Overwriting files on NTFS?

BackupUser · Post by **BackupUser** » Sat Sep 28, 2002 2:19 am

Restored from previous forum. Originally posted by PB.

The following code, used to "securely" delete a file, only works for
me on FAT16/32 drives, and not with NTFS drives. On FAT16/32 drives,
the file is overwritten with random data, but with NTFS, it's not
overwritten UNLESS I remove the DeleteFile command... Strange! That
is, if I leave DeleteFile in, then when I "undelete" the file with
PC File Inspector Recovery the file holds 1234567890, but if remove
DeleteFile then the file DOES contain random data. I can't see any
logical reason for this...

Code: Select all

a$="d:\aaaaaaaaaa.txt" ; D:\ is my NTFS drive.
;
If CreateFile(0,a$)
  WriteString("1234567890")
  CloseFile(0)
  If OpenFile(0,a$)
    For r=0 To Lof()-1
      FileSeek(r)
      WriteByte(Random(255))
    Next
    CloseFile(0)
    DeleteFile(a$)
  EndIf
EndIf

PB - Registered PureBasic Coder

BackupUser · Post by **BackupUser** » Sat Sep 28, 2002 3:20 am

Restored from previous forum. Originally posted by Hi-Toro.

I don't know the reason, but if you go to [url]http://www.sysinternals.com,[/url] they have a secure deletion utility with C source (looks pretty simple, and I think it works on NTFS)...

--
See ya,
James L Boyd.
http://www.hi-toro.com/
--

BackupUser · Post by **BackupUser** » Sat Sep 28, 2002 3:28 am

Restored from previous forum. Originally posted by PB.

> I don't know the reason, but if you go to [url]http://www.sysinternals.com,[/url]
> they have a secure deletion utility with C source (looks pretty
> simple, and I think it works on NTFS)...

Yeah, I've tried SDelete from there and it works with NTFS, so I'm
curious as to why using DeleteFile (and even the DeleteFile API) seems
to prevent the overwriting done by PureBasic. Fred, you reading this?

PB - Registered PureBasic Coder

BackupUser · Post by **BackupUser** » Sat Sep 28, 2002 2:13 pm

Restored from previous forum. Originally posted by Berikco.

NTFS is a journaling file system, it is a recoverable file system because it keeps track of transactions against the file system.
So if you overwrite a file, and delete imediatly, it is smart enough to stop the transaction and don't put the changes to disk. Its all cached in memory.
Search info about NT cache manager.
I think you need FlushFileBuffers_() to dget this to work.

Regards,

Berikco

http://www.benny.zeb.be

BackupUser · Post by **BackupUser** » Sun Sep 29, 2002 1:00 am

Restored from previous forum. Originally posted by PB.

> I think you need FlushFileBuffers_() to get this to work.

I took at look the FlushFileBuffers API and it needs a handle to the
file to flush it... which means it won't work with my example at the
start of this thread. Does this mean I'll have to use the API routines
to open, write, close, and flush the file? Yuck...

PB - Registered PureBasic Coder

BackupUser · Post by **BackupUser** » Sun Sep 29, 2002 5:20 pm

Restored from previous forum. Originally posted by Berikco.

Originally posted by PB

> Does this mean I'll have to use the API routines
to open, write, close, and flush the file? Yuck...

Yep, until Fred makes it possible to get the Windows filehandle from PB, you will need API.
But just re-open the file for read after you overwrite should be enough.

Regards,

Berikco

http://www.benny.zeb.be

BackupUser · Post by **BackupUser** » Sun Sep 29, 2002 5:30 pm

Restored from previous forum. Originally posted by Berikco.

PB, try this, don't know it does the job for you're overwrite function.

Code: Select all

FileName$="test.txt"If CreateFile(0,FileName$)
  WriteString("1234567890")
  CloseFile(0)
  hfile = CreateFile_(FileName$, #GENERIC_READ, #FILE_SHARE_READ, #Null, #OPEN_EXISTING, 0, #Null)
  FlushFileBuffers_(hfile) 
  CloseHandle_(hfile)
EndIf

Regards,

Berikco

http://www.benny.zeb.be

BackupUser · Post by **BackupUser** » Sun Sep 29, 2002 8:06 pm

Restored from previous forum. Originally posted by Pupil.

Originally posted by PB
I took at look the FlushFileBuffers API and it needs a handle to the
file to flush it... which means it won't work with my example at the
start of this thread. Does this mean I'll have to use the API routines
to open, write, close, and flush the file? Yuck...

I may be wrong, but i think PureBasic returns the handle when opening a file, like this:
FileHandle.l = OpenFile(0,"myFile.txt")

BackupUser · Post by **BackupUser** » Sun Sep 29, 2002 8:13 pm

Restored from previous forum. Originally posted by Berikco.

Originally posted by Pupil
I may be wrong, but i think PureBasic returns the handle when opening a file,

I think you're wright Pupil, but could not find this in the docs.
This test returns the Same handle.
So not so much API stuff needed PB.

Code: Select all

FileName$="test.txt"
a=CreateFile(0,FileName$)
Debug a
WriteString("1234567890")
CloseFile(0)
hfile = CreateFile_(FileName$, #GENERIC_READ, #FILE_SHARE_READ, #Null, #OPEN_EXISTING, 0, #Null)
Debug hfile
FlushFileBuffers_(hfile) 
CloseHandle_(hfile)

Regards,

Berikco

http://www.benny.zeb.be

BackupUser · Post by **BackupUser** » Sun Sep 29, 2002 9:25 pm

Restored from previous forum. Originally posted by PB.

Thanks all, I'll give it a try.

PB - Registered PureBasic Coder