for the vast majority of people.

Sometimes, they're really, REALLY after you

Everything that I've discussed above applies to what CCleaner terms a "Simple Overwrite (1 pass)". A simple overwrite does exactly what's described above: it overwrites the free space and prevents common file recovery utilities from undeleting deleted files.

If someone is seriously after your data, that could potentially be not enough.

As I discussed in What difference does multiple-overwrite delete really make? there are techniques - expensive techniques - that can be used by those who are sufficiently motivated that may be able to recover some or all of the data that has been overwritten once.

The solution is to overwrite it more than once. CCleaner offers the option of overwriting 3, 7, and even 35 times.

Three's probably plenty, but if you're in some top-secret government agency, perhaps you'll want to consider more.

And once again, three is overkill for the average user.

Zero's probably just fine.

Article C5106 - March 7, 2012 « »

Share this article with your friends:

Share this article on Facebook Tweet this article Email a link to this article
Leo Leo A. Notenboom has been playing with computers since he was required to take a programming class in 1976. An 18 year career as a programmer at Microsoft soon followed. After "retiring" in 2001, Leo started Ask Leo! in 2003 as a place for answers to common computer and technical questions. More about Leo.

Not what you needed?

12 Comments
Shelly
March 9, 2012 8:24 AM

I made a video in Windows Movie Maker. I had this video saved on my computer.

I did a complete reset to factory settings and lost that video (I thought I had it on a disk - I was wrong).

Is there any way to use Recuva to recover a file following a "reset to factory settings?"

The last reset was done well over a year ago. I know I've used CCleaner in the past but don't believe that I've used it since my last reset (it's not installed on my computer now). I've done multiple resets and don't remember where in the process of the multiple resets & use of CCleaner that the video was deleted.

Windows Vista Home Premium 64-bit Svc pk2

Thank you!

reuben
March 9, 2012 12:45 PM

If someone works for an ultra-top secret company and possesses some super sensitive information, would not the person's company give a seminar or tutorial on how to keep their data safe? I find it idiotic to hire someone to keep sensitive data and not teach him/her some techniques to safeguard it.

I agree. And yet, that education often does not happen, or when it does people don't follow the guidelines. We hear about sensitive data lost via lost or stolen laptops often.
Leo
09-Mar-2012
bob price
March 9, 2012 1:17 PM

My son works for a large aircraft company and the designs are highly secret. Their IT dept discovered that not one "wipe out" program worked 100%. They now crush all old hard drives and incinerate the debris.

John
March 9, 2012 2:32 PM

I have noticed that CC Cleaner is available for Macs now!

ausGeoff
March 9, 2012 3:23 PM

I run CCleaner on a daily basis — before I shut down my PC for the night (possibly overkill, bit it only takes seconds to run on my machine). I have noticed that CCleaner takes differing times to run depending on the particular browser you're running.

Firefox is around 3-5 seconds, Chrome around 20-30 seconds, and finally IE(x) anything up to 2-3 minutes! This seems to be caused by the way each browser organises its caching.

I'm guessing that were one to run CCleaner for the very first and only time on a machine, there's a chance it could take three hours to finish its scan, particularly if you've been tardy with your PC's "housework" over a lengthy period of time.

I always use CCleaner's three-pass method as I reckon this is more than sufficient for any average home user. I agree with Leo that 37 passes, whilst not only massive overkill, is a pointless waste of time better spent doing other system housework.

—Geoff, Australia.


The person asking the question wasn't using the cleaning function, but the drive wipe function which can easily take a lot of time.
Leo
09-Mar-2012

Alex
March 9, 2012 4:23 PM

Shelly :),
Why would you not simply try it? You can get a free version of Recuva (just click on the underlined 'Recuva' word itself in this Leo's article which will then take you to his another article on Recuva where there's a link to their official website with a download of a free version (yes, Leo always does (re)direct you to the official website(s) of whatever he recommends).
No harm to try... Install it and perform a recovery. Unless you don't want to install something that you wouldn't use often enough. But how important could that deleted file be to you? At the end of the day you can always uninstall it. Or, if you happen to have Acronis TIH installed on your machine then you can simply perform a Recuva installation and file recovery while in 'Try&Decide' mode.
I recall there's also a portable version of free Recuva (not sure if still, but recall the discussions about it, - just browse the comments in Leo's article on Recuva).

Alex
March 9, 2012 4:29 PM

Shelly, btw, talking Recuva is slightly off the topic in this article - sorry! :) Best, search Leo's answers first! :)

Mark J
March 9, 2012 4:51 PM

@Shelly
Unfortunately, a factory re-install overwrites everything on your hard drive. There may be a small outside chance that if the file resides on an unwritten portion of the drive, it might be recoverable shortly after the re-install. But after a year of use since the re-install, the likelihood of recovery is virtually zero.

Bob
March 9, 2012 5:49 PM

There are additional aspects that should be addressed in an article like this, namely the free space at the tail end of the last sector of a file, the deleted entries in the file directory (which still contain nearly complete file names), and the swap file on the hard drive. Perhaps even the hibernation file on the hard drive. A program such as BCWipe will wipe all of these, except perhaps the hibernation file. From what I've read about CCleaner, it doesn't address these concerns. If your hard drive had super sensitive data on it, then you will want to consider these areas, because the bad guys probably will.

Nat
March 10, 2012 6:39 PM

I had a friend that had his house broken into and computers stolen. Because he had all his records on the computer, he had to get all new credit cards etc. etc. At that point you have no idea how sophisticated the burglar was although the likelihood is that they are not all that computer savvy. However, with the computer gone am I willing to risk it. Since then, I encrypted my data drive and run Eraser in the background at night to erase the free space.

Question: Does cleaning the free space add anything if the drive is encrypted?

Only if someone can decrypt it. On an encrypted drive (or other encrypted volume such as TrueCrypt) even the free space is encrypted. If they can't decrypt it then wiping has no real benefit.
Leo
17-Mar-2012
Yeppers
March 19, 2012 10:34 PM

Leo, based on your reply to Nat’s 3/10/12 question, it sounds like CCleaner can wipe a free space even if that free space is encrypted (ie., no need to decrypt first) – is that correct?

Plus, you had mention in another article that using a file shredder causes accelerated wear on a flash/thumb drive. Does wiping the free space on a flash/thumb drive also cause the flash drive to wear out faster?

Thanks…

Mark J
March 20, 2012 1:33 AM

@Yeppers
It would not be possible to wipe the free space inside an encrypted file with out first opening it. Since the free space is encrypted, the free space cleaner would have no way of determining what is free space or not. In any case, there is no need to wipe the free space on encrypted data as this free space would be inaccessible due to the encryption.

Comments on this entry are closed.

If you have a question, start by using the search box up at the top of the page - there's a very good chance that your question has already been answered on Ask Leo!.

If you don't find your answer, head out to http://askleo.com/ask to ask your question.